Edit tour

Windows Analysis Report
wLw52XmkOM.exe

Overview

General Information

Sample name:	wLw52XmkOM.exe renamed because original name is a hash value
Original sample name:	e78473bca17b8e1e7353570719b5ad0c.exe
Analysis ID:	1447538
MD5:	e78473bca17b8e1e7353570719b5ad0c
SHA1:	b86d03c15612419b13245d8593a6f843775f7d20
SHA256:	f81de3b76d2e7f5166c6029cbd9918dcc6c8649bb0d9f869a76e141b3abca791
Tags:	32exeRedLineStealer
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

wLw52XmkOM.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\wLw52XmkOM.exe" MD5: E78473BCA17B8E1E7353570719B5AD0C)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wLw52XmkOM.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8D 88 44 24 2B 88 44 24 2F B0 86 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.wLw52XmkOM.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8D 88 44 24 2B 88 44 24 2F B0 86 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.wLw52XmkOM.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8D 88 44 24 2B 88 44 24 2F B0 86 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wLw52XmkOM.exe	ReversingLabs: Detection: 34%
Source: wLw52XmkOM.exe	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 68.9% probability

Machine Learning detection for sample

Source: wLw52XmkOM.exe

Joe Sandbox ML: detected

Source: wLw52XmkOM.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: _.pdb source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1624510010.000000000079F000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: STHealthUp.pdbh; source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886873518.0000000004A20000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: STHealthUp.pdb source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886873518.0000000004A20000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp

Source: wLw52XmkOM.exe, 00000000.00000003.1635643956.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: wLw52XmkOM.exe, 00000000.00000003.1646452465.00000000055BF000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1647359223.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646106838.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646237880.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1645838759.00000000055BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: wLw52XmkOM.exe, 00000000.00000003.1646452465.00000000055BF000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646106838.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646237880.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1645838759.00000000055BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html.
Source: wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636140853.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636217370.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636834509.00000000055D2000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636180894.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: wLw52XmkOM.exe, 00000000.00000003.1636266529.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636217370.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comP
Source: wLw52XmkOM.exe, 00000000.00000003.1636834509.00000000055D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: wLw52XmkOM.exe, 00000000.00000003.1636266529.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636217370.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636180894.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comitkY
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: wLw52XmkOM.exe, 00000000.00000003.1636266529.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comt
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designerse
Source: wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com=
Source: wLw52XmkOM.exe, 00000000.00000003.1646473890.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF4if
Source: wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaYi
Source: wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comived
Source: wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como.jp/
Source: wLw52XmkOM.exe, 00000000.00000003.1646473890.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comtalic
Source: wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comx
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: wLw52XmkOM.exe, 00000000.00000003.1634015778.00000000055B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnd
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/4if
Source: wLw52XmkOM.exe, 00000000.00000003.1637962712.00000000055A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/8
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Fit
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Fy
Source: wLw52XmkOM.exe, 00000000.00000003.1638331422.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1637962712.00000000055A4000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Giw
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Oi
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Pi
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1637962712.00000000055A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Yi
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/bi
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/4if
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638331422.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Yi
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/ki
Source: wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ki
Source: wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: wLw52XmkOM.exe, 00000000.00000003.1642096502.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.Yf5
Source: wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: wLw52XmkOM.exe, 00000000.00000003.1629865595.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630753132.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1629956611.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630346475.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630220282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630021282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com6
Source: wLw52XmkOM.exe, 00000000.00000003.1629865595.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630753132.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1629956611.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630346475.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630220282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630021282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comB
Source: wLw52XmkOM.exe, 00000000.00000003.1629865595.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630753132.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1629956611.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630346475.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630220282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630021282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comednj
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: wLw52XmkOM.exe, 00000000.00000003.1635643956.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.&Fc
Source: wLw52XmkOM.exe, 00000000.00000003.1635643956.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnueFA

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: 0_2_0702F186 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_0702F186

System Summary

Malicious sample detected (through community Yara rule)

Source: wLw52XmkOM.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.wLw52XmkOM.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.wLw52XmkOM.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0040DC11	0_2_0040DC11
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00407C3F	0_2_00407C3F
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00418CCC	0_2_00418CCC
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00406CA0	0_2_00406CA0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_004028B0	0_2_004028B0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0041A4BE	0_2_0041A4BE
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00418244	0_2_00418244
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00401650	0_2_00401650
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00402F20	0_2_00402F20
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_004193C4	0_2_004193C4
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00418788	0_2_00418788
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00402F89	0_2_00402F89
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00402B90	0_2_00402B90
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_004073A0	0_2_004073A0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_02161030	0_2_02161030
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_02161020	0_2_02161020
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_04A8D3CC	0_2_04A8D3CC
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_05371C00	0_2_05371C00
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_05370040	0_2_05370040
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_05371BF1	0_2_05371BF1
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B1E08	0_2_066B1E08
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B1E0C	0_2_066B1E0C
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B8B8B	0_2_066B8B8B
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B9188	0_2_066B9188
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066F600C	0_2_066F600C
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_070249C0	0_2_070249C0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0702A8D0	0_2_0702A8D0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_070200F9	0_2_070200F9
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0702A8D0	0_2_0702A8D0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_07022750	0_2_07022750
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0702563F	0_2_0702563F
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_070249C0	0_2_070249C0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: String function: 0040E1D8 appears 43 times

Source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2884219674.000000000264B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2884219674.000000000264B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2884219674.000000000264B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000003.1621437550.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000003.1624510010.000000000079F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000003.1621536508.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000000.1619610533.0000000000426000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2886873518.0000000004A20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs wLw52XmkOM.exe
Source: wLw52XmkOM.exe	Binary or memory string: OriginalFilenameSTHealthUp.exe6 vs wLw52XmkOM.exe

Source: wLw52XmkOM.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: wLw52XmkOM.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.wLw52XmkOM.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.wLw52XmkOM.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'

Source: wLw52XmkOM.exe, 00000000.00000002.2882166975.0000000000720000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBp

Source: classification engine

Classification label: mal68.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

0_2_004019F0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Mutant created: \Sessions\1\BaseNamedObjects\STHealthUp

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Command line argument: 08A

0_2_00413780

Source: wLw52XmkOM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wLw52XmkOM.exe	ReversingLabs: Detection: 34%
Source: wLw52XmkOM.exe	Virustotal: Detection: 40%

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: wLw52XmkOM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: _.pdb source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1624510010.000000000079F000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: STHealthUp.pdbh; source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886873518.0000000004A20000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: STHealthUp.pdb source: wLw52XmkOM.exe, 00000000.00000002.2883688606.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1621827937.0000000000778000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2883523183.0000000002239000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886873518.0000000004A20000.00000004.08000000.00040000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2886783889.00000000035E1000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777365)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777266)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777259))})
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777365)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777266)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777259))})
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777365)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777266)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777259))})
Source: 0.2.wLw52XmkOM.exe.23e0f32.4.raw.unpack, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777365)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777266)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777259))})
Source: 0.3.wLw52XmkOM.exe.7786e2.0.raw.unpack, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777365)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777266)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777259))})
Source: 0.2.wLw52XmkOM.exe.360db90.7.raw.unpack, DyyVDbaRvM1YfIq9il.cs	.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777365)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777266)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.dDYu3EUMgtAH5(16777259))})

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

0_2_004019F0

Source: wLw52XmkOM.exe

Static PE information: real checksum: 0x23bfb should be: 0x42be2

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0040E21D push ecx; ret	0_2_0040E230
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0040BB97 push dword ptr [ecx-75h]; iretd	0_2_0040BBA3
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_04A843C1 push 5D6CF1B3h; ret	0_2_04A843D9
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B7EEF push es; retf	0_2_066B7EF0
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B7F7B push es; iretd	0_2_066B7F7C
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B7F33 push es; ret	0_2_066B7F38
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066BF05B pushad ; retf	0_2_066BF061
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066B802F push es; iretd	0_2_066B8030
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066FF6D8 pushfd ; iretd	0_2_066FF6E1
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066F9760 push es; ret	0_2_066F9770
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_066FBA09 push E406D045h; iretd	0_2_066FBA15
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_07028E20 pushfd ; ret	0_2_07028E29
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_07021151 pushfd ; iretd	0_2_0702115D
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0702F179 push eax; ret	0_2_0702F185
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_07029863 pushad ; retf	0_2_07029879
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0702987B push esp; retf	0_2_07029881
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0702C09F push es; ret	0_2_0702C0A0

Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'GBHu3EOUCogsl', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 0.2.wLw52XmkOM.exe.35e64a2.8.raw.unpack, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'GBHu3EOUCogsl', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 0.2.wLw52XmkOM.exe.227a9d0.2.raw.unpack, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'GBHu3EOUCogsl', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 0.2.wLw52XmkOM.exe.4a20000.9.raw.unpack, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'
Source: 0.2.wLw52XmkOM.exe.23e0f32.4.raw.unpack, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'GBHu3EOUCogsl', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 0.2.wLw52XmkOM.exe.23e0f32.4.raw.unpack, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'
Source: 0.3.wLw52XmkOM.exe.7786e2.0.raw.unpack, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'GBHu3EOUCogsl', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 0.3.wLw52XmkOM.exe.7786e2.0.raw.unpack, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'
Source: 0.2.wLw52XmkOM.exe.360db90.7.raw.unpack, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'GBHu3EOUCogsl', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 0.2.wLw52XmkOM.exe.360db90.7.raw.unpack, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Memory allocated: 2160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Memory allocated: 25E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Memory allocated: 2320000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

0_2_004019F0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

API call chain: ExitProcess graph end node

graph_0-66403

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040CE09

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

0_2_004019F0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

0_2_004019F0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree,

0_2_0040ADB0

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040CE09
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040E61C
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416F6A
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Code function: 0_2_004123F1 SetUnhandledExceptionFilter,	0_2_004123F1

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: GetLocaleInfoA,

0_2_00417A20

Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wLw52XmkOM.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412A15

Source: C:\Users\user\Desktop\wLw52XmkOM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
wLw52XmkOM.exe	34%	ReversingLabs
wLw52XmkOM.exe	41%	Virustotal	Browse
wLw52XmkOM.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.zhongyicts.com.cnueFA	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com6	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Fit	0%	Avira URL Cloud	safe
http://www.fontbureau.como.jp/	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comB	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Pi	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Fit	0%	Virustotal		Browse
http://www.fontbureau.comF4if	0%	Avira URL Cloud	safe
http://www.fontbureau.comaYi	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/4if	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/8	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comednj	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Pi	0%	Virustotal		Browse
http://www.fontbureau.como.jp/	0%	Virustotal		Browse
http://www.ascendercorp.com/typedesigners.html.	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designerse	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Fy	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/8	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/Y0	0%	Avira URL Cloud	safe
http://www.carterandcone.comP	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html.	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/jp/ki	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Oi	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Y0	0%	Virustotal		Browse
http://www.zhongyicts.com.cno.&Fc	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designerse	0%	Virustotal		Browse
http://www.fontbureau.com=	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnd	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Fy	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/bi	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/ki	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/jp/4if	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Oi	0%	Virustotal		Browse
http://www.carterandcone.comTC	0%	Avira URL Cloud	safe
http://www.carterandcone.comitkY	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Giw	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/bi	0%	Virustotal		Browse
http://www.fontbureau.comived	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnd	1%	Virustotal		Browse
http://www.carterandcone.comt	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	Avira URL Cloud	safe
http://www.fontbureau.comd	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/ki	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/Yi	0%	Avira URL Cloud	safe
http://www.fontbureau.comtalic	0%	Avira URL Cloud	safe
http://www.monotype.Yf5	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/t	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/Yi	0%	Avira URL Cloud	safe
http://www.fontbureau.comx	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/t	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/ki	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/Yi	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Fit	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com6	wLw52XmkOM.exe, 00000000.00000003.1629865595.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630753132.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1629956611.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630346475.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630220282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630021282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnueFA	wLw52XmkOM.exe, 00000000.00000003.1635643956.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como.jp/	wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.tiro.com	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comB	wLw52XmkOM.exe, 00000000.00000003.1629865595.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630753132.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1629956611.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630346475.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630220282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630021282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Pi	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636140853.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636217370.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636834509.00000000055D2000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636180894.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comaYi	wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF4if	wLw52XmkOM.exe, 00000000.00000003.1646473890.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/4if	wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/8	wLw52XmkOM.exe, 00000000.00000003.1637962712.00000000055A4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comednj	wLw52XmkOM.exe, 00000000.00000003.1629865595.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630753132.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1629956611.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630346475.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630220282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630021282.00000000055BB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1630132733.00000000055BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.html.	wLw52XmkOM.exe, 00000000.00000003.1646452465.00000000055BF000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646106838.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646237880.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1645838759.00000000055BF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designerse	wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Fy	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.carterandcone.comP	wLw52XmkOM.exe, 00000000.00000003.1636266529.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636217370.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.html	wLw52XmkOM.exe, 00000000.00000003.1646452465.00000000055BF000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1647359223.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646106838.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1646237880.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1645838759.00000000055BF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/ki	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Oi	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cno.&Fc	wLw52XmkOM.exe, 00000000.00000003.1635643956.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com=	wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnd	wLw52XmkOM.exe, 00000000.00000003.1634015778.00000000055B7000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/bi	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	wLw52XmkOM.exe, 00000000.00000003.1635643956.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/4if	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comTC	wLw52XmkOM.exe, 00000000.00000003.1636834509.00000000055D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comitkY	wLw52XmkOM.exe, 00000000.00000003.1636266529.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636217370.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636180894.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Giw	wLw52XmkOM.exe, 00000000.00000003.1638331422.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1637962712.00000000055A4000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comived	wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comt	wLw52XmkOM.exe, 00000000.00000003.1636266529.00000000055D1000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1636309621.00000000055D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.comd	wLw52XmkOM.exe, 00000000.00000003.1642522152.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/ki	wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comtalic	wLw52XmkOM.exe, 00000000.00000003.1646473890.00000000055AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/Yi	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638331422.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.Yf5	wLw52XmkOM.exe, 00000000.00000003.1642096502.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/t	wLw52XmkOM.exe, 00000000.00000003.1640433108.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638549054.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Yi	wLw52XmkOM.exe, 00000000.00000003.1640224705.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639512013.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639681409.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1638962512.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639188257.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1639952825.00000000055AB000.00000004.00000020.00020000.00000000.sdmp, wLw52XmkOM.exe, 00000000.00000003.1637962712.00000000055A4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	wLw52XmkOM.exe, 00000000.00000003.1638725711.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	wLw52XmkOM.exe, 00000000.00000002.2887586288.0000000006722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comx	wLw52XmkOM.exe, 00000000.00000003.1640543348.00000000055AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447538
Start date and time:	2024-05-25 23:41:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wLw52XmkOM.exe renamed because original name is a hash value
Original Sample Name:	e78473bca17b8e1e7353570719b5ad0c.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 62 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.3849491452610065
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	wLw52XmkOM.exe
File size:	263'168 bytes
MD5:	e78473bca17b8e1e7353570719b5ad0c
SHA1:	b86d03c15612419b13245d8593a6f843775f7d20
SHA256:	f81de3b76d2e7f5166c6029cbd9918dcc6c8649bb0d9f869a76e141b3abca791
SHA512:	918d8ab9fcde9448e56e84f73a14f081d0514ca537853e4c3970ab4b094f92476c6a9a17456115e89c9ef70433c5225384e6d3e5f23c7e3acd2ae80c95940409
SSDEEP:	6144:WDKW1Lgbdl0TBBvjc/ZbIu2CZd/5E4Nwsxx0L9QqL8:Qh1Lk70TnvjcN2kVvDp
TLSH:	0644BE117181C2B3C4B7113045E6CB769E3A70314BBA96DBB6DD1BBA6F213D1A3362C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~................W.Md....PE..L...t..P..........#........

File Icon


Icon Hash:	072919949c39230f

Static PE Info

General

Entrypoint:	0x40cd2f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5000A574 [Fri Jul 13 22:47:16 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf5a4aa99e5b160f8521cadd6bfe73b8

Entrypoint Preview

Instruction
call 00007FB48914B1D6h
jmp 00007FB489145399h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FB4891454FEh
test byte ptr [eax], 00000008h
je 00007FB4891454F9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413563h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C4Ah
mov dword ptr [004228ECh], 00412BFEh
mov dword ptr [004228F0h], 00412C37h
mov dword ptr [004228F4h], 00412BA0h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 004134DBh
mov dword ptr [00422900h], 00412BBCh
mov dword ptr [00422904h], 00412B1Eh
mov dword ptr [00422908h], 00412AABh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007FB48914548Bh
call 00007FB48914BD10h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x1e334	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19718	0x19800	7b218b42526c4c548865f21c7cf3e479	False	0.5789483762254902	data	6.748603021116175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6db4	0x6e00	5826801f33fc1b607aa8e942aa92e9fa	False	0.5467329545454546	data	6.442956247632331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	2fe51a72ede820cd7cf55a77ba59b1f4	False	0.3126775568181818	data	3.2625868398009703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x1e334	0x1e400	59a5a7f3f063df96a7c190d2a2c98dc1	False	0.9312451575413223	data	7.819636407050906	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x261b4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5906 x 5906 px/m	0.5351913084553613
RT_RCDATA	0x2a3dc	0x19a0a	data	1.0003905877869868
RT_RCDATA	0x43de8	0x20	data	1.34375
RT_GROUP_ICON	0x43e08	0x14	data	1.1
RT_VERSION	0x43e1c	0x32c	data	0.4236453201970443
RT_MANIFEST	0x44148	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA
ole32.dll	OleInitialize
OLEAUT32.dll	SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysFreeString, SysAllocString

Target ID:	0
Start time:	17:41:52
Start date:	25/05/2024
Path:	C:\Users\user\Desktop\wLw52XmkOM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wLw52XmkOM.exe"
Imagebase:	0x400000
File size:	263'168 bytes
MD5 hash:	E78473BCA17B8E1E7353570719B5AD0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	85.1%
Signature Coverage:	5.1%
Total number of Nodes:	1091
Total number of Limit Nodes:	79

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

{, xrefs: 00401B4B
[, xrefs: 00401B37
E, xrefs: 00401E0F
W, xrefs: 00401B14
[, xrefs: 00402047
W, xrefs: 00401B23
!, xrefs: 00401B1E
D, xrefs: 00401DFB
v, xrefs: 00401E4B
%, xrefs: 004020FA
., xrefs: 0040201F
!, xrefs: 0040201A
4, xrefs: 00402074
v, xrefs: 0040206A
4, xrefs: 00402136
o, xrefs: 00402159
o, xrefs: 00401B8D
o, xrefs: 00402097
:, xrefs: 00401B28
W, xrefs: 00402033
", xrefs: 00401B0F
6, xrefs: 004020C5
___, xrefs: 0040227D
h, xrefs: 00401A6F
v, xrefs: 00401B5A
5, xrefs: 00402109
., xrefs: 00401B0A
*, xrefs: 004020E1
!, xrefs: 004020CF
*, xrefs: 00401A1F
U, xrefs: 004020F5
4, xrefs: 00401B64
8, xrefs: 00401BA9
0, xrefs: 00401BBD
', xrefs: 00401AF6
x, xrefs: 00401B78
V, xrefs: 00402038
W, xrefs: 004020E6
x, xrefs: 0040214A
v, xrefs: 0040212C
{, xrefs: 0040205B
x, xrefs: 00402088
{, xrefs: 00401E3C
V, xrefs: 00401E19
', xrefs: 00402006
x, xrefs: 00401E69
_._, xrefs: 00402257
{, xrefs: 0040211D
), xrefs: 0040202E

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: 224088bd6fdf40f00aacdd5f7db7c03047c3cc993abb63ba2c7175de51848a6e
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 224088bd6fdf40f00aacdd5f7db7c03047c3cc993abb63ba2c7175de51848a6e
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 066F600C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,00000000,?,?), ref: 066F62FE

Strings

B^., xrefs: 066F6072
B^., xrefs: 066F6043

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: PrivateProfileString
String ID: B^.$ B^.
API String ID: 1096422788-1586472816
Opcode ID: 187cbebf499f1507b2b7eb519de86d74a8b8454df3fbd396b8d6af8edd02a7ea
Instruction ID: 39da0224ef6035498ef1e98f8a99ccaef11462d9d33ef383e259a8f4f451b50c
Opcode Fuzzy Hash: 187cbebf499f1507b2b7eb519de86d74a8b8454df3fbd396b8d6af8edd02a7ea
Instruction Fuzzy Hash: 35C19A71D202198FDB54CFA8C9817AEBBF2BF48314F148529E959E7381DB749881CB82

Function 070200F9 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc34956bec03c70e81e631fed65c360a733e5f133d093fae2d8730b4c5090f6
Instruction ID: eb4ae14840c7a5bdbe27d093a9f1c56b31877f3161c54214531e881670490ed0
Opcode Fuzzy Hash: 0bc34956bec03c70e81e631fed65c360a733e5f133d093fae2d8730b4c5090f6
Instruction Fuzzy Hash: C9D16CB1A00329CFDB54DFA5C948BADBBF2BF44304F148259E409AF2A1DB74E946DB40

Function 0702A8D0 Relevance: 1.8, Strings: 1, Instructions: 522COMMON

Download Yara Rule

Strings

B^., xrefs: 0702A916

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: B^.
API String ID: 0-176575641
Opcode ID: 2bd38538bdbdde02d777cce966de5476acad965a7ebc67cf664b43cc5e85b2ed
Instruction ID: c4e532dfdcaf39bf15644c90be4bb3e689fe59e8af2a7769f2e4f91ae30edc13
Opcode Fuzzy Hash: 2bd38538bdbdde02d777cce966de5476acad965a7ebc67cf664b43cc5e85b2ed
Instruction Fuzzy Hash: 70323971A0062ACFCB61DF64C944BD9B7B2FF49300F1486D9E909AB221DB75AA85CF40

Function 070249C0 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb793f83cf918351cbff2b7b3bfe91608930f925fe669e520acc28447edb36fb
Instruction ID: 9b2bfb0e29ea4c8efbb6d440e8d53dc1ce3fc449572e190e041f78e1da1a1ad3
Opcode Fuzzy Hash: bb793f83cf918351cbff2b7b3bfe91608930f925fe669e520acc28447edb36fb
Instruction Fuzzy Hash: 5B524D75A1066ACFCB51DF64C844AE9B7B1FF49300F1486D9E409AB261EB31EE82DF40

Function 05371C00 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30446535b65ebe9057d61fed8226c10856f55863e7f774cdd8e9d4a02ef057b
Instruction ID: d6432794791a296e9f072b2aa65c5e7b60f611c289b6db6f33fc29ca747088bd
Opcode Fuzzy Hash: c30446535b65ebe9057d61fed8226c10856f55863e7f774cdd8e9d4a02ef057b
Instruction Fuzzy Hash: 7EA1A475E0031ACFCB14DFA4D8949DDFBBAFF89310F148219E41AAB2A5DB74A941CB50

Function 05371BF1 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedec8c390a16ebc0169fe2530ab2eb3db0c980b9bccaf184fd4163280a33392
Instruction ID: f49f97466d565023381c69fd3d8aee7b3280314d32c1022fb8d2486fc78e9a20
Opcode Fuzzy Hash: bedec8c390a16ebc0169fe2530ab2eb3db0c980b9bccaf184fd4163280a33392
Instruction Fuzzy Hash: 82919635E0030ADFCB14DFA0D8849DDFBBAFF99314F148219E419AB2A4DB74A946CB50

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 04A8CE48 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04A8CED6
GetCurrentThread.KERNEL32 ref: 04A8CF13
GetCurrentProcess.KERNEL32 ref: 04A8CF50
GetCurrentThreadId.KERNEL32 ref: 04A8CFA9

Strings

B^., xrefs: 04A8CE74

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: Current$ProcessThread
String ID: B^.
API String ID: 2063062207-176575641
Opcode ID: d83ac4e4a02a9428e128bc7540e3585a4e2b552866a5b965c0ffdf26b05248d2
Instruction ID: e4fa969f2e64a006fc8726a3f28f9ae3ac0785a1ab206b85bdd7f25d3beb4ad2
Opcode Fuzzy Hash: d83ac4e4a02a9428e128bc7540e3585a4e2b552866a5b965c0ffdf26b05248d2
Instruction Fuzzy Hash: 4E5159B09013098FEB14DFA9D548BDEBBF1EF88314F208059D559A72A0D734A985CF65

Function 04A8CE58 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04A8CED6
GetCurrentThread.KERNEL32 ref: 04A8CF13
GetCurrentProcess.KERNEL32 ref: 04A8CF50
GetCurrentThreadId.KERNEL32 ref: 04A8CFA9

Strings

B^., xrefs: 04A8CE74

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: Current$ProcessThread
String ID: B^.
API String ID: 2063062207-176575641
Opcode ID: 7ed57b1daf85e4857215ed625997ada82c8868eb590245ae3e45d728dbf2a7fc
Instruction ID: b78be956a78d1bd1ce4f468b532cef13048708111a7af4cb3cfa3947127f86a2
Opcode Fuzzy Hash: 7ed57b1daf85e4857215ed625997ada82c8868eb590245ae3e45d728dbf2a7fc
Instruction Fuzzy Hash: 5C5138B09003098FEB14DFA9D948BDEBBF1EF88314F208459E419A73A0D734A984CF65

Function 05373288 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 508COMMON

Download Yara Rule

Strings

B^., xrefs: 0537329F

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: B^.
API String ID: 0-176575641
Opcode ID: e9274e843275177e56049a4970dd373080d47f5fa363eade7282a3d239974e2a
Instruction ID: dae804dff9264ec9789c40a1b5663a5cb38838ed5a81a37d4b45ee7176253c56
Opcode Fuzzy Hash: e9274e843275177e56049a4970dd373080d47f5fa363eade7282a3d239974e2a
Instruction Fuzzy Hash: 9D224D74E0424DCFDB34DB58C589ABEBBB6FB88310F248856D812AB764C77C9881DB51

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 066F4DFC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,00000000,?,?), ref: 066F62FE

Strings

B^., xrefs: 066F6072
B^., xrefs: 066F6043

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: PrivateProfileString
String ID: B^.$ B^.
API String ID: 1096422788-1586472816
Opcode ID: f7a5fe0c09032137e87eb384e527925bae44c88bb0924d7fa4895eba1bba8ba4
Instruction ID: 1b0bb6ed0ce16be602c896c6cab68d82f25c0c95515d2cddf006dc8aa8985a59
Opcode Fuzzy Hash: f7a5fe0c09032137e87eb384e527925bae44c88bb0924d7fa4895eba1bba8ba4
Instruction Fuzzy Hash: 8FC19B71D20219CFDB54CFA8C9817AEBBF2BF48304F148529E959E7395DB749881CB82

Function 066F1E10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

B^., xrefs: 066F2022
Hbq, xrefs: 066F1EF1

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: B^.$Hbq
API String ID: 0-2870721958
Opcode ID: 9e49719ac7ef687cb6bf4d1005ee29cfb3664750d370b2c53d1f622170e3cdd2
Instruction ID: 1e40d9207d19780e61a340fc90181b01d9f4e7089e57ab10b8be4c511bab88df
Opcode Fuzzy Hash: 9e49719ac7ef687cb6bf4d1005ee29cfb3664750d370b2c53d1f622170e3cdd2
Instruction Fuzzy Hash: B071F272A002049FC754DB69D855BAFBFFAEB99350F14806AE1099B351DA30AD45CBE0

Function 066F6DE8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 217
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 066F6EE1

Strings

B^., xrefs: 066F6E12
B^., xrefs: 066F7157

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: CurrentThread
String ID: B^.$ B^.
API String ID: 2882836952-1586472816
Opcode ID: 9c02be315ea3e6938edd3af643def56eb3ebeebef1340145a7f165b6bdab5039
Instruction ID: de02551ff77199564583c564ddddd719fcdb3bda660d0da844d14c1904f28109
Opcode Fuzzy Hash: 9c02be315ea3e6938edd3af643def56eb3ebeebef1340145a7f165b6bdab5039
Instruction Fuzzy Hash: 9F818870E102488FDB54DFA9D944ADEBFF6BF88310F14842AD515AB3A0DB34A945CFA1

Function 053718E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05371A02

Strings

B^., xrefs: 0537191E
B^., xrefs: 0537193E

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID: CreateWindow
String ID: B^.$ B^.
API String ID: 716092398-1586472816
Opcode ID: 440741d687e9a772873dc6a5845e53586181740c71218df18dbeddab8801e3c0
Instruction ID: 6e295cfdf0fe928bf57b78d61bb4d4c8ac47244abac0d8d34b11054f40fce08f
Opcode Fuzzy Hash: 440741d687e9a772873dc6a5845e53586181740c71218df18dbeddab8801e3c0
Instruction Fuzzy Hash: C451CFB1D10349DFDB14CFA9D984ADEBBF5BF48310F24812AE819AB210D7749985CF91

Function 053718F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05371A02

Strings

B^., xrefs: 0537191E
B^., xrefs: 0537193E

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID: CreateWindow
String ID: B^.$ B^.
API String ID: 716092398-1586472816
Opcode ID: a2c057cf240085b4d6f7f4eee17ec49350e72dc4995e96ff9e6983010a014092
Instruction ID: 1bee7a965bbbea51c50878ce7c96852c8fe5b33ee19adf4dd0c9658e3d6ed23a
Opcode Fuzzy Hash: a2c057cf240085b4d6f7f4eee17ec49350e72dc4995e96ff9e6983010a014092
Instruction Fuzzy Hash: 6241BEB1D103499FDB14CFA9D984ADEBBF5BF48310F24812AE819AB210D7749985CF91

Function 0216B440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 0216B514

Strings

B^., xrefs: 0216B462
B^., xrefs: 0216B482

Memory Dump Source

Source File: 00000000.00000002.2883138040.0000000002160000.00000040.00000800.00020000.00000000.sdmp, Offset: 02160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2160000_wLw52XmkOM.jbxd

Similarity

API ID: LibraryLoad
String ID: B^.$ B^.
API String ID: 1029625771-1586472816
Opcode ID: 0072949e803c69f0f83e70be2b2fec7c4733c153f453932f6c841eb80277a1a1
Instruction ID: f7bad0de1b87f4f6b47797db2367eabe2c058a92f38849f9ba50dbd68d1cbe68
Opcode Fuzzy Hash: 0072949e803c69f0f83e70be2b2fec7c4733c153f453932f6c841eb80277a1a1
Instruction Fuzzy Hash: F13132B1D142588FDB10CFA9D9897AEBBF1AB48318F148129E819FB350D7749941CF92

Function 04A8AEC8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04A8B11E

Strings

B^., xrefs: 04A8B0D7

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: HandleModule
String ID: B^.
API String ID: 4139908857-176575641
Opcode ID: 9fbc456e8d36522878f21e574d7f6f1f4f64bda0b78a8511ef5d288e64ccc651
Instruction ID: 0b45fe4d936900a00e5e66ccc70fdeae6b576e8acf6b69af6dd285c64369f59d
Opcode Fuzzy Hash: 9fbc456e8d36522878f21e574d7f6f1f4f64bda0b78a8511ef5d288e64ccc651
Instruction Fuzzy Hash: 087115B0A00B058FD724EF29D54475ABBF5FF88304F108A2EE48A9BA50D775F946CB91

Function 066F6DD1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 144threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 066F6EE1

Strings

B^., xrefs: 066F6E12

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: CurrentThread
String ID: B^.
API String ID: 2882836952-176575641
Opcode ID: 42c09fe988d40cbdc98b73daf4c3607410f1de4bf6ec568419f0c187bd014110
Instruction ID: 25bd4668066232b05847c3a852aa36f2aae23f344f407a13a662888d555bb9af
Opcode Fuzzy Hash: 42c09fe988d40cbdc98b73daf4c3607410f1de4bf6ec568419f0c187bd014110
Instruction Fuzzy Hash: 6251AA70E102889FDB55DFA8C940ADDBFF6AF85300F18842AE555EB3A0CB34A845CB91

Function 04A80318 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 04A85B19

Strings

B^., xrefs: 04A85A9C

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: Create
String ID: B^.
API String ID: 2289755597-176575641
Opcode ID: 978339b5974b554533439407e17801477b8b611ce1934727215f454a055c798d
Instruction ID: 6c098ac0f0bb853a225cd0cf133e7c833fe2431230f743b5cb273d48a155a3a8
Opcode Fuzzy Hash: 978339b5974b554533439407e17801477b8b611ce1934727215f454a055c798d
Instruction Fuzzy Hash: AD41D2B0C00619DFDB24DFA9C884B9EBBF5FF58304F2480AAD408AB255EB756945CF90

Function 04A85A5D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 04A85B19

Strings

B^., xrefs: 04A85A9C

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: Create
String ID: B^.
API String ID: 2289755597-176575641
Opcode ID: 26c2777c505e0f69fb404c560d3db9b3ff33fd0b8769a8aa88e0cfadea33074f
Instruction ID: 4f87eeee007290c9f57c706254ffaa53bb880d000aa8500403093df82d3af9a2
Opcode Fuzzy Hash: 26c2777c505e0f69fb404c560d3db9b3ff33fd0b8769a8aa88e0cfadea33074f
Instruction Fuzzy Hash: 4041D2B0C00619DFDB24DFA9C88478EBBF5FF58304F24809AD408AB254EB756945CF91

Function 05373EC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05373F81

Strings

B^., xrefs: 05373ED7

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID: CallProcWindow
String ID: B^.
API String ID: 2714655100-176575641
Opcode ID: 6ebf33fb4e3f4f6ebd587eca889aca62ac1037312f5662a13bb9f50b90495b84
Instruction ID: 4c77eb84d18ef36880f2c1cf6d46c3e9dd3108774afd6a2c487dd4be0e5a971e
Opcode Fuzzy Hash: 6ebf33fb4e3f4f6ebd587eca889aca62ac1037312f5662a13bb9f50b90495b84
Instruction Fuzzy Hash: D841FBB9900309CFDB14CF99C448AAABBF5FF88314F24C859E519AB321D774A841CFA1

Function 066F7301 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 066F7385

Strings

B^., xrefs: 066F7342

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: MessagePost
String ID: B^.
API String ID: 410705778-176575641
Opcode ID: 9795ad64d60f96a8a08c657eff997d3f54773134a80a7e238da5f0a5caf1c425
Instruction ID: 29c0e87f646c28b1e03320d296998e6ff53d8ecc8ed12c761b3d0c22b4804c6d
Opcode Fuzzy Hash: 9795ad64d60f96a8a08c657eff997d3f54773134a80a7e238da5f0a5caf1c425
Instruction Fuzzy Hash: 3821B1718093859FCB11CF69E885BDABFF4EF0A314F18409AD554A7252C3349949CFA2

Function 066BD108 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 066BD197

Strings

B^., xrefs: 066BD12F

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID: FromMonitorPoint
String ID: B^.
API String ID: 1566494148-176575641
Opcode ID: 23ae85fe273469bc70a5abcda3dc7361ffcd9e8bdd24b68ecb458af948421c77
Instruction ID: bc9ed45db70d82cdb442b5a392ce2f5fa2cee1d7ab7c9e0f926f40591dd0e7ed
Opcode Fuzzy Hash: 23ae85fe273469bc70a5abcda3dc7361ffcd9e8bdd24b68ecb458af948421c77
Instruction Fuzzy Hash: 1A219CB4A00248DFDB10DF99D849BEEBFF4EB48310F548019E949AB380C778A944CFA5

Function 066F37A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 066F382C

Strings

B^., xrefs: 066F37D2

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: ClassInfo
String ID: B^.
API String ID: 3534257612-176575641
Opcode ID: d93ec9654f25ab75bf25c88ec6595e33449f827c32655972dca3275a71a63930
Instruction ID: 39b13223a6278ca52e04c7c611b75f88377fffe9a4bd97c379bb08347043814a
Opcode Fuzzy Hash: d93ec9654f25ab75bf25c88ec6595e33449f827c32655972dca3275a71a63930
Instruction Fuzzy Hash: CF2107B5D017499FDB14CF9AD984ADEFBF4BB48320F14802AE958A7340D378A944CBA5

Function 04A8D4A1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04A8D52F

Strings

B^., xrefs: 04A8D4C7

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: DuplicateHandle
String ID: B^.
API String ID: 3793708945-176575641
Opcode ID: e394de1cba88a2f2d2eee948258d0fb75074d184b16588c2351c7ab6c2943f5b
Instruction ID: c52bdece20bb27f79d1229de71ef8f4060b490a0615ec0f301388fc9ac855881
Opcode Fuzzy Hash: e394de1cba88a2f2d2eee948258d0fb75074d184b16588c2351c7ab6c2943f5b
Instruction Fuzzy Hash: D121E3B59002489FDB10CFA9D584ADEBFF4EB48314F14841AE918A7250D374AA54CFA5

Function 04A8D4A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04A8D52F

Strings

B^., xrefs: 04A8D4C7

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: DuplicateHandle
String ID: B^.
API String ID: 3793708945-176575641
Opcode ID: 211e832344bf77313ffdb8aaf93384a5ab667bef69cfa523df556df0d9346fc7
Instruction ID: d2789a1315ef07728bdca4773a462253e10ed6d7ce986d602ce5014a911018ee
Opcode Fuzzy Hash: 211e832344bf77313ffdb8aaf93384a5ab667bef69cfa523df556df0d9346fc7
Instruction Fuzzy Hash: AD21D3B59002589FDB10CFAAD984ADEFFF8FB48324F14841AE958A7350D374A944CFA5

Function 066F37B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 066F382C

Strings

B^., xrefs: 066F37D2

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: ClassInfo
String ID: B^.
API String ID: 3534257612-176575641
Opcode ID: 24630321b9d4f4029b8783c7c6c879461041891cea99c57655037c1aa6514ad8
Instruction ID: 7af57ab665fa676f54f3ab1a0a83b70b8a4186281e1367f71d64f2aaffa8c8db
Opcode Fuzzy Hash: 24630321b9d4f4029b8783c7c6c879461041891cea99c57655037c1aa6514ad8
Instruction Fuzzy Hash: 8E2115B5D017499FDB10CF9AD884ADEFBF4FB48310F14802AE958A7340D378A944CBA5

Function 066F13B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 066F1422

Strings

B^., xrefs: 066F13D7

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: TextWindow
String ID: B^.
API String ID: 530164218-176575641
Opcode ID: 3fb3b8460eb97353a0925858119cd996e14e16d862806c9d75cbd2e2c2a72e38
Instruction ID: 6028c1da75dff31b3eeb8681c3903c5211507745a297e019ef530968bf02767f
Opcode Fuzzy Hash: 3fb3b8460eb97353a0925858119cd996e14e16d862806c9d75cbd2e2c2a72e38
Instruction Fuzzy Hash: 5F2130B2C002498FCB10CF9AD844BEEFBF4EF89324F14842AD858A7640C339A545CFA5

Function 070208D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0702093D

Strings

B^., xrefs: 070208F7

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: B^.
API String ID: 2492992576-176575641
Opcode ID: 68afbbc50a543091c91babba9c45c355ccc16fa8de7aeac64faf326b791e828f
Instruction ID: e0d7c82adff6e1e144c43c42e1dd6344596a3784bfcea1cf346bf50de60fb273
Opcode Fuzzy Hash: 68afbbc50a543091c91babba9c45c355ccc16fa8de7aeac64faf326b791e828f
Instruction Fuzzy Hash: 77110AB5800359DFDB10CF9AD844BDEFBF8EB48314F14842AE554A7251C378A545CFA5

Function 04A8AAE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04A8B199,00000800,00000000,00000000), ref: 04A8B38A

Strings

B^., xrefs: 04A8B33F

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: LibraryLoad
String ID: B^.
API String ID: 1029625771-176575641
Opcode ID: fc620cc41ccf825b971c43f49dee9dfcf1e957184e4df39ae186ecce51e728b5
Instruction ID: 4756c3fc1c182625dd4688c575cc390fafad6c09dd6e160069af16c062fa9c85
Opcode Fuzzy Hash: fc620cc41ccf825b971c43f49dee9dfcf1e957184e4df39ae186ecce51e728b5
Instruction Fuzzy Hash: 9011F3B69003099FDB20DF9AD444ADEFBF4EB48310F14842EE559B7610C375A945CFA5

Function 04A8B319 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04A8B199,00000800,00000000,00000000), ref: 04A8B38A

Strings

B^., xrefs: 04A8B33F

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: LibraryLoad
String ID: B^.
API String ID: 1029625771-176575641
Opcode ID: 1226999b1a884ca17c5b2461647f9cc7fd170f4d93b13a3393377715834bfafc
Instruction ID: 6656b0a100c5902490dac4b642c2d42f424723c4162e74bb2d036909918d036a
Opcode Fuzzy Hash: 1226999b1a884ca17c5b2461647f9cc7fd170f4d93b13a3393377715834bfafc
Instruction Fuzzy Hash: 5B11E2B6D002099FDB10DF9AD444ADEFBF4EB88310F14842EE559A7610C375A945CFA5

Function 066F13B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 066F1422

Strings

B^., xrefs: 066F13D7

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: TextWindow
String ID: B^.
API String ID: 530164218-176575641
Opcode ID: 202a19de8176904cccf6d7e4f5a69fc5cda1013b3500e722d9a211a305526149
Instruction ID: 3730004376e2c404f19cdbfe8a1892600cd9b11d4553bb3d31789181001fc2b3
Opcode Fuzzy Hash: 202a19de8176904cccf6d7e4f5a69fc5cda1013b3500e722d9a211a305526149
Instruction Fuzzy Hash: 7A111FB2C002498FDB14CF9AD844ADEFBF4EB88324F14C02AD968A7240D338A545CFA5

Function 07020603 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 07020670

Strings

B^., xrefs: 07020627

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: MessagePeek
String ID: B^.
API String ID: 2222842502-176575641
Opcode ID: 0102a64a9b310301578dc88b0e704df787f072ad6f04f947746491f99be92034
Instruction ID: 5bc4d2c69e6e9dd11c69a8d07f6a2ece8855da99125229dbebe1d467872a0cbb
Opcode Fuzzy Hash: 0102a64a9b310301578dc88b0e704df787f072ad6f04f947746491f99be92034
Instruction Fuzzy Hash: 801126B1900219DFCB10CF9AD884BDEFBF8EB48314F10842AE558A7250C378A944DFA5

Function 07020608 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 07020670

Strings

B^., xrefs: 07020627

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: MessagePeek
String ID: B^.
API String ID: 2222842502-176575641
Opcode ID: ea3806b1be6adc4b3c5fd31146302143f15967aa7b1d5aa9920027c3e0b5f6ef
Instruction ID: 85e718aac0efd5df22c594b538c0a8d2205db7f64f4398f4efcbdb9f46cadf2a
Opcode Fuzzy Hash: ea3806b1be6adc4b3c5fd31146302143f15967aa7b1d5aa9920027c3e0b5f6ef
Instruction Fuzzy Hash: 491107B5D00259DFDB10CF9AD544BDEFBF8EB48320F10842AE558A7250C378A944DFA5

Function 0216B290 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0216B303

Strings

B^., xrefs: 0216B2AF

Memory Dump Source

Source File: 00000000.00000002.2883138040.0000000002160000.00000040.00000800.00020000.00000000.sdmp, Offset: 02160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2160000_wLw52XmkOM.jbxd

Similarity

API ID: ProtectVirtual
String ID: B^.
API String ID: 544645111-176575641
Opcode ID: 1bf3c28a2685fd05a1cfec38ce824a6853a54d9881ada6e0c2682f0da2f9a4ab
Instruction ID: 104efc0e0d3b26cffcdda50bf6ac4b6ec21880067cca600d2d6ba6db3d4cfd2d
Opcode Fuzzy Hash: 1bf3c28a2685fd05a1cfec38ce824a6853a54d9881ada6e0c2682f0da2f9a4ab
Instruction Fuzzy Hash: C011C0B59042499FCB10DF9AD584ADFFBF4FB48324F14842AE958A7250C374AA44CFA5

Function 070208D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0702093D

Strings

B^., xrefs: 070208F7

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: B^.
API String ID: 2492992576-176575641
Opcode ID: c1e454bbdde4306336daa3441dfce707aa159b388dc8fe79da5570ed6839f457
Instruction ID: cae7611b824ea80029dc4e71307bcec82f7eca0646b261bd458137d4528fe176
Opcode Fuzzy Hash: c1e454bbdde4306336daa3441dfce707aa159b388dc8fe79da5570ed6839f457
Instruction Fuzzy Hash: 681104B18003599FDB10CF9AD884BDEFBF8EB48320F10842AE558A3240C378A944CFA5

Function 07020DA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 07020E05

Strings

B^., xrefs: 07020DC7

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: DispatchMessage
String ID: B^.
API String ID: 2061451462-176575641
Opcode ID: 55b9b7abdaf120b4e651b8b98d4d2c1c83d196d655863349b424780e19156913
Instruction ID: 43532d9cbe55f9f5cec7a3ca0101c83a59819e794e8d7d16ccb6b82dcb3b3863
Opcode Fuzzy Hash: 55b9b7abdaf120b4e651b8b98d4d2c1c83d196d655863349b424780e19156913
Instruction Fuzzy Hash: DA1122B5C006599FCB20CF9AD444BDEFBF4EB48324F10852AE458A3200C378A940CFA5

Function 066F7328 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 066F7385

Strings

B^., xrefs: 066F7342

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: MessagePost
String ID: B^.
API String ID: 410705778-176575641
Opcode ID: 4efeccb9e1af6a20642b5fd89325f51ea5c13b63dbf927bdcbd780829a5a8509
Instruction ID: ddda947f87c76cb7c4d3a794c0d8f143a0b0ecc248af28695edc0d293de7b3ed
Opcode Fuzzy Hash: 4efeccb9e1af6a20642b5fd89325f51ea5c13b63dbf927bdcbd780829a5a8509
Instruction Fuzzy Hash: 501125B28003499FDB10CF9AD845BDEFBF8EB48320F108419E958A3240C378A984CFA5

Function 0702EA28 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 0702EA8D

Strings

B^., xrefs: 0702EA4F

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: DispatchMessage
String ID: B^.
API String ID: 2061451462-176575641
Opcode ID: db317875e7996355db4d78eaa037868979013ebd9273945b0ddcaf9be1dcc5f4
Instruction ID: 1931e57f81f6e7950f0d0edacc9038c51e54c675a865988691c2ba84487c1422
Opcode Fuzzy Hash: db317875e7996355db4d78eaa037868979013ebd9273945b0ddcaf9be1dcc5f4
Instruction Fuzzy Hash: 6D1103B5C006599FCB10DFAAE848BDEFBF4EB48320F10852AE518A7350D374A545CFA5

Function 066F1570 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 066F2065

Strings

B^., xrefs: 066F2022

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: MessageSend
String ID: B^.
API String ID: 3850602802-176575641
Opcode ID: 3d5b99e08b120cf9d22030b8528e05633d26ea1938ef93708b92963ed1c1f87d
Instruction ID: f92b556db540b5af0c2af3bcbdf0ae6291eda359fe1864daee2c876b499a86eb
Opcode Fuzzy Hash: 3d5b99e08b120cf9d22030b8528e05633d26ea1938ef93708b92963ed1c1f87d
Instruction Fuzzy Hash: 9511F5B58003489FDB60DF99D894BDEBBF8EB48314F108419E558A7210C375A984CFA5

Function 04A8B0B8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04A8B11E

Strings

B^., xrefs: 04A8B0D7

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID: HandleModule
String ID: B^.
API String ID: 4139908857-176575641
Opcode ID: 27ed359dbd67bd277e87ede71ce57dc1fb8ecbceee8409473e9c432b6bda47fb
Instruction ID: f5265c93eb7dbe394c9c7e54bd4f8efe2d6e0c985462bfadc0132d9116246cc6
Opcode Fuzzy Hash: 27ed359dbd67bd277e87ede71ce57dc1fb8ecbceee8409473e9c432b6bda47fb
Instruction Fuzzy Hash: 3F1122B5C002498FCB10DF9AD844ADEFBF4EF88324F10842AD418AB210C378A545CFA5

Function 066F2000 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 066F2065

Strings

B^., xrefs: 066F2022

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: MessageSend
String ID: B^.
API String ID: 3850602802-176575641
Opcode ID: d5ecacad5237ec85cd800073225bb2e076110d954091a46c5da802c58ffa7e12
Instruction ID: 3c76c7c35e3ef484881ff7cdd191a0c9bc5a919dbe4da5b6d922d8f88658e71e
Opcode Fuzzy Hash: d5ecacad5237ec85cd800073225bb2e076110d954091a46c5da802c58ffa7e12
Instruction Fuzzy Hash: B01103B58003489FDB50CF9AD884BDEFFF8EB48324F24841AE558A7210C375A984CFA5

Function 05371B30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05371B95

Strings

B^., xrefs: 05371B52

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID: LongWindow
String ID: B^.
API String ID: 1378638983-176575641
Opcode ID: 70ddccb3f280fc58b2aaf1ba123964c6dd19a78a40659e83ddcc2bf9469e16f2
Instruction ID: 995a9f0a069eb6a02b78abbd8c6ccb0e1883269b52eda9394b30f47092f7dcce
Opcode Fuzzy Hash: 70ddccb3f280fc58b2aaf1ba123964c6dd19a78a40659e83ddcc2bf9469e16f2
Instruction Fuzzy Hash: 7B11F5B5800249DFDB10DF9AD588BDEBBF4EB48324F20845AD559A7700D374AA44CFA5

Function 05371B38 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05371B95

Strings

B^., xrefs: 05371B52

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID: LongWindow
String ID: B^.
API String ID: 1378638983-176575641
Opcode ID: 7b7d3da8a74c8715fb622799a40df91ab543fc2a239087d1671e9f4dae072658
Instruction ID: 43a161d7586218a9b499e122dd75fd8e926ca7abfe3d36dacdf1f22859c761ff
Opcode Fuzzy Hash: 7b7d3da8a74c8715fb622799a40df91ab543fc2a239087d1671e9f4dae072658
Instruction Fuzzy Hash: 491115B5800248CFDB10CF9AD584BDEFBF8EB48320F10841AD958A7300C374A944CFA5

Function 07020DA8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 07020E05

Strings

B^., xrefs: 07020DC7

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: DispatchMessage
String ID: B^.
API String ID: 2061451462-176575641
Opcode ID: 21925f56757a46b23ddd132a05f43c9721358008a061e2babfe8aacb4723d9c1
Instruction ID: 9fbeb11986f5199a0f84bb341b5d3497d6d584bee40074c1250fc1d190a5acb8
Opcode Fuzzy Hash: 21925f56757a46b23ddd132a05f43c9721358008a061e2babfe8aacb4723d9c1
Instruction Fuzzy Hash: DF110DB1C00259DFCB20CF9AE444BCEFBF4EB48324F10852AD558A7210C378A984CFA5

Function 0702EA30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 0702EA8D

Strings

B^., xrefs: 0702EA4F

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: DispatchMessage
String ID: B^.
API String ID: 2061451462-176575641
Opcode ID: 6023a6d236a6923f60bcc1401f52ecaef72f841d04ee826bfdca52601e4beaf7
Instruction ID: 2d478884cd7ebe2eea8b2266f110ed244bb7838d659b10ce3eee575694f681c4
Opcode Fuzzy Hash: 6023a6d236a6923f60bcc1401f52ecaef72f841d04ee826bfdca52601e4beaf7
Instruction Fuzzy Hash: E811DDB5D006598FCB10DF9AE548BDEFBF4EB48324F10852AD558A7210D378A944CFA5

Function 0216BEE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0216BF48

Strings

B^., xrefs: 0216BEFA

Memory Dump Source

Source File: 00000000.00000002.2883138040.0000000002160000.00000040.00000800.00020000.00000000.sdmp, Offset: 02160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2160000_wLw52XmkOM.jbxd

Similarity

API ID: AllocVirtual
String ID: B^.
API String ID: 4275171209-176575641
Opcode ID: 20b1a323ecf317ddb32c1af7a31f1596a9b8af88814c6373011d0b901143c0ea
Instruction ID: 0b36946d401ea7db3d0af0fd116c966565a6752b55ca5d16c30aed7949ffa414
Opcode Fuzzy Hash: 20b1a323ecf317ddb32c1af7a31f1596a9b8af88814c6373011d0b901143c0ea
Instruction Fuzzy Hash: 011128B59002489FCB10DF9AD544BDFFFF4EB48324F208469E558A7210C375A944CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0071D524 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882123524.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff381f8190f24c84aa9f109163805e67f9f01b8ba5f9ab4e3d0f9f75a3971183
Instruction ID: 3167c75b75370bfa687690d2d377ad2fc415de6e30b2a686146f75d646ac8b5a
Opcode Fuzzy Hash: ff381f8190f24c84aa9f109163805e67f9f01b8ba5f9ab4e3d0f9f75a3971183
Instruction Fuzzy Hash: CD212BB1500240DFCB15DF18D5C0B67BF66FB94318F20C569D9054B296C339DCA6CAA1

Function 020CD01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882692423.00000000020CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20cd000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ae0e0112a5008edb1ff50dcc9250b458a42b46865386fe5ea5c558d3ca2e57
Instruction ID: d570af2255844346ede780f7c5ea475f329886483f3ac06c1738458c24a787ac
Opcode Fuzzy Hash: 44ae0e0112a5008edb1ff50dcc9250b458a42b46865386fe5ea5c558d3ca2e57
Instruction Fuzzy Hash: 912100B1104340DFDB11EF18DA84B2EBFA5EB84324F30C57DE9090B246C336D84ADAA2

Function 020CD2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882692423.00000000020CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20cd000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c280a52ce6c6c2278f704bc12bd61ed7ab24fede959d705cb01ed6e77392c928
Instruction ID: cbb4665eb65cc4f87f785c7ef4ae5b3939b8a1597bc1d17b2dfc7d0cc0498554
Opcode Fuzzy Hash: c280a52ce6c6c2278f704bc12bd61ed7ab24fede959d705cb01ed6e77392c928
Instruction Fuzzy Hash: A621CCB1604304EFDB05DF14DAC0B2ABBA5EB84314F24C67DE8494B296C33AD846DA61

Function 020CD104 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882692423.00000000020CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20cd000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89b2e61ac04b060c869a9da19c798e23ce9a0564c9c73c70e5a0dd5b43d187b
Instruction ID: 395b5e24578be26e058d2bb6032566a422b3a92c05af46517bcd28d2eab20949
Opcode Fuzzy Hash: c89b2e61ac04b060c869a9da19c798e23ce9a0564c9c73c70e5a0dd5b43d187b
Instruction Fuzzy Hash: ED21D0B1604344EFDB05DF14D984B2ABBA5EB88314F30C5BDDD494A351C33AD846DA61

Function 020CD006 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882692423.00000000020CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20cd000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabfb5da31589cb065e1f088c2c9ebde4aeb547b1eb29faeaa01cc7f9382ec20
Instruction ID: 0cc28593e543d7282ca574b4de9f3946381034c5b535cee9aaf2e8a14b532221
Opcode Fuzzy Hash: dabfb5da31589cb065e1f088c2c9ebde4aeb547b1eb29faeaa01cc7f9382ec20
Instruction Fuzzy Hash: 0B2183B15083809FCB13CF14D994716BFB1EB86324F2985EAD8454B656C33AD81ADB62

Function 0071D51F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882123524.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 96eedce137a4f9344363358b0c549b3a6fa7ae2c41851be1053c749c7c8f348d
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 3111D376504280CFCB16CF14D5C4B56BF72FB98314F24C5A9D8094B656C33AD86ACFA1

Function 020CD0FF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882692423.00000000020CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20cd000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction ID: bd21195d8afcb174773af5bdc4c3156ef9fc65073a65928eddaf6eeb9a9690c5
Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction Fuzzy Hash: E711BBB5504384EFDB06CF10C9C4B19BBA2FB88218F24C6AEDC494B752C33AD44ADB61

Function 020CD2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882692423.00000000020CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20cd000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction ID: 116222dbb97aed32d993b7419847bdd2630582ec02f8882eda1b0b9f96ae3884
Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction Fuzzy Hash: A1119DB5504780DFDB06CF14D5C4B19BFA2FB84318F28C6AED8494B656C33AD44ADBA1

Function 0071D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882123524.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda91825e813ee2d51382143b02c76bb2ec9ea8b802701b4347d4706f0fce0bb
Instruction ID: 398ebe1f41ea4e257752979a77f8562c4428cc7143857fdb9cf7bd2a0f295303
Opcode Fuzzy Hash: bda91825e813ee2d51382143b02c76bb2ec9ea8b802701b4347d4706f0fce0bb
Instruction Fuzzy Hash: 7901A7715083409AE7204A2DDDC47A7BFD8DF59324F18C529ED484A2C6C27D9C81CAB1

Function 0071D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2882123524.000000000071D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd9e351406262f74a487278a7b6212dba51d393f2da3cfdb7a63aabfe8d4c35
Instruction ID: 6393d7a9b5758ffa518d6037f7dd328164a6bc984a85baa7165ae9d3f4129bb2
Opcode Fuzzy Hash: cbd9e351406262f74a487278a7b6212dba51d393f2da3cfdb7a63aabfe8d4c35
Instruction Fuzzy Hash: 56F06271404344AEE7208A1ADDC4BA6FFE8EB55724F18C55AED484E286C2799C85CAB1

Non-executed Functions

Function 0702F186 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 0702F1D5
GetKeyState.USER32(00000002), ref: 0702F21A
GetKeyState.USER32(00000004), ref: 0702F25F
GetKeyState.USER32(00000005), ref: 0702F2A4
GetKeyState.USER32(00000006), ref: 0702F2E9

Strings

B^., xrefs: 0702F19F

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID: State
String ID: B^.
API String ID: 1649606143-176575641
Opcode ID: 80223584be0680886504bb184e7e4a4496bbaf06fcbb99873a87829be3a66471
Instruction ID: 06162ebbb2218d5b6472aa331c65403242a8c447c8366785425d0e2081ab1af3
Opcode Fuzzy Hash: 80223584be0680886504bb184e7e4a4496bbaf06fcbb99873a87829be3a66471
Instruction Fuzzy Hash: 394181F5800756CEEB21DF99C9483AFBFF4AB05358F208419D449B7240C779A58ACFA6

Function 066B1E0C Relevance: 8.2, Strings: 6, Instructions: 651COMMON

Download Yara Rule

Strings

Hbq, xrefs: 066B99BB
B^., xrefs: 066B9A5A
Hbq, xrefs: 066B98FD
Hbq, xrefs: 066B9873
Hbq, xrefs: 066B9759
Hbq, xrefs: 066B97EC

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: B^.$Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1342982874
Opcode ID: 4a60a44c4b184460fdd8f6d084ed5842ff13f553fb4765ca50b2be4d9c3c2611
Instruction ID: 74d9b01d7c60ccb373fb26c25cc60986bfce9b22370fc1870e9e00be50d744f1
Opcode Fuzzy Hash: 4a60a44c4b184460fdd8f6d084ed5842ff13f553fb4765ca50b2be4d9c3c2611
Instruction Fuzzy Hash: 4F429C70E00218CFDB98DFA9C85479EBBF2AF89300F1485A9D109AB395DB349D85CF95

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 07022750 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

(&^q, xrefs: 07022A21
, xrefs: 070227EC
Hbq, xrefs: 070228C6
(bq, xrefs: 0702289A

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: $(&^q$(bq$Hbq
API String ID: 0-1723523991
Opcode ID: fd8b2f1dc4ac8542a1f448c4db3945e6a6b6d06eda3143b33e372dd8b0c5657e
Instruction ID: c8fe441bcf97b8fe9da813cde8f7080c01a0c43edb7194a80eee727997444277
Opcode Fuzzy Hash: fd8b2f1dc4ac8542a1f448c4db3945e6a6b6d06eda3143b33e372dd8b0c5657e
Instruction Fuzzy Hash: 5E9191B1E002159FDB68DFB9C844AAFBAF6FF88310F118529E415EB250DF34D9028B95

Function 00408C60 Relevance: 4.1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

Strings

PA, xrefs: 00408E3D
@, xrefs: 00408D03
@, xrefs: 00409092

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: @$@$PA
API String ID: 0-3039612711
Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 0702563F Relevance: 1.9, Strings: 1, Instructions: 697COMMON

Download Yara Rule

Strings

fff?, xrefs: 07025CB8

Memory Dump Source

Source File: 00000000.00000002.2887992307.0000000007020000.00000040.00000800.00020000.00000000.sdmp, Offset: 07020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7020000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: e3e0d8d6762e4b340fb6b91790f50bf9e6088d46fa8708e18060b6f537b62606
Instruction ID: d3e269af8c0666489072be05e4a7582a3d1f7e520a9888fa03c1b0287c80e349
Opcode Fuzzy Hash: e3e0d8d6762e4b340fb6b91790f50bf9e6088d46fa8708e18060b6f537b62606
Instruction Fuzzy Hash: 9062183281061ADFCF11DF50C884AD9BBB2FF99304F1586D5E9086B125E772AAD6DF80

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 00407C3F Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95

Function 004073A0 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction ID: 17d22deff8d32e931318445bbea846c6b698fa6fcc44f6923348d96d7e24b863
Opcode Fuzzy Hash: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction Fuzzy Hash: 0A329E70A087029FD318CF29C98472AB7E1BF84304F148A3EE89567781D779E955CBDA

Function 00406CA0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55

Function 05370040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f6535fb3c97e5c7bc5dfe1058a723d46b79329d8cf1e30dfb329958b7d67fa
Instruction ID: c0f9544992c4031d989c3d8831dbfc106d42999e5a70f13596be4af89a7fa797
Opcode Fuzzy Hash: f4f6535fb3c97e5c7bc5dfe1058a723d46b79329d8cf1e30dfb329958b7d67fa
Instruction Fuzzy Hash: DE1295F1C817458AD710CF65E84C1897BB9BB51318FF08A0AD2617A2E5DBB835AACF44

Function 066B8B8B Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8feccb5240fb9fd79036e6a983d6e69274eeff31369cabbbb18cc6db9eeb305
Instruction ID: 656b079c3ecd0ae66b6f028ed9eff168e6336eb4064326212d5e93a713df6c9c
Opcode Fuzzy Hash: c8feccb5240fb9fd79036e6a983d6e69274eeff31369cabbbb18cc6db9eeb305
Instruction Fuzzy Hash: 13B17EB1E10209CFDB54CBA8C8553EEBBBAEF85304F14906ED512AB385C7359C46CBA4

Function 066B1E08 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f4c90f06fe8791703872e9c2ca79f2d0c46b2b97237e43102b2647866390bb
Instruction ID: b556a16f923ef2b51774e47a24a888c3b3f73b00c945fb38550a94b0b578171c
Opcode Fuzzy Hash: 34f4c90f06fe8791703872e9c2ca79f2d0c46b2b97237e43102b2647866390bb
Instruction Fuzzy Hash: 6AC15771E00258DFDBA4CF65C8807DDBBB2AF8A300F04D2A9D519AB255DB34D985CF94

Function 066B9188 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b21b035193776cbc4ae10a67ad33e3ce2e9c831554b85b2120bd0dfb6b37d3f
Instruction ID: 38d137823949dad18ae9787811867c71179d6f0ba599f1e55aedccdd8ceeae35
Opcode Fuzzy Hash: 2b21b035193776cbc4ae10a67ad33e3ce2e9c831554b85b2120bd0dfb6b37d3f
Instruction Fuzzy Hash: E9C16971E00258DFDBA4CF65C8807DDBBB2AF8A300F08D2AAD519AB255DB34D985CF54

Function 04A8D3CC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2886976668.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c81021ac3381426b3c47e82b132e55fe04a1ba74c8626606f57e07f40469e4
Instruction ID: 95bcc90fde8ea62e5895e96a6122257d69fc1463456f814245f5f12fbb4b335b
Opcode Fuzzy Hash: d8c81021ac3381426b3c47e82b132e55fe04a1ba74c8626606f57e07f40469e4
Instruction Fuzzy Hash: 6EA15032E0020A8FDF09EFB4C94459EB7B6FF89304B15856EE805AB265DB71F956CB40

Function 00402B90 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction ID: 74c1b90a01db230de662c72faab58802bb742d928f34651097fec506a9751401
Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction Fuzzy Hash: 15717072A9155347E39CCF5CECD17763713DBC5351F49C23ACA025B6EAC938A922C688

Function 004028B0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC

Function 02161020 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2883138040.0000000002160000.00000040.00000800.00020000.00000000.sdmp, Offset: 02160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2160000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546a428a8e36440a41a54e18e216f7f14babaa16cceb99985a5e993f08cf69df
Instruction ID: 3d947f6a687cdc5d18cdd6ea15431bbace969fd653b2f801ea09981644af1d87
Opcode Fuzzy Hash: 546a428a8e36440a41a54e18e216f7f14babaa16cceb99985a5e993f08cf69df
Instruction Fuzzy Hash: 34519574D402048FD709EF3AE84079ABBEBBF84304F14C928D4559B369EB746A5A8F50

Function 02161030 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2883138040.0000000002160000.00000040.00000800.00020000.00000000.sdmp, Offset: 02160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2160000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd473d34676837f0902f474a525adf8d889c16346f29cb9b065cad2816d79167
Instruction ID: 43aec2dd72a402ab64f4518100bb0121cc47381dd3172b489b8eda573eb5c660
Opcode Fuzzy Hash: bd473d34676837f0902f474a525adf8d889c16346f29cb9b065cad2816d79167
Instruction Fuzzy Hash: CF517374D402048FD708EF3AED40B9ABBEBBF84304F10C928D4159B369EB746A599B90

Function 00401650 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77

Function 00402F20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction ID: cff114a85fcb8f5deb46d81d22c4208fa3965af46b01a687ebeadebabb5a60ab
Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction Fuzzy Hash: 9A31D8302052028BE738CE19C954BEBB3B5AFC0349F44883ED986A73C4DABDD945D795

Function 00402F89 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction ID: 40597224e526abc728bb10992f322fa75c91b34d76fbbe6bc80328d1c420bfc2
Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction Fuzzy Hash: F321923170520247EB68C929C9547ABB3A5ABC0389F48853EC986A73C8DAB9E941D785

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,022118C0), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b820e78b463918eed32479816903fc70d8532b7c557c67349a3712e4f0fad1ae
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b820e78b463918eed32479816903fc70d8532b7c557c67349a3712e4f0fad1ae
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 61b9ef8a6f765c58139a33a573ef994292dae8fcc9e916c915b81b6d9ebba236
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: 61b9ef8a6f765c58139a33a573ef994292dae8fcc9e916c915b81b6d9ebba236
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 0040C73D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Strings

'B, xrefs: 0040C70F

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID: 'B
API String ID: 2805327698-2787509829
Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(02211660), ref: 00414050

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 0040FA58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040FA7A
__calloc_crt.LIBCMT ref: 0040FA93

Strings

`$B, xrefs: 0040FACC
P$B, xrefs: 0040FAAA

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: 4bdca0f49684ef71ac3198dcc3f656e5d5ce7fed137673697bf40858e87bd1f9
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 6011A3327446115BE7348B1DBD50F662391EB84728BA4423BE619EA7E0E77CD8864A4C

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 004146FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 0041470C

Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(00000001), ref: 004145E4
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 004145F1
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 004145FE
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 0041460B
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414618
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414634
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414644
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 0041465A

___removelocaleref.LIBCMT ref: 00414717

Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 0041467B
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 00414688
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 00414695
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146A2
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146AF
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146CB
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(00000000), ref: 004146DB
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146F1

___freetlocinfo.LIBCMT ref: 0041472B

Part of subcall function 00414489: ___free_lconv_mon.LIBCMT ref: 004144CF
Part of subcall function 00414489: ___free_lconv_num.LIBCMT ref: 004144F0
Part of subcall function 00414489: ___free_lc_time.LIBCMT ref: 00414575

Strings

@.B, xrefs: 00414722

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B
API String ID: 467427115-470711618
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: 8e9b8205a585dc9325c25650a27042e0212317e7447dcce9b0fe23aa5a8dd77f
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: BDE0863250192255CE35261D76806EF93A98FD3725B3A017FF864AF7D8EB2C4CC0809D

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 689e5a2a8d0df6628a55ca55f65915ee6a0b33bdec45a2b9390eeacb6c5b01b1
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 689e5a2a8d0df6628a55ca55f65915ee6a0b33bdec45a2b9390eeacb6c5b01b1
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000000.00000002.2881375196.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2881332756.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881420001.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881467063.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881507410.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881554486.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2881648097.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_wLw52XmkOM.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Function 066F1D08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000031), ref: 066F1D66
GetSystemMetrics.USER32(00000032), ref: 066F1DA0

Strings

B^., xrefs: 066F1D2F

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.
API String ID: 4116985748-176575641
Opcode ID: 1662e9f8996e380df8d11a024c18c657b131a20222c79d770ebe3864ca7ac11b
Instruction ID: 21a4973a653c14f462bd65d6371d1071a57367e9680356adb39b855c2efc577d
Opcode Fuzzy Hash: 1662e9f8996e380df8d11a024c18c657b131a20222c79d770ebe3864ca7ac11b
Instruction Fuzzy Hash: 732102B0800349CFDB60DF99D8487DEBFF4EB49364F14841AD659AB251C378A584CFA5

Function 0537D3D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000005), ref: 0537D42E
GetSystemMetrics.USER32(00000006), ref: 0537D468

Strings

B^., xrefs: 0537D3F7

Memory Dump Source

Source File: 00000000.00000002.2887186576.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5370000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.
API String ID: 4116985748-176575641
Opcode ID: af160fe690e856d8a81914253268938d52397ad137fc2ac1807f148e03bc3095
Instruction ID: 71dea968f98279a82305da897160cc7777d10c5d51b3175a8d687fd65e7be212
Opcode Fuzzy Hash: af160fe690e856d8a81914253268938d52397ad137fc2ac1807f148e03bc3095
Instruction Fuzzy Hash: FF2123B18003498FDB20DF99D84979EBFF4EB08314F14842AD559AB650C778A984CFA5

Function 066B2D78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000022), ref: 066B2DD6
GetSystemMetrics.USER32(00000023), ref: 066B2E10

Strings

B^., xrefs: 066B2D9F

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.
API String ID: 4116985748-176575641
Opcode ID: ccdde4e2ebfbb7fdb46e28d9b96759f999759e1f31bcbd94c42a5a79eee50ffd
Instruction ID: cbecfc8559b92386ea7c183c799498094ed4c07a7a7ec69beca671739950bd3d
Opcode Fuzzy Hash: ccdde4e2ebfbb7fdb46e28d9b96759f999759e1f31bcbd94c42a5a79eee50ffd
Instruction Fuzzy Hash: B12134B0800349CFDB20CFAAE8497EEBFF4EB09314F24842AD559A7250C3786584CFA5

Function 066B2CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000003B), ref: 066B2CFE
GetSystemMetrics.USER32(0000003C), ref: 066B2D38

Strings

B^., xrefs: 066B2CC7

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.
API String ID: 4116985748-176575641
Opcode ID: 01a942369cc7c9b8deaffd920b9d89c1369f86c0c3564f69423263e1bea74195
Instruction ID: d6a2b9683fb473c0896d0b686c254d3dac6e29b069d673d3b8f13f89305eaaab
Opcode Fuzzy Hash: 01a942369cc7c9b8deaffd920b9d89c1369f86c0c3564f69423263e1bea74195
Instruction Fuzzy Hash: FD2103B0901349CFDB20DF99E8497EEBFF8EB08314F24841AD559A7251C3786985CFA5

Function 066BD1FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000050), ref: 066BD28B

Strings

B^., xrefs: 066BD227
4'^q, xrefs: 066BD244

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.$4'^q
API String ID: 4116985748-876356118
Opcode ID: cbe823798a958353d328a0507bf1d7bd9ef6f54ade424bf70658d038f3befed7
Instruction ID: 3e6735fd7ecc34f18a83e5faeaf615113a8b20648ddb349d593ca438fb195343
Opcode Fuzzy Hash: cbe823798a958353d328a0507bf1d7bd9ef6f54ade424bf70658d038f3befed7
Instruction Fuzzy Hash: 022103B5D00249CFCB14DF99D8456EEBBF4EB08320F14855AD419B7281C738A945CFA5

Function 066F1D18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000031), ref: 066F1D66
GetSystemMetrics.USER32(00000032), ref: 066F1DA0

Strings

B^., xrefs: 066F1D2F

Memory Dump Source

Source File: 00000000.00000002.2887560348.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66f0000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.
API String ID: 4116985748-176575641
Opcode ID: ecc62d11ea0f1be7f2cbbc2e21b5897a2ea743dc3a8c367e5366a1669c48e1ea
Instruction ID: bcd46571a7363f189523c427814aa8d4ac688149f476db3d336b87eeb6f0bbc1
Opcode Fuzzy Hash: ecc62d11ea0f1be7f2cbbc2e21b5897a2ea743dc3a8c367e5366a1669c48e1ea
Instruction Fuzzy Hash: 6321F0B4800349CFDB60DF9AD84979EFFF4AB09364F24841AD559A7250C378A984CFA5

Function 066BD208 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000050), ref: 066BD28B

Strings

B^., xrefs: 066BD227
4'^q, xrefs: 066BD244

Memory Dump Source

Source File: 00000000.00000002.2887486446.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66b0000_wLw52XmkOM.jbxd

Similarity

API ID: MetricsSystem
String ID: B^.$4'^q
API String ID: 4116985748-876356118
Opcode ID: 75b665d3cfb1cf98e2c1ecb4c2d70ec95387d9852cb80ccc51d31a2e6e6431eb
Instruction ID: 14ee0029fde899ced11dcf58b826de7946cc6e4bcafd7b3a1eafb74f45d9297d
Opcode Fuzzy Hash: 75b665d3cfb1cf98e2c1ecb4c2d70ec95387d9852cb80ccc51d31a2e6e6431eb
Instruction Fuzzy Hash: 652104B0D0025ACFCB14DF99D8456EEBBF4EB08320F10855AD959BB390C738A945CFA5

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wLw52XmkOM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: wLw52XmkOM.exePID: 7520, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: wLw52XmkOM.exePID: 7520, Parent PID: 2580COMMON

Execution Graph

Windows Analysis Report
wLw52XmkOM.exe

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 066F600C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295
COMMON

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Function 04A8CE48 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
threadCOMMON

Function 04A8CE58 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Function 066F4DFC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 294
COMMON

Function 066F1E10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 226
COMMON

Function 066F6DE8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 217
threadCOMMON

Function 053718E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115
COMMON

Function 053718F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Function 0216B440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
libraryCOMMON