Edit tour

Windows Analysis Report
LETTER OF AUTHORIZATION.exe

Overview

General Information

Sample name:	LETTER OF AUTHORIZATION.exe
Analysis ID:	1464858
MD5:	57cb0d1fbbe7e57e906d9bec624ff50f
SHA1:	d8eeb1c8e4530d619c7a5927fec5fcc892e0b24f
SHA256:	235feecbf39c506144e406ee52d764d830e5124d113280a5e339bf3bdee978a5
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LETTER OF AUTHORIZATION.exe (PID: 5776 cmdline: "C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe" MD5: 57CB0D1FBBE7E57E906D9BEC624FF50F)

InstallUtil.exe (PID: 2432 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 3580 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 2348 cmdline: C:\Windows\system32\WerFault.exe -u -p 5776 -s 1008 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "rightlut@valleycountysar.org", "Password": "fY,FLoadtsiF", "Host": "valleycountysar.org", "Port": "26"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1484e:$a1: get_encryptedPassword 0x14b3a:$a2: get_encryptedUsername 0x1465a:$a3: get_timePasswordChanged 0x14755:$a4: get_passwordField 0x14864:$a5: set_encryptedPassword 0x15e37:$a7: get_logins 0x15d9a:$a10: KeyLoggerEventArgs 0x15a33:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18110:$x1: $%SMTPDV$ 0x18176:$x2: $#TheHashHere%& 0x1976d:$x3: %FTPDV$ 0x19861:$x4: $%TelegramDv$ 0x15a33:$x5: KeyLoggerEventArgs 0x15d9a:$x5: KeyLoggerEventArgs 0x19791:$m2: Clipboard Logs ID 0x199b1:$m2: Screenshot Logs ID 0x19ac1:$m2: keystroke Logs ID 0x19d9b:$m3: SnakePW 0x19989:$m4: \SnakeKeylogger\
00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.4543065876.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xab276:$a1: get_encryptedPassword 0xcbcbe:$a1: get_encryptedPassword 0xab562:$a2: get_encryptedUsername 0xcbfaa:$a2: get_encryptedUsername 0xab082:$a3: get_timePasswordChanged 0xcbaca:$a3: get_timePasswordChanged 0xab17d:$a4: get_passwordField 0xcbbc5:$a4: get_passwordField 0xab28c:$a5: set_encryptedPassword 0xcbcd4:$a5: set_encryptedPassword 0xac85f:$a7: get_logins 0xcd2a7:$a7: get_logins 0xac7c2:$a10: KeyLoggerEventArgs 0xcd20a:$a10: KeyLoggerEventArgs 0xac45b:$a11: KeyLoggerEventArgsEventHandler 0xccea3:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xaeb38:$x1: $%SMTPDV$ 0xcf580:$x1: $%SMTPDV$ 0xaeb9e:$x2: $#TheHashHere%& 0xcf5e6:$x2: $#TheHashHere%& 0xb0195:$x3: %FTPDV$ 0xd0bdd:$x3: %FTPDV$ 0xb0289:$x4: $%TelegramDv$ 0xd0cd1:$x4: $%TelegramDv$ 0xac45b:$x5: KeyLoggerEventArgs 0xac7c2:$x5: KeyLoggerEventArgs 0xccea3:$x5: KeyLoggerEventArgs 0xcd20a:$x5: KeyLoggerEventArgs 0xb01b9:$m2: Clipboard Logs ID 0xb03d9:$m2: Screenshot Logs ID 0xb04e9:$m2: keystroke Logs ID 0xd0c01:$m2: Clipboard Logs ID 0xd0e21:$m2: Screenshot Logs ID 0xd0f31:$m2: keystroke Logs ID 0xb07c3:$m3: SnakePW 0xd120b:$m3: SnakePW 0xb03b1:$m4: \SnakeKeylogger\
00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f27a:$a1: get_encryptedPassword 0x3f55c:$a2: get_encryptedUsername 0x3f090:$a3: get_timePasswordChanged 0x3f18b:$a4: get_passwordField 0x3f290:$a5: set_encryptedPassword 0x41680:$a7: get_logins 0x415e3:$a10: KeyLoggerEventArgs 0x4127c:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4127c:$x5: KeyLoggerEventArgs 0x415e3:$x5: KeyLoggerEventArgs 0x41ed1:$x5: KeyLoggerEventArgs 0x42205:$x5: KeyLoggerEventArgs 0x437b3:$m2: Clipboard Logs ID 0x438aa:$m2: Screenshot Logs ID 0x43900:$m2: keystroke Logs ID 0x43a35:$m3: SnakePW 0x43896:$m4: \SnakeKeylogger\
Process Memory Space: InstallUtil.exe PID: 2432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 2432	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 2432	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf3d7:$a1: get_encryptedPassword 0xf6b9:$a2: get_encryptedUsername 0xf1ed:$a3: get_timePasswordChanged 0xf2e8:$a4: get_passwordField 0xf3ed:$a5: set_encryptedPassword 0x117dd:$a7: get_logins 0x11740:$a10: KeyLoggerEventArgs 0x113d9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 2432	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x113d9:$x5: KeyLoggerEventArgs 0x11740:$x5: KeyLoggerEventArgs 0x1202e:$x5: KeyLoggerEventArgs 0x12362:$x5: KeyLoggerEventArgs 0x13910:$m2: Clipboard Logs ID 0x13a07:$m2: Screenshot Logs ID 0x13a5d:$m2: keystroke Logs ID 0x13b92:$m3: SnakePW 0x139f3:$m4: \SnakeKeylogger\
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a4e:$a1: get_encryptedPassword 0x14d3a:$a2: get_encryptedUsername 0x1485a:$a3: get_timePasswordChanged 0x14955:$a4: get_passwordField 0x14a64:$a5: set_encryptedPassword 0x16037:$a7: get_logins 0x15f9a:$a10: KeyLoggerEventArgs 0x15c33:$a11: KeyLoggerEventArgsEventHandler
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c4e:$a1: get_encryptedPassword 0x12f3a:$a2: get_encryptedUsername 0x12a5a:$a3: get_timePasswordChanged 0x12b55:$a4: get_passwordField 0x12c64:$a5: set_encryptedPassword 0x14237:$a7: get_logins 0x1419a:$a10: KeyLoggerEventArgs 0x13e33:$a11: KeyLoggerEventArgsEventHandler
2.2.InstallUtil.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c36b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b59d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b9d0:$a4: \Orbitum\User Data\Default\Login Data 0x1ca0f:$a5: \Kometa\User Data\Default\Login Data
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a56b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1979d:$a3: \Google\Chrome\User Data\Default\Login Data 0x19bd0:$a4: \Orbitum\User Data\Default\Login Data 0x1ac0f:$a5: \Kometa\User Data\Default\Login Data
2.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x155d6:$s1: UnHook 0x155dd:$s2: SetHook 0x155e5:$s3: CallNextHook 0x155f2:$s4: _hook
2.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18310:$x1: $%SMTPDV$ 0x18376:$x2: $#TheHashHere%& 0x1996d:$x3: %FTPDV$ 0x19a61:$x4: $%TelegramDv$ 0x15c33:$x5: KeyLoggerEventArgs 0x15f9a:$x5: KeyLoggerEventArgs 0x19991:$m2: Clipboard Logs ID 0x19bb1:$m2: Screenshot Logs ID 0x19cc1:$m2: keystroke Logs ID 0x19f9b:$m3: SnakePW 0x19b89:$m4: \SnakeKeylogger\
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x137d6:$s1: UnHook 0x137dd:$s2: SetHook 0x137e5:$s3: CallNextHook 0x137f2:$s4: _hook
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16510:$x1: $%SMTPDV$ 0x16576:$x2: $#TheHashHere%& 0x17b6d:$x3: %FTPDV$ 0x17c61:$x4: $%TelegramDv$ 0x13e33:$x5: KeyLoggerEventArgs 0x1419a:$x5: KeyLoggerEventArgs 0x17b91:$m2: Clipboard Logs ID 0x17db1:$m2: Screenshot Logs ID 0x17ec1:$m2: keystroke Logs ID 0x1819b:$m3: SnakePW 0x17d89:$m4: \SnakeKeylogger\
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c4e:$a1: get_encryptedPassword 0x12f3a:$a2: get_encryptedUsername 0x12a5a:$a3: get_timePasswordChanged 0x12b55:$a4: get_passwordField 0x12c64:$a5: set_encryptedPassword 0x14237:$a7: get_logins 0x1419a:$a10: KeyLoggerEventArgs 0x13e33:$a11: KeyLoggerEventArgsEventHandler
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a56b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1979d:$a3: \Google\Chrome\User Data\Default\Login Data 0x19bd0:$a4: \Orbitum\User Data\Default\Login Data 0x1ac0f:$a5: \Kometa\User Data\Default\Login Data
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x137d6:$s1: UnHook 0x137dd:$s2: SetHook 0x137e5:$s3: CallNextHook 0x137f2:$s4: _hook
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16510:$x1: $%SMTPDV$ 0x16576:$x2: $#TheHashHere%& 0x17b6d:$x3: %FTPDV$ 0x17c61:$x4: $%TelegramDv$ 0x13e33:$x5: KeyLoggerEventArgs 0x1419a:$x5: KeyLoggerEventArgs 0x17b91:$m2: Clipboard Logs ID 0x17db1:$m2: Screenshot Logs ID 0x17ec1:$m2: keystroke Logs ID 0x1819b:$m3: SnakePW 0x17d89:$m4: \SnakeKeylogger\
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a4e:$a1: get_encryptedPassword 0x14d3a:$a2: get_encryptedUsername 0x1485a:$a3: get_timePasswordChanged 0x14955:$a4: get_passwordField 0x14a64:$a5: set_encryptedPassword 0x16037:$a7: get_logins 0x15f9a:$a10: KeyLoggerEventArgs 0x15c33:$a11: KeyLoggerEventArgsEventHandler
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c36b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b59d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b9d0:$a4: \Orbitum\User Data\Default\Login Data 0x1ca0f:$a5: \Kometa\User Data\Default\Login Data
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x155d6:$s1: UnHook 0x155dd:$s2: SetHook 0x155e5:$s3: CallNextHook 0x155f2:$s4: _hook
0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18310:$x1: $%SMTPDV$ 0x18376:$x2: $#TheHashHere%& 0x1996d:$x3: %FTPDV$ 0x19a61:$x4: $%TelegramDv$ 0x15c33:$x5: KeyLoggerEventArgs 0x15f9a:$x5: KeyLoggerEventArgs 0x19991:$m2: Clipboard Logs ID 0x19bb1:$m2: Screenshot Logs ID 0x19cc1:$m2: keystroke Logs ID 0x19f9b:$m3: SnakePW 0x19b89:$m4: \SnakeKeylogger\
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a4e:$a1: get_encryptedPassword 0x35496:$a1: get_encryptedPassword 0x14d3a:$a2: get_encryptedUsername 0x35782:$a2: get_encryptedUsername 0x1485a:$a3: get_timePasswordChanged 0x352a2:$a3: get_timePasswordChanged 0x14955:$a4: get_passwordField 0x3539d:$a4: get_passwordField 0x14a64:$a5: set_encryptedPassword 0x354ac:$a5: set_encryptedPassword 0x16037:$a7: get_logins 0x36a7f:$a7: get_logins 0x15f9a:$a10: KeyLoggerEventArgs 0x369e2:$a10: KeyLoggerEventArgs 0x15c33:$a11: KeyLoggerEventArgsEventHandler 0x3667b:$a11: KeyLoggerEventArgsEventHandler
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c36b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cdb3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b59d:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bfe5:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b9d0:$a4: \Orbitum\User Data\Default\Login Data 0x3c418:$a4: \Orbitum\User Data\Default\Login Data 0x1ca0f:$a5: \Kometa\User Data\Default\Login Data 0x3d457:$a5: \Kometa\User Data\Default\Login Data
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x155d6:$s1: UnHook 0x3601e:$s1: UnHook 0x155dd:$s2: SetHook 0x36025:$s2: SetHook 0x155e5:$s3: CallNextHook 0x3602d:$s3: CallNextHook 0x155f2:$s4: _hook 0x3603a:$s4: _hook
0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18310:$x1: $%SMTPDV$ 0x38d58:$x1: $%SMTPDV$ 0x18376:$x2: $#TheHashHere%& 0x38dbe:$x2: $#TheHashHere%& 0x1996d:$x3: %FTPDV$ 0x3a3b5:$x3: %FTPDV$ 0x19a61:$x4: $%TelegramDv$ 0x3a4a9:$x4: $%TelegramDv$ 0x15c33:$x5: KeyLoggerEventArgs 0x15f9a:$x5: KeyLoggerEventArgs 0x3667b:$x5: KeyLoggerEventArgs 0x369e2:$x5: KeyLoggerEventArgs 0x19991:$m2: Clipboard Logs ID 0x19bb1:$m2: Screenshot Logs ID 0x19cc1:$m2: keystroke Logs ID 0x3a3d9:$m2: Clipboard Logs ID 0x3a5f9:$m2: Screenshot Logs ID 0x3a709:$m2: keystroke Logs ID 0x19f9b:$m3: SnakePW 0x3a9e3:$m3: SnakePW 0x19b89:$m4: \SnakeKeylogger\
Click to see the 28 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "rightlut@valleycountysar.org", "Password": "fY,FLoadtsiF", "Host": "valleycountysar.org", "Port": "26"}

Multi AV Scanner detection for submitted file

Source: LETTER OF AUTHORIZATION.exe	ReversingLabs: Detection: 50%
Source: LETTER OF AUTHORIZATION.exe	Virustotal: Detection: 45%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: LETTER OF AUTHORIZATION.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49701 version: TLS 1.0

Source: LETTER OF AUTHORIZATION.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb#( source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER2F83.tmp.dmp.6.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0299F1F6h	2_2_0299F007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0299FB80h	2_2_0299F007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0299E528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F1011h	2_2_055F0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FF009h	2_2_055FED60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FC041h	2_2_055FBD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FDEA9h	2_2_055FDC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FB791h	2_2_055FB4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FE759h	2_2_055FE4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F0751h	2_2_055F04A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FDA51h	2_2_055FD7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FC8F1h	2_2_055FC648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FF8B9h	2_2_055FF610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F1A38h	2_2_055F1610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F1A38h	2_2_055F1620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FD1A1h	2_2_055FCEF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FBBE9h	2_2_055FB940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F1A38h	2_2_055F1966
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FEBB1h	2_2_055FE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F0BB1h	2_2_055F0900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F1471h	2_2_055F11C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FC499h	2_2_055FC1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FF461h	2_2_055FF1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FE301h	2_2_055FE058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055F02F1h	2_2_055F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FD5F9h	2_2_055FD350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FFD11h	2_2_055FFA68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 055FCD49h	2_2_055FCAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06598945h	2_2_06598608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06595D19h	2_2_06595A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 065958C1h	2_2_06595618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06596171h	2_2_06595EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_065936CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06596A21h	2_2_06596778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 065965C9h	2_2_06596320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06596E79h	2_2_06596BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_065933B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_065933A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 065972FAh	2_2_06597050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 065902E9h	2_2_06590040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06590B99h	2_2_065908F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06590741h	2_2_06590498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06597751h	2_2_065974A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06598001h	2_2_06597D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06590FF1h	2_2_06590D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06597BA9h	2_2_06597900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06595441h	2_2_06595198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06598459h	2_2_065981B0

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49701 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B3F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: InstallUtil.exe, 00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002A8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: InstallUtil.exe, 00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34891608	0_2_00007FFD34891608
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3489B661	0_2_00007FFD3489B661
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3489AEBF	0_2_00007FFD3489AEBF
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD348937DC	0_2_00007FFD348937DC
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD348A41F9	0_2_00007FFD348A41F9
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3489E1E9	0_2_00007FFD3489E1E9
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD348A31C7	0_2_00007FFD348A31C7
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34898B48	0_2_00007FFD34898B48
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34898B40	0_2_00007FFD34898B40
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3489B280	0_2_00007FFD3489B280
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34897DFB	0_2_00007FFD34897DFB
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3489FE00	0_2_00007FFD3489FE00
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3489BE38	0_2_00007FFD3489BE38
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34896F18	0_2_00007FFD34896F18
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD348996A6	0_2_00007FFD348996A6
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD348A3B39	0_2_00007FFD348A3B39
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34899B2C	0_2_00007FFD34899B2C
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34898261	0_2_00007FFD34898261
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD348A6A89	0_2_00007FFD348A6A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299B328	2_2_0299B328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299F007	2_2_0299F007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299C190	2_2_0299C190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02996108	2_2_02996108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02996730	2_2_02996730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299C751	2_2_0299C751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299C470	2_2_0299C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02994AD9	2_2_02994AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299CA31	2_2_0299CA31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299BBD2	2_2_0299BBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02999858	2_2_02999858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299BEB0	2_2_0299BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299E517	2_2_0299E517
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299E528	2_2_0299E528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02993570	2_2_02993570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F8460	2_2_055F8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F3870	2_2_055F3870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F7B70	2_2_055F7B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F0D51	2_2_055F0D51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FED50	2_2_055FED50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F0D60	2_2_055F0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FED60	2_2_055FED60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FBD98	2_2_055FBD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F7D90	2_2_055F7D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FBD88	2_2_055FBD88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FDC00	2_2_055FDC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FB4D7	2_2_055FB4D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FB4E8	2_2_055FB4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F0490	2_2_055F0490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FE4B0	2_2_055FE4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F04A0	2_2_055F04A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FE4A0	2_2_055FE4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FD798	2_2_055FD798
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FD7A8	2_2_055FD7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FC648	2_2_055FC648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FF610	2_2_055FF610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FF600	2_2_055FF600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FC638	2_2_055FC638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FCEF8	2_2_055FCEF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FCEEA	2_2_055FCEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FB940	2_2_055FB940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FE908	2_2_055FE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F0900	2_2_055F0900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FB930	2_2_055FB930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F11C0	2_2_055F11C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FC1F0	2_2_055FC1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FC1E0	2_2_055FC1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FF1B8	2_2_055FF1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F11B0	2_2_055F11B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FF1A9	2_2_055FF1A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FE058	2_2_055FE058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FE049	2_2_055FE049
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F0040	2_2_055F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F3860	2_2_055F3860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F0014	2_2_055F0014
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FE8F8	2_2_055FE8F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F08F0	2_2_055F08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FD350	2_2_055FD350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FD340	2_2_055FD340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F73D8	2_2_055F73D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FDBF1	2_2_055FDBF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F73E8	2_2_055F73E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FFA59	2_2_055FFA59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FFA68	2_2_055FFA68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FCA90	2_2_055FCA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055FCAA0	2_2_055FCAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659AA58	2_2_0659AA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659D670	2_2_0659D670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06598608	2_2_06598608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659B6E8	2_2_0659B6E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659C388	2_2_0659C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06598C51	2_2_06598C51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659A408	2_2_0659A408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659D028	2_2_0659D028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659B0A0	2_2_0659B0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659BD38	2_2_0659BD38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659C9D8	2_2_0659C9D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065911A0	2_2_065911A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659AA48	2_2_0659AA48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06595A70	2_2_06595A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06595A60	2_2_06595A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659D662	2_2_0659D662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06595618	2_2_06595618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659560A	2_2_0659560A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06598602	2_2_06598602
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659B6D9	2_2_0659B6D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06595EC8	2_2_06595EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06595EB8	2_2_06595EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06596778	2_2_06596778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659C378	2_2_0659C378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659676A	2_2_0659676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06596312	2_2_06596312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06593730	2_2_06593730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06596320	2_2_06596320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06596BD0	2_2_06596BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06596BC1	2_2_06596BC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659A3F8	2_2_0659A3F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065933B8	2_2_065933B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065933A8	2_2_065933A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06597050	2_2_06597050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06597049	2_2_06597049
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06590040	2_2_06590040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06592818	2_2_06592818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659D018	2_2_0659D018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06592807	2_2_06592807
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06590006	2_2_06590006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06594430	2_2_06594430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065908F0	2_2_065908F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065978F0	2_2_065978F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065908E0	2_2_065908E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06590498	2_2_06590498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06597497	2_2_06597497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06590488	2_2_06590488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659B08F	2_2_0659B08F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065974A8	2_2_065974A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06597D58	2_2_06597D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06590D48	2_2_06590D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06597D48	2_2_06597D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06597900	2_2_06597900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06590D39	2_2_06590D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659BD28	2_2_0659BD28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659C9C8	2_2_0659C9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06595198	2_2_06595198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06591191	2_2_06591191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0659518A	2_2_0659518A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065981B0	2_2_065981B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_065981A0	2_2_065981A0

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5776 -s 1008

Source: LETTER OF AUTHORIZATION.exe

Static PE information: No import functions for PE file found

Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2150146211.00000118FF2A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameElujuginesojisoF vs LETTER OF AUTHORIZATION.exe
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.00000118918E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElujuginesojisoF vs LETTER OF AUTHORIZATION.exe
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000000.2078531124.00000118FEA82000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOmuxinaq> vs LETTER OF AUTHORIZATION.exe
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs LETTER OF AUTHORIZATION.exe
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElujuginesojisoF vs LETTER OF AUTHORIZATION.exe
Source: LETTER OF AUTHORIZATION.exe	Binary or memory string: OriginalFilenameOmuxinaq> vs LETTER OF AUTHORIZATION.exe

Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@6/5@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5776

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d259c026-c497-4174-832e-9ba7f2022638

Jump to behavior

Source: LETTER OF AUTHORIZATION.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: InstallUtil.exe, 00000002.00000002.4543065876.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002C06000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4544323565.0000000003A3C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002BF7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002C3A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: LETTER OF AUTHORIZATION.exe	ReversingLabs: Detection: 50%
Source: LETTER OF AUTHORIZATION.exe	Virustotal: Detection: 45%

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

File read: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe "C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe"
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5776 -s 1008
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: LETTER OF AUTHORIZATION.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LETTER OF AUTHORIZATION.exe

Static file information: File size 3097248 > 1048576

Source: LETTER OF AUTHORIZATION.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: LETTER OF AUTHORIZATION.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb#( source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2F83.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER2F83.tmp.dmp.6.dr

Source: LETTER OF AUTHORIZATION.exe

Static PE information: 0x840105AF [Tue Mar 6 15:11:43 2040 UTC]

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD34891598 push edi; iretd	0_2_00007FFD348AB2B6
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Code function: 0_2_00007FFD3496026B push esp; retf 4810h	0_2_00007FFD34960312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0299B0A5 pushfd ; iretd	2_2_0299B0AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055F2E78 push esp; iretd	2_2_055F2E79

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory allocated: 118FEDC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory allocated: 118FF450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 49B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599427	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597209	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597038	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595247	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594794	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594660	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594422	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2688			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7163			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6868	Thread sleep count: 2688 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6868	Thread sleep count: 7163 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599427s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597209s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -597038s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -594794s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -594660s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7096	Thread sleep time: -594422s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599427	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597209	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597038	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595247	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594794	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594660	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594422	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: InstallUtil.exe, 00000002.00000002.4542240473.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: LETTER OF AUTHORIZATION.exe, 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 2_2_055F7B70 LdrInitializeThunk,

2_2_055F7B70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 424000	Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 90F008	Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"			Jump to behavior
Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"			Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe	Queries volume information: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4543065876.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917c4270.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LETTER OF AUTHORIZATION.exe.118917a3828.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4543065876.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LETTER OF AUTHORIZATION.exe PID: 5776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2432, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LETTER OF AUTHORIZATION.exe	50%	ReversingLabs	ByteCode-MSIL.Spyware.Snakekeylogger
LETTER OF AUTHORIZATION.exe	45%	Virustotal		Browse
LETTER OF AUTHORIZATION.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
reallyfreegeoip.org	0%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/q	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Virustotal		Browse
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	1%	Virustotal		Browse
https://reallyfreegeoip.org/xml/	0%	Avira URL Cloud	safe
http://reallyfreegeoip.org	0%	Virustotal		Browse
http://checkip.dyndns.org/q	0%	Virustotal		Browse
https://reallyfreegeoip.org	0%	Virustotal		Browse
http://checkip.dyndns.org/	1%	Virustotal		Browse
https://reallyfreegeoip.org/xml/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
checkip.dyndns.com	132.226.8.169	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org	InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B3F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A63000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://reallyfreegeoip.org	InstallUtil.exe, 00000002.00000002.4543065876.0000000002A8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	LETTER OF AUTHORIZATION.exe, 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4543065876.0000000002A76000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States		16989	UTMEMUS	false
188.114.96.3	reallyfreegeoip.org	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464858
Start date and time:	2024-06-30 16:23:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LETTER OF AUTHORIZATION.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@6/5@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 118 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:23:55	API Interceptor	13322783x Sleep call for process: InstallUtil.exe modified
10:23:58	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	checkip.dyndns.org/
	MT STENA IMPRESSION Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	LAQ-PO088PDF.bat	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	MT STENA IMPRESSION Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT Sea Gull 9 Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT Sea Gull 9 Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Commodity Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
188.114.96.3	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	445798cm.nyashka.top/ProviderEternalLinephpRequestSecurePacketprocessauthwordpress.php
	http://www.youkonew.anakembok.de/	Get hash	malicious	HTMLPhisher	Browse	www.youkonew.anakembok.de/cdn-cgi/challenge-platform/h/g/jsd/r/89b98144d9c843b7
	hnCn8gE6NH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	yenot.top/providerlowAuthApibigloadprotectflower.php
	288292021 ABB.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?Hp=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk6zzmBcbZOQR3Nr9VCMayuUBptQdoGcq8y485hKv0f5POEUdLprTAYpXY&5H=CtUlKhgP42a
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	www.liposuctionclinics2.today/btrd/?OR-TJfQ=g2Awi9g0RhXmDXdNu5BlCrpPGRTrEfCXfESYZTVa1wMirmNXITW5szlP5E4EhRYb22U+Mw==&2dc=kvXd-rKHCF
	Purchase Order -JJ023639-PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/9a4iHwft/download
	Techno_PO LV12406-00311.xla.xlsx	Get hash	malicious	Unknown	Browse	qr-in.com/cpGHnqq
	Techno_PO LV12406-00311.xla.xlsx	Get hash	malicious	Unknown	Browse	qr-in.com/cpGHnqq
	QUOTATION_JUNQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/ygivXnVx/download
	NGL 3200-Phase 2- Strainer.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?oH=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk7xznBNrfJyFZcb5vCPyKuUBo+l90Wdia8Y821KfsfreAbg==&ML=uVzXijwPkXTxAbN

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	LETTER OF AUTHORIZATION.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	IMG_2007_520073.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	PRODUCTS LIST.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PRODUCTS LIST.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Official PO.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Prouduct list Specifictions.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
checkip.dyndns.com	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	LETTER OF AUTHORIZATION.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	IMG_2007_520073.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	132.226.8.169
	PRODUCTS LIST.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PRODUCTS LIST.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	z1MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTMEMUS	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	132.226.8.169
	LEpsypIZxU.elf	Get hash	malicious	Mirai, Moobot	Browse	128.169.91.82
	itinerary_1719382117.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Halkbank_Ekstre_20240625_082306_910668.bat.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	242010.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	MT STENA IMPRESSION Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Baltic questionnaire.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.23220.28486.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	LAQ-PO088PDF.bat	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
CLOUDFLARENETUS	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	https://bit.ly/3RPGSFw?lBj=IgAqyyGiOF?ehd=cNhnM3Ug7I	Get hash	malicious	Unknown	Browse	188.114.97.3
	a.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	exe	Get hash	malicious	Unknown	Browse	172.67.159.30
	https://fhdqc8.fi59.fdske.com/ec/gAAAAABmfF3sPeQKBD_Act5bCCrkUMkGrd87GXE85ptSvU0h8H9S97li_YZ1W2sNi71P90U8x627NEH6e-kCa62tjlvXVsamrSGp1TAMFtfgRydM8D-QFp4rxbgAeEilnkMUdRVDSB2T_2Qfh0hQuA2S3kIGAGxxOhLGRZlimak4HvWAhPpr3cGXO1dkFMRkycppPQIWKMCxf7zn-Sf2FKVlkV3bIiKpv65JecmpKmv7K1YnibkbTtyYKjzM0RBpe8SGtfO5gpSHLvPTYqZjsrGpeXbXcWmlaR9PZhWomJ586b1OeF7psyrkOXu7PHMFbYVK6t7rkfnsF9FVAXEF_z9qYdd6yq7sZRqhCkgEwDqZaPg8lBDqiVI04is9Ux1ckCdi1zoggbpZr_i4tJ1iUVNzVnpUh4z0GQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://carsales.au1.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAfnb-qPSyZecO9B5ZfywmNLbpLvp031ot7ln8fPgu7eWwZ19_ZPQHTOqDMGxjirJcrmCsSaiIDmPdIRas_zn4z1go8wNiaf6T7KGdMemdAI87j-2cWRTSM8MgKsIEHUt-&	Get hash	malicious	Unknown	Browse	162.247.243.29
	j05KsN2280.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	FIX_0x80070643_(Need_reboot).reg	Get hash	malicious	Unknown	Browse	172.67.201.134
	azl7lFUQ86.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	Evo Resou_nls..scr.exe	Get hash	malicious	AsyncRAT	Browse	172.67.75.40

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	MT Marine Tiger.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	new order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	LETTER OF AUTHORIZATION.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	IMG_2007_520073.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	30 - 3050324.scr.exe	Get hash	malicious	Remcos	Browse	188.114.96.3
	PRODUCTS LIST.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PRODUCTS LIST.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	data-sheet.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LETTER OF AUTHOR_329154322c784dbb2b1b7cad391c25af57eb70_fa2d1c6a_5a9197ca-ebb7-4c17-b016-25b978ac7f2a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.010831241850549
Encrypted:	false
SSDEEP:	96:b8Fk//RKBVsm+SboNy/qXQXIDcQqc6jcEOcw3WTiY+BHUHZ0ownOgFkEwH3d2FY9:Yq0Vz0UnU9aWB9fOzuiFhZ24lO8ELb
MD5:	2EC21C28BCA1F985F78358FBDD64D21F
SHA1:	9473C19C8359B0E9679550ABCCBE931653204022
SHA-256:	C5AED082AE721FD0A17F28E9C2D0A2C60C850118BEED6AB832A5EC58F54B4015
SHA-512:	FABD15E2E1D1F5C267FE0CF0669A84816F3B5396E55911B80AF89D2D0B16C9CA27E718EB7908788A8025AD56768A659DD4C6345B262699EE6B473F96DAD56086
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.2.3.1.0.3.3.3.6.2.7.7.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.2.3.1.0.3.4.0.9.7.1.3.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.9.1.9.7.c.a.-.e.b.b.7.-.4.c.1.7.-.b.0.1.6.-.2.5.b.9.7.8.a.c.7.f.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.a.7.c.0.d.6.-.3.a.5.b.-.4.7.6.2.-.8.d.b.4.-.0.1.a.0.b.6.f.8.7.8.d.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.L.E.T.T.E.R. .O.F. .A.U.T.H.O.R.I.Z.A.T.I.O.N...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.O.m.u.x.i.n.a.q.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.9.0.-.0.0.0.1.-.0.0.1.5.-.e.1.3.e.-.9.a.2.1.f.9.c.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.d.c.f.2.1.f.3.8.b.5.4.c.e.9.1.3.e.d.b.1.1.1.2.b.c.6.a.4.b.f.b.0.0.0.0.0.0.0.0.!.0.0.0.0.d.8.e.e.b.1.c.8.e.4.5.3.0.d.6.1.9.c.7.a.5.9.2.7.f.e.c.5.f.c.c.8.9.2.e.0.b.2.4.f.!.L.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F83.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Jun 30 14:23:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	385355
Entropy (8bit):	3.2845824508548898
Encrypted:	false
SSDEEP:	3072:36IrvJew/42G/d1mQrFY1CCq6m3+vldBB744jQGMcSpcKz:36IjJew/cZ8q6m3QP7Sf1
MD5:	0F27DED7686BCD34C61D92485BFB7BB6
SHA1:	5516BD601FFF7B127393E2327BE7E2D642E94ED0
SHA-256:	F734F18D20EC6C96C18AC15C52BFED59D6F56AC00884365DEF766DE57661AD6A
SHA-512:	680E618839A931F47277928685A4F50B655C5FDA28E6731814E27AA9CE34DD8848B5090C4D3FD9293A62842CC31B5EE466870C0DB8948FC116A0DE0EE257EF8D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......yj.f....................................$........................D..rs..........l.......8...........T...........`(.............\6..........H8..............................................................................eJ.......8......Lw......................T...........xj.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3188.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8652
Entropy (8bit):	3.719240005697245
Encrypted:	false
SSDEEP:	192:R6l7wVeJ24k6Y2DZKZgmfdLKprB89bhMffMrm:R6lXJRk6YkKZgmfdLhhMfN
MD5:	E8045ABE8DA12CC701DA5D0FB27C203E
SHA1:	896568BA97D87407C054A3EE175823876B1AF4EE
SHA-256:	592A150D134F3A9B7C3C3F99E2104562AE6313C4F37FFBC1784C718AACEC1BD2
SHA-512:	56066B36061EEBE46C0BA3FE59E7F962274C891C537BEC20EB5A259A37A2E1F4DB2A64E768FF097DED683BF5487227880EAC77C8AF327F3CB084AD8E064188C6
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31B8.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4825
Entropy (8bit):	4.582662103240114
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg771I9KVWpW8VYOYm8M4JxDFejmyq85IwkBWfoEd:uIjfzI75k7V2JSCxkfoEd
MD5:	88CF66DD862B13015FAA9834128BD129
SHA1:	C6208717FA6CCE0A1E15973C2B5FC5BA77FDE2B5
SHA-256:	79CD164FF5A07F94B99F5ABF1515E0BBCB653F72C28BB09BB0BB44EAF48110B0
SHA-512:	2B41FA5791FE918A515F5B480C6A798ACAD502019FDCD63BE0ADD95D45F5601573BA20DEEF8C32F46A7E6E56AD3AFD14A320358D10C2C7CCFD4B19D51749F303
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="390566" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46900801247698
Encrypted:	false
SSDEEP:	6144:FzZfpi6ceLPx9skLmb0f2ZWSP3aJG8nAgeiJRMMhA2zX4WABluuNTjDH5S:9ZHt2ZWOKnMM6bFpxj4
MD5:	470D51641D9D26D9D51A7C84DE2B715D
SHA1:	EC6D545E14E79009201B7F9DD1BF6FCFD995AA6A
SHA-256:	8F8E10FA33861C4AD6C42170C982CAC68DCC351F1A40E665BFB14FEC9C0C07A4
SHA-512:	1825633F1EFF664FDB438BABB30CADCB769D2B1D57058C17C8E07BDBBE9921ACAD0E8D4574831C544CEEB02A228FF10B90FAC0521389D0F3F1AECA73BFE519E3
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..>"..................................................................................................................................................................................................................................................................................................................................................).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.17071387961605
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LETTER OF AUTHORIZATION.exe
File size:	3'097'248 bytes
MD5:	57cb0d1fbbe7e57e906d9bec624ff50f
SHA1:	d8eeb1c8e4530d619c7a5927fec5fcc892e0b24f
SHA256:	235feecbf39c506144e406ee52d764d830e5124d113280a5e339bf3bdee978a5
SHA512:	7d0be14e10f4174648cb597b9f8b32883088b9fed59cd4812339cdb379746e49b58dfb357d733fcb9b73c725451b64f6588e328518091b6311ef38c1dc41d886
SSDEEP:	12288:RaoerDVWSJRvp61xGNoQOgR4FeGQ5fzF2M9PbxyWnnMRGIliKj:RinVl1Yeo0R4FeHX2qwRFj
TLSH:	37E51282B8A35D1BFC650234C5D332F16DFDAE9332F2855FEF955D89240267CA522AB0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0..3............... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x840105AF [Tue Mar 6 15:11:43 2040 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x9b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5392	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x33ae	0x3400	a4a2cdc9df72d7d8408c9c6737f107fc	False	0.6467848557692307	data	6.1944655722108	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x9b4	0xa00	d4d1a80e40a3a7dc14842f9e0ea5ba1c	False	0.31015625	data	4.215990068227885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x60b8	0x388	data			0.4911504424778761
RT_VERSION	0x6440	0x388	data	English	United States	0.4922566371681416
RT_MANIFEST	0x67c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 30, 2024 16:23:54.481656075 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:54.486485004 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:54.486573935 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:54.486789942 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:54.491558075 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:55.289753914 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:55.312232018 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:55.317486048 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:55.573235989 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:55.621259928 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:55.639023066 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:55.639069080 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:55.639130116 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:55.645484924 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:55.645507097 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.127690077 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.127840042 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.132344007 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.132355928 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.132690907 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.172832012 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.220501900 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.601824045 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.601922989 CEST	443	49701	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.602132082 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.607372046 CEST	49701	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.610258102 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:56.615066051 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:56.870302916 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:56.873667002 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.873707056 CEST	443	49704	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.873773098 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.874245882 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:56.874259949 CEST	443	49704	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:56.918131113 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:57.343919992 CEST	443	49704	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:57.386918068 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:57.416734934 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:57.416771889 CEST	443	49704	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:57.526449919 CEST	443	49704	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:57.526546001 CEST	443	49704	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:57.526592016 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:57.527146101 CEST	49704	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:57.532984018 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:57.534104109 CEST	49706	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:57.540525913 CEST	80	49706	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:57.540579081 CEST	49706	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:57.540734053 CEST	49706	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:57.541224003 CEST	80	49700	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:57.541280031 CEST	49700	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:57.545576096 CEST	80	49706	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:58.337528944 CEST	80	49706	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:58.339306116 CEST	49708	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:58.339370966 CEST	443	49708	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:58.339469910 CEST	49708	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:58.339879990 CEST	49708	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:58.339903116 CEST	443	49708	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:58.386923075 CEST	49706	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:58.811244011 CEST	443	49708	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:58.820616007 CEST	49708	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:58.820647955 CEST	443	49708	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:58.965055943 CEST	443	49708	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:58.965296984 CEST	443	49708	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:58.965389013 CEST	49708	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:58.966039896 CEST	49708	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:58.973440886 CEST	49710	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:58.979120016 CEST	80	49710	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:58.979201078 CEST	49710	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:58.979296923 CEST	49710	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:23:58.985553026 CEST	80	49710	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:59.787322998 CEST	80	49710	132.226.8.169	192.168.2.6
Jun 30, 2024 16:23:59.813589096 CEST	49713	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:59.813704014 CEST	443	49713	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:59.813787937 CEST	49713	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:59.814426899 CEST	49713	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:23:59.814461946 CEST	443	49713	188.114.96.3	192.168.2.6
Jun 30, 2024 16:23:59.840003967 CEST	49710	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:00.314718962 CEST	443	49713	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:00.339340925 CEST	49713	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:00.339400053 CEST	443	49713	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:00.521290064 CEST	443	49713	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:00.521385908 CEST	443	49713	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:00.521440029 CEST	49713	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:00.522042036 CEST	49713	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:00.525669098 CEST	49710	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:00.526345015 CEST	49714	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:00.530980110 CEST	80	49710	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:00.531044960 CEST	49710	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:00.531157970 CEST	80	49714	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:00.531219006 CEST	49714	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:00.531339884 CEST	49714	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:00.536143064 CEST	80	49714	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:01.342286110 CEST	80	49714	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:01.345330000 CEST	49715	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:01.345367908 CEST	443	49715	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:01.345443964 CEST	49715	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:01.345792055 CEST	49715	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:01.345804930 CEST	443	49715	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:01.386934996 CEST	49714	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:01.827716112 CEST	443	49715	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:01.833679914 CEST	49715	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:01.833718061 CEST	443	49715	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:01.976455927 CEST	443	49715	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:01.976600885 CEST	443	49715	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:01.976700068 CEST	49715	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:01.977574110 CEST	49715	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:01.981628895 CEST	49714	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:01.982223034 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:01.987135887 CEST	80	49716	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:01.987225056 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:01.987386942 CEST	80	49714	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:01.987421036 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:01.987449884 CEST	49714	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:01.992893934 CEST	80	49716	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:02.833487034 CEST	80	49716	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:02.835372925 CEST	49717	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:02.835405111 CEST	443	49717	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:02.835479021 CEST	49717	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:02.835767984 CEST	49717	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:02.835778952 CEST	443	49717	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:02.886929989 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.101833105 CEST	80	49716	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:03.101902008 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.557184935 CEST	443	49717	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:03.559020042 CEST	49717	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:03.559052944 CEST	443	49717	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:03.709003925 CEST	443	49717	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:03.709129095 CEST	443	49717	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:03.709186077 CEST	49717	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:03.709772110 CEST	49717	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:03.713406086 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.714744091 CEST	49718	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.718672037 CEST	80	49716	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:03.718730927 CEST	49716	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.719660997 CEST	80	49718	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:03.719829082 CEST	49718	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.719947100 CEST	49718	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:03.725676060 CEST	80	49718	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:04.508342981 CEST	80	49718	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:04.509819984 CEST	49719	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:04.509907961 CEST	443	49719	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:04.509996891 CEST	49719	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:04.510293961 CEST	49719	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:04.510330915 CEST	443	49719	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:04.558784008 CEST	49718	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:05.009772062 CEST	443	49719	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:05.011980057 CEST	49719	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:05.012042046 CEST	443	49719	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:05.149638891 CEST	443	49719	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:05.149949074 CEST	443	49719	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:05.150115967 CEST	49719	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:05.150403023 CEST	49719	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:05.153940916 CEST	49718	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:05.154968023 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:05.159545898 CEST	80	49718	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:05.159603119 CEST	49718	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:05.159837961 CEST	80	49720	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:05.159898996 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:05.159986019 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:05.164876938 CEST	80	49720	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:05.972330093 CEST	80	49720	132.226.8.169	192.168.2.6
Jun 30, 2024 16:24:05.973949909 CEST	49721	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:05.973994017 CEST	443	49721	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:05.974078894 CEST	49721	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:05.974420071 CEST	49721	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:05.974435091 CEST	443	49721	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:06.027556896 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:24:06.441863060 CEST	443	49721	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:06.443754911 CEST	49721	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:06.443775892 CEST	443	49721	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:06.600174904 CEST	443	49721	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:06.600250959 CEST	443	49721	188.114.96.3	192.168.2.6
Jun 30, 2024 16:24:06.600298882 CEST	49721	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:24:06.600863934 CEST	49721	443	192.168.2.6	188.114.96.3
Jun 30, 2024 16:25:03.338763952 CEST	80	49706	132.226.8.169	192.168.2.6
Jun 30, 2024 16:25:03.338910103 CEST	49706	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:25:11.676615953 CEST	80	49720	132.226.8.169	192.168.2.6
Jun 30, 2024 16:25:11.676697969 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:25:11.676701069 CEST	80	49720	132.226.8.169	192.168.2.6
Jun 30, 2024 16:25:11.676749945 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:25:11.676825047 CEST	80	49720	132.226.8.169	192.168.2.6
Jun 30, 2024 16:25:11.676877022 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:25:45.982181072 CEST	49720	80	192.168.2.6	132.226.8.169
Jun 30, 2024 16:25:45.987735033 CEST	80	49720	132.226.8.169	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 30, 2024 16:23:54.459386110 CEST	60829	53	192.168.2.6	1.1.1.1
Jun 30, 2024 16:23:54.468234062 CEST	53	60829	1.1.1.1	192.168.2.6
Jun 30, 2024 16:23:55.629904985 CEST	52705	53	192.168.2.6	1.1.1.1
Jun 30, 2024 16:23:55.637643099 CEST	53	52705	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 30, 2024 16:23:54.459386110 CEST	192.168.2.6	1.1.1.1	0x9417	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:55.629904985 CEST	192.168.2.6	1.1.1.1	0x11e0	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 30, 2024 16:23:54.468234062 CEST	1.1.1.1	192.168.2.6	0x9417	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 30, 2024 16:23:54.468234062 CEST	1.1.1.1	192.168.2.6	0x9417	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:54.468234062 CEST	1.1.1.1	192.168.2.6	0x9417	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:54.468234062 CEST	1.1.1.1	192.168.2.6	0x9417	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:54.468234062 CEST	1.1.1.1	192.168.2.6	0x9417	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:54.468234062 CEST	1.1.1.1	192.168.2.6	0x9417	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:55.637643099 CEST	1.1.1.1	192.168.2.6	0x11e0	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 30, 2024 16:23:55.637643099 CEST	1.1.1.1	192.168.2.6	0x11e0	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49700	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:23:54.486789942 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 30, 2024 16:23:55.289753914 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:55 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0f5f305219c90c3f8763a3db717a4f98 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jun 30, 2024 16:23:55.312232018 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jun 30, 2024 16:23:55.573235989 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:55 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6b647a698d042a7747d7265deddb91b1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jun 30, 2024 16:23:56.610258102 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jun 30, 2024 16:23:56.870302916 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:56 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0f8ee2b1a30eb138d587bd0992656191 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49706	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:23:57.540734053 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jun 30, 2024 16:23:58.337528944 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:58 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8fd17d444f014c0a1536441192b8bea7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49710	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:23:58.979296923 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 30, 2024 16:23:59.787322998 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:59 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1e06c3896ee9d2f8edc4ba5622321ff6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:24:00.531339884 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 30, 2024 16:24:01.342286110 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:01 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 35a491eb1ab3ce0ecbd1a19bff5d7867 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49716	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:24:01.987421036 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 30, 2024 16:24:02.833487034 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:02 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5ed1f29d2ee4a75fe9bb2c3dba245b36 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jun 30, 2024 16:24:03.101833105 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:02 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5ed1f29d2ee4a75fe9bb2c3dba245b36 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49718	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:24:03.719947100 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 30, 2024 16:24:04.508342981 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:04 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2c7be51425733c486078ee8f5b5be0fe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49720	132.226.8.169	80	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jun 30, 2024 16:24:05.159986019 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jun 30, 2024 16:24:05.972330093 CEST	320	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4c4b49438902d64352986b01dd99c8a2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49701	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:23:56 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-06-30 14:23:56 UTC	708	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:56 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: EXPIRED Last-Modified: Fri, 28 Jun 2024 23:11:33 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1T6xl%2F8lr2Y3vtulq%2BwkQF%2BFBCQn0vAuTOGyy7%2FDPZJ5psC6cmifWxneTcYc36vIfKcnscZvU%2FfgccP%2Bharc1GBlhC67V0o3BntEt8%2FKUTzjW0Q8yLxiSZl9qTzMDmE%2ByFEOD0wL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed128487b1a48-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:23:56 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:23:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49704	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:23:57 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-06-30 14:23:57 UTC	714	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:57 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gPV3GSWH4meC5C23FqrEKbeDWIXK3fP59K%2BFaTCU5n2pQ6ehoFi%2B%2F5ULv%2FypieJrWVf%2FedJ9qT%2FACO9N0U5Ncf5RAblSFCdu61fdWWVPOPukHm%2BR88naP%2BhWbzX%2Bic4tSqgEoEfJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed130181b4267-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:23:57 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:23:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49708	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:23:58 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-06-30 14:23:58 UTC	698	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:23:58 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h98JeW3SYh9HJ%2Bi6eEhANpltFcmRMiplNQ2g8DRxY4h82JORCuNDGVATXSylulcAcp54F2217q4EPrwoC296MAsKKgH7z0FJ2WmuxktO9GgQ6jtSSLWttwaPOhA6pjiSTjp4RcUn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed1390ef9c3fa-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:23:58 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:23:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49713	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:24:00 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-06-30 14:24:00 UTC	708	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:00 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qAL0K8p%2F0MtVgDKoCIvf3%2BWQC6FT1FRrtmrOk9%2BDQVp52RzXCup%2BQLdniZ3ZdPIDo19ilm9e%2BTQThkwN966G%2BKILuxl4pFW6ViyF84qezwi9EoRtT5ubvjMQ8ryV9L0RjwyXxqcC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed1428d280c8e-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:24:00 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:24:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49715	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:24:01 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-06-30 14:24:01 UTC	702	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:01 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2fmX8dVBAFpjl6bS%2FYodboeYbRKUmJ8nodQT7BOadZt7bIieF7W0hUyGl%2F5DA9DcZsE72qHwjlcXf3IUquSN93LK3hPXTLZPUdR6gxBs0GwCN0gnhxk7aDfZeFlzXQG%2BcV2JU2uk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed14beede1819-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:24:01 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:24:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49717	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:24:03 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-06-30 14:24:03 UTC	706	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:03 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u5mzzVQJk7dC6dnFtErMqoMJbW%2FXUImDJaDls8AbIStHsLwlf5bHvz6Nxm2r%2BzOBsWQ2kBQOrD%2F59rKSIjrBxwFTwAKVxJ09xmYW3ziZ2tyPqSXU3jaFIDVlljRN%2F2Ns%2FnIl4BSd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed156b9cc19cb-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:24:03 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:24:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49719	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:24:05 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-06-30 14:24:05 UTC	700	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WnEIYpxY0hLqHZRdkka9IuYns%2BL5AdUcGE0RASHf3OkzKAwh1iVDVTlOrMdC5hLuZs2s2sH508AmREbo2jdVJXoOKBo4KuKD2qyLc%2BTx42O2o1y2iRl0zJEbeU700hcvaCclgvG2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed15fbce5c33a-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:24:05 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:24:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49721	188.114.96.3	443	2432	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-30 14:24:06 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-06-30 14:24:06 UTC	711	IN	HTTP/1.1 200 OK Date: Sun, 30 Jun 2024 14:24:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10 Last-Modified: Sun, 30 Jun 2024 14:23:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=deYSVdZP%2BZJAYmHipQwlDXW%2BXmNT%2Fv4u9URLX%2BRPHtrdSf4gl8Fb4ubwiiYBpts0hz6kny92Vz8P5iWSpUHBhyfIKuLNADzTw69ado2%2B6V%2FmRRq4XTxMaD1%2BS1meVpBA7ddk4Nbd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89bed168cf3e8c7b-EWR alt-svc: h3=":443"; ma=86400
2024-06-30 14:24:06 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-06-30 14:24:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:23:52
Start date:	30/06/2024
Path:	C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe"
Imagebase:	0x118fea80000
File size:	3'097'248 bytes
MD5 hash:	57CB0D1FBBE7E57E906D9BEC624FF50F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2147880002.0000011881763000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2148277244.000001189170D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:23:52
Start date:	30/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0x700000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.4541927175.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4543065876.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4543065876.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:23:52
Start date:	30/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:23:53
Start date:	30/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5776 -s 1008
Imagebase:	0x7ff71ecf0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD348937DC Relevance: 3.0, Strings: 2, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X]w4, xrefs: 00007FFD34893870
fish, xrefs: 00007FFD34893830

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: X]w4$fish
API String ID: 0-2113251362
Opcode ID: 04c7caa3e04a4ea39d679faca622a0b77b82bb7b9019c37d77d9c237fedf4e23
Instruction ID: f59ff52e9800b0b5b9610624e999989156840d2641e1e4f1fc1d5f013e4eeaa3
Opcode Fuzzy Hash: 04c7caa3e04a4ea39d679faca622a0b77b82bb7b9019c37d77d9c237fedf4e23
Instruction Fuzzy Hash: 69D11931B1CE4A0FE75DAB2898A55B57BE1EF9B210B04417ED58BC3192DE28AC468781

Function 00007FFD3489E1E9 Relevance: 2.9, Strings: 1, Instructions: 1668COMMON

Download Yara Rule

Strings

4N_L, xrefs: 00007FFD3489F06D

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: 4N_L
API String ID: 0-1715493888
Opcode ID: 6681173384cf607a8d1688ea91d407b6198ad96d8e680cb21d1d42c4972eebf1
Instruction ID: 79b0d8dac4cb99b3a027476a28554e8509a55628e3630275cd71b108ab8b7a6f
Opcode Fuzzy Hash: 6681173384cf607a8d1688ea91d407b6198ad96d8e680cb21d1d42c4972eebf1
Instruction Fuzzy Hash: 96B2573160CB854FD359DB28C4A14B5BFE2FF96301B1445BEE48AC72A6DE39E846C781

Function 00007FFD34898B40 Relevance: 2.1, Strings: 1, Instructions: 866
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

YY_L, xrefs: 00007FFD3489CACE

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: YY_L
API String ID: 0-3060123179
Opcode ID: c52890d7fb6f2ff8cc3575318a27b7265a2dd3649ef51755880f144a546b4803
Instruction ID: d5d5473a06f7df4e9b4e8d1e647c590f4ffc1713ebd0838a5bf84065011209d4
Opcode Fuzzy Hash: c52890d7fb6f2ff8cc3575318a27b7265a2dd3649ef51755880f144a546b4803
Instruction Fuzzy Hash: CD42B730B18A494FDB68DF2CD4A56797BE1FF5A301F1401BEE48EC7292DE29AC429741

Function 00007FFD34891608 Relevance: 2.0, Strings: 1, Instructions: 700
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFD3489433F

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 83fe1ddf8d3141b7921383e04812966117c42e986a8c4e76a7de230ace652286
Instruction ID: f6cd3a58138d27837bb856011ca111854a369f6a47e41a2cd395dbda65e02230
Opcode Fuzzy Hash: 83fe1ddf8d3141b7921383e04812966117c42e986a8c4e76a7de230ace652286
Instruction Fuzzy Hash: 53125431B1CE4A4FE759DB6898E25B17BD0FF46314B1442BAD58EC7197EE28F8428780

Function 00007FFD348A31C7 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v^, xrefs: 00007FFD348A3547

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: v^
API String ID: 0-1724403811
Opcode ID: f8458dd686604f496d654094c10e93b04a3125c1c772f5beea7c4a928e966b2d
Instruction ID: bb44a5c8767804c974c5354ac97919348da574b386b48305fb9f503ff50cdd31
Opcode Fuzzy Hash: f8458dd686604f496d654094c10e93b04a3125c1c772f5beea7c4a928e966b2d
Instruction Fuzzy Hash: 3F025C31B0FA454FE3E9C76C94A657477D1FF9A320B1402BED94DC7292DE9CA8068391

Function 00007FFD34898B48 Relevance: 1.6, Instructions: 1634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26909a3c4b419b1b4cbfb0b9f4f20d41b963f19fa9b13a74fbf76696fb2ac907
Instruction ID: 8e9a10ab055cef324573e1072921921d21a48c231de86c33acc4abfbc1665246
Opcode Fuzzy Hash: 26909a3c4b419b1b4cbfb0b9f4f20d41b963f19fa9b13a74fbf76696fb2ac907
Instruction Fuzzy Hash: 3AC2D331A0AA498FDB99DF28C4A56B877E1FF56300F1400BED04EC72A2DE79AC45DB51

Function 00007FFD3489B661 Relevance: 1.1, Instructions: 1133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02537ae722e63b6971960d31be37cdbbb37c90306cbcbc482d48420adf29ec6
Instruction ID: 0f3a25f7a442e6b7b10aafc9df030f988cf02c33fa7303ae894b833046deaffa
Opcode Fuzzy Hash: c02537ae722e63b6971960d31be37cdbbb37c90306cbcbc482d48420adf29ec6
Instruction Fuzzy Hash: 0B72F131A0DB8A4FE756CB3888A44A47FF1FF57200B1941FED589CB1A3DA2DA846C741

Function 00007FFD3489FE00 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba4563c08cd0d5bf44534a7d33e457caf966b4a638bb0139f39d3baaf020888
Instruction ID: a7159af9fc50b4395ce5dfaa7620bf0075ae056b5949c18a42bd6b56160b2a0c
Opcode Fuzzy Hash: 8ba4563c08cd0d5bf44534a7d33e457caf966b4a638bb0139f39d3baaf020888
Instruction Fuzzy Hash: 99426831A0DB4A4FE3A9DF2884A15B577E1FF97304B1041BED58AC7292DE29E846C781

Function 00007FFD3489B280 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd482d4d2a61e506f0be553ebfb898f729fbbc8871656dcd8038b4b51cc9780d
Instruction ID: e575f684d81e8e177a68979f581625d0e3c3efd2e5854c345df3c39b7dfdb4ed
Opcode Fuzzy Hash: dd482d4d2a61e506f0be553ebfb898f729fbbc8871656dcd8038b4b51cc9780d
Instruction Fuzzy Hash: B4D1193160CF854FE359CB2D84E51B5BBE2FF96301B14867EE5C6C72A1DA28E842D781

Function 00007FFD3489AEBF Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742b256138c46a605541d5a94aaeb126684361781ec5d62f15f77370f1f950fb
Instruction ID: a1afb68465b3461b5a780d75967b0296ce010005144d5f00d1b1620b7efa1f19
Opcode Fuzzy Hash: 742b256138c46a605541d5a94aaeb126684361781ec5d62f15f77370f1f950fb
Instruction Fuzzy Hash: 2D915C71B1CBC60BE75DCB2D84E11B5BBD2EFC6301B04857ED9DAC32D5D928A8029781

Function 00007FFD348A41F9 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de6dcd4ec5e6fe43fcbe4964cbc5971cb7a8a874f04ddbf1e8ef6b9b7660160
Instruction ID: 4214d0ff5d828b6c96bd25a3b3aa0d8579e44803844d196ce07e7461192aaea5
Opcode Fuzzy Hash: 4de6dcd4ec5e6fe43fcbe4964cbc5971cb7a8a874f04ddbf1e8ef6b9b7660160
Instruction Fuzzy Hash: 5F515831B0D7490FE75E8B6888651A57BE1EB87320B15C2BFD48AC7197DD38A8468392

Function 00007FFD3496026B Relevance: 1.7, Strings: 1, Instructions: 432
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FFD34960236

Memory Dump Source

Source File: 00000000.00000002.2150887416.00007FFD34960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34960000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 8948f4708215054b352b8edb35a9b6a0d2a3ee4e59d9e1105810a0545d5853e4
Instruction ID: 245cc93f6b62ed46b8ddde5ee121cb4e3974e268f98a6f4d832018d07b0f954d
Opcode Fuzzy Hash: 8948f4708215054b352b8edb35a9b6a0d2a3ee4e59d9e1105810a0545d5853e4
Instruction Fuzzy Hash: 74D13B72A0D6864FE765DB2888E55A87BE0FF97330F0505BED588CB0D6DB2C68069351

Function 00007FFD348A7829 Relevance: 1.6, APIs: 1, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD348A78D1

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 75f555cc976e19688d4bdde7c5be042c5fdd866d2fae12b490ad4ef1aa982af1
Instruction ID: ea637dd4fab57719c51f200260c3764145f9fad9e33d64e71fc7ba8cf1dd0d3a
Opcode Fuzzy Hash: 75f555cc976e19688d4bdde7c5be042c5fdd866d2fae12b490ad4ef1aa982af1
Instruction Fuzzy Hash: E131D430A0CB5C5FDB18DFA898466F97BF1EB5A321F04426FD049D3152DB74A846CB91

Function 00007FFD34961091 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150887416.00007FFD34960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34960000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637db4fcca9bd3f4b6d71d1d60084a1dd9f931d48b725b637560d15fd98a947f
Instruction ID: df8f289f1dfcc74226c414a988ee2e4bab23d50c0bc2d763e3d0316e76f10b72
Opcode Fuzzy Hash: 637db4fcca9bd3f4b6d71d1d60084a1dd9f931d48b725b637560d15fd98a947f
Instruction Fuzzy Hash: E451593160DAC94FDB16DB2888A34E87BA0FF57330B1501FEC589CB09BCA1DA846D791

Function 00007FFD349610FC Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150887416.00007FFD34960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34960000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f96c75b200b97bbfc21da21b6d265d75d61b49833b4fe8930ddd30937ca86b3
Instruction ID: 3d57ecbbb31b6d65dea2b3ce6b14d9d74d93d8e6026366964a83de6ef490f1f6
Opcode Fuzzy Hash: 7f96c75b200b97bbfc21da21b6d265d75d61b49833b4fe8930ddd30937ca86b3
Instruction Fuzzy Hash: 9A416B35A0CA8D4FDB56DF14C8E64A87BF0FF56324B0501BEC18ACB19ACE2DA841D790

Non-executed Functions

Function 00007FFD348A3B39 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

:32;, xrefs: 00007FFD348A3BC3
gfff, xrefs: 00007FFD348A3BA6

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID: :32;$gfff
API String ID: 0-1317646537
Opcode ID: e8b4d00b497fd8b8243c6b314141aa32840210e1bb0dc05d1137ab8a04462d6f
Instruction ID: 04cfe6b59d59116e3e26c73c95d08d06fbf229213646e76e553f21e38c8947b6
Opcode Fuzzy Hash: e8b4d00b497fd8b8243c6b314141aa32840210e1bb0dc05d1137ab8a04462d6f
Instruction Fuzzy Hash: 2451293260E7D50FD31B86799C664A17FE5DB8722070982FBD582CB1E3E9596C0BC392

Function 00007FFD34899B2C Relevance: 1.0, Instructions: 1028COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5945139cd397e6f452734002e2c62c3e57875e7bca25cad5f898fd4dd63cc0
Instruction ID: 34051b6025f2603b4eba2373a4f09c2b735ac80033c32b6518aa19beccd86790
Opcode Fuzzy Hash: af5945139cd397e6f452734002e2c62c3e57875e7bca25cad5f898fd4dd63cc0
Instruction Fuzzy Hash: FC427B16A8EBC60FE75357744CB50A47FB49E2365071E51EBC6C5CB1E3EA0D280AE722

Function 00007FFD34896F18 Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ece43c7a59ccbb3da2cfd3409c78e2ae1955fd8e6dba33718c83be7576d1ee2
Instruction ID: 56ddfeabec820e471d6018840dfbd1886ad55a7b9e78969413013fea714345de
Opcode Fuzzy Hash: 1ece43c7a59ccbb3da2cfd3409c78e2ae1955fd8e6dba33718c83be7576d1ee2
Instruction Fuzzy Hash: 5E027F21A4EBC60FE3678B7848710A57FE0AF5321071A41FBC599CB1E3DA1DA84BD752

Function 00007FFD348A6A89 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225588b0ae73dcbf8340f901fd9cb6d6ba8ec48f80445befe4f0db53ef2047e7
Instruction ID: b3a662d7a62337a56a28626c66342d6a575261f29ebd9cd94dd7ef0f3f690130
Opcode Fuzzy Hash: 225588b0ae73dcbf8340f901fd9cb6d6ba8ec48f80445befe4f0db53ef2047e7
Instruction Fuzzy Hash: 97E1153070DA894FD799DF28C4A497977E1FF96300B0441BEE48AC72A6DE29EC46C751

Function 00007FFD348996A6 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21efa8a61c57bc19dd1d52200e2b57acfb2d72054cc4f1ea512ec4716c7cdf0d
Instruction ID: 7edf1143ed084b664a4ac016af31c7e6efc9caa4dfd58d0eb0e110ce6a13b3f4
Opcode Fuzzy Hash: 21efa8a61c57bc19dd1d52200e2b57acfb2d72054cc4f1ea512ec4716c7cdf0d
Instruction Fuzzy Hash: 71B16726A8EBC60FE7134B744CB50A47FB49E2365071E51EBC5C5CB1E3DA1D580AEB22

Function 00007FFD3489BE38 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3db549b929373e6f8f03c76b9e3c3c31a38852830adb0da0c5e4a7bed7c5a5
Instruction ID: 92aaf4d167e40be58781b5d254dc89695f50b31a7686eb2f4da0357036f789b1
Opcode Fuzzy Hash: fe3db549b929373e6f8f03c76b9e3c3c31a38852830adb0da0c5e4a7bed7c5a5
Instruction Fuzzy Hash: F3517725A8E7D60FE7234A750CB14997FB0AA2355070E51EBC684CF4E3DA0D580EE762

Function 00007FFD34897DFB Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b1c8b8f37d90f55d9005ef606cf48e58e3a9462ed033ec5c0d77c57b512d69
Instruction ID: 76010824f42768f0ad941fd552dbf9fb15a0728e27ddfbaae07143b92be691fb
Opcode Fuzzy Hash: 17b1c8b8f37d90f55d9005ef606cf48e58e3a9462ed033ec5c0d77c57b512d69
Instruction Fuzzy Hash: 77715212A0D7A25BD712B7FC68B61EA7FA49F0332870C45B7D1C8DA093FD7C644A9285

Function 00007FFD34898261 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150688844.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_LETTER OF AUTHORIZATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf87ac59869ebf25371503e2b7626511ebebfc700be5cec1f507cbf01f0060c
Instruction ID: 6dd9d82fb3151fd7917b7c3d1f79419046565fdf14fbc650e3d5fe28b1426b93
Opcode Fuzzy Hash: 9bf87ac59869ebf25371503e2b7626511ebebfc700be5cec1f507cbf01f0060c
Instruction Fuzzy Hash: 2E51EC12A0D7D22BE72277FC69B60EA7FA49F0332870C55B7D1C89A093ED6C64469285

Analysis Process: InstallUtil.exePID: 2432, Parent PID: 5776COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	18.4%
Total number of Nodes:	38
Total number of Limit Nodes:	5

Executed Functions

Function 055F7B70 Relevance: 2.0, APIs: 1, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b66be34a7378510d16235fa55435ca83528b642ca207c3ae47ca66cde24be9
Instruction ID: a18e7d5abc0cc0067afab40955fb2d6647a6555d87bd19f41ea0b3f4986756bb
Opcode Fuzzy Hash: 20b66be34a7378510d16235fa55435ca83528b642ca207c3ae47ca66cde24be9
Instruction Fuzzy Hash: 44220874E00219CFDB14DFA9C884BADBBB2FF88304F1485A9D509AB355DB359986CF50

Function 02999858 Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2c11272ec6072734bc99ba667a081f1492897fada273ee2e53c0b04fc018bd
Instruction ID: 36165c1c7e04d94488b47bf3965cb87fe8161e1be5f60de9020bfa3eedb7813e
Opcode Fuzzy Hash: 8f2c11272ec6072734bc99ba667a081f1492897fada273ee2e53c0b04fc018bd
Instruction Fuzzy Hash: E5728D70A00209CFDF15CF69C984AAEBBB6FF88324F158569E8059B3A5D735ED41CB60

Function 065911A0 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b90f056ba8c9fcb2c531c70e61638927948b51dde187a44a1150cbdc5f28e4
Instruction ID: 8b31639489dc2096fba9efe34e69353112953977c34bab46930433f9039ccd0e
Opcode Fuzzy Hash: b6b90f056ba8c9fcb2c531c70e61638927948b51dde187a44a1150cbdc5f28e4
Instruction Fuzzy Hash: 8E826E74E01229CFDBA5DF69C998BDDBBB2BB89300F1481E9A40DA7254DB345E81CF50

Function 0299F007 Relevance: .7, Instructions: 720
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52b2524dbcbdc7f5562a43b00036837674d73340ebb5018562cff4258fc5c47
Instruction ID: 6735e5ed6fca335338369eae715dd52a0ee5aa27642a655ff92002b0f7401d89
Opcode Fuzzy Hash: e52b2524dbcbdc7f5562a43b00036837674d73340ebb5018562cff4258fc5c47
Instruction Fuzzy Hash: 9672CD74E00229CFDB64DF69C984BE9BBB2BB49314F1481EAD40CA7255EB349E81CF50

Function 02996108 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd24ad86c5822c1fcbd6bd0cf0273fc2b39c368d563235f96d6285f8d20b185b
Instruction ID: 64e81864b128b1617f38b7ebd4581b402396ba32456e2f33c5c8257b71bd6cb1
Opcode Fuzzy Hash: dd24ad86c5822c1fcbd6bd0cf0273fc2b39c368d563235f96d6285f8d20b185b
Instruction Fuzzy Hash: 1D12AE70A002198FDB14DFA9C954BAEBBFAFF88314F148569E409DB395DB359C42CB90

Function 02996730 Relevance: .5, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d03d15e613605fa517553bfa2e594d3e1670691e688a03aa935c22016dfdddf
Instruction ID: 8b70af0ad5360c2872a0b988c61e19dc8121c5d4a50030a715d9d271cbf84573
Opcode Fuzzy Hash: 1d03d15e613605fa517553bfa2e594d3e1670691e688a03aa935c22016dfdddf
Instruction Fuzzy Hash: 08123970A00209DFCF14CFADC984AADBBBAFF88364F158469E505AB265E735EC41CB50

Function 02993570 Relevance: .4, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9adc6a7a60c32a08d1255029104cb0bdc164a5234e25ac13e82e404a72c0aa
Instruction ID: 70ac0de87351ca97fe6e081635f5093a62670f4cd382df896e6203588286b201
Opcode Fuzzy Hash: 1c9adc6a7a60c32a08d1255029104cb0bdc164a5234e25ac13e82e404a72c0aa
Instruction Fuzzy Hash: 04F15B74E01248DFDF08DFB9D4546AEBBB3BF88710B14896DE806AB354DB359812CB94

Function 0299B328 Relevance: .4, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572049febc2186d008d75f16592baa5128fd9babc6b23fda4467c65360f6511e
Instruction ID: aef0a819e58fbf06728ad6a0e04d97b875646510a5a041d68395230d029fd004
Opcode Fuzzy Hash: 572049febc2186d008d75f16592baa5128fd9babc6b23fda4467c65360f6511e
Instruction Fuzzy Hash: 0EE11A75E00218CFDF14CFA9D894A9DBBB6FF99328F158069E819AB361D734A841CF50

Function 06598608 Relevance: .3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740ecea33664e5b630b6f1eee87cf3719a335be704d33d88281e9bc89e8f6368
Instruction ID: aef16978c706c259685a296d8437152edb53ee83ec419b8b5b0874986bef8f6a
Opcode Fuzzy Hash: 740ecea33664e5b630b6f1eee87cf3719a335be704d33d88281e9bc89e8f6368
Instruction Fuzzy Hash: 4DE1D474E00218CFEB54DFA5C994B9DBBB2FF89304F2081A9D418AB395DB355A85CF60

Function 0659D670 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ec2ad2b6891c0596f7859f9b57226ba65a2527f46f01c683e837627dea27cd
Instruction ID: 73c5c498c85d9d2eece9fec937a2e43a55cd0f19227cdd75e81aac8f9d4b3732
Opcode Fuzzy Hash: f2ec2ad2b6891c0596f7859f9b57226ba65a2527f46f01c683e837627dea27cd
Instruction Fuzzy Hash: 30A1A271E016188FEB68DF6AC944B9DBBF2BF89300F14C1AAD40CA7255DB345A85CF60

Function 0659B6E8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52430b8b6e1942d7060f0987569ec36c1256568306dbc9a4d9b91dec80e1467b
Instruction ID: 6e9eacfde2388f9d711f9bea7af829335365bf3d4724b624556f05c1a1bb500b
Opcode Fuzzy Hash: 52430b8b6e1942d7060f0987569ec36c1256568306dbc9a4d9b91dec80e1467b
Instruction Fuzzy Hash: 3FA1A671E012188FEB58CF6AD944B9EBBF2BF89300F14C1AAD40CA7255DB345A85CF50

Function 0659C388 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84dbd7b027269d6d9c0d9559817c5fa361a61d530e896fb0cbd21f4b70765b0
Instruction ID: 616d89724202d491a318e41ea1dcc29a9f1d4ea4b308d5bd1b7f539f2baa4a1a
Opcode Fuzzy Hash: f84dbd7b027269d6d9c0d9559817c5fa361a61d530e896fb0cbd21f4b70765b0
Instruction Fuzzy Hash: 01A18275E012188FEB68CF6AD944B9DBBF2BF89304F14C0AAD40DA7255DB345A85CF60

Function 0659A408 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0883f8f432ce60e3a358ff2e0cb1d52e99d51a43a174855ba1d98d908ecfa4e1
Instruction ID: 8cf6704e1090bb9a502c448ad8d6da4970cb934f5dc1814c26b6131a73c58245
Opcode Fuzzy Hash: 0883f8f432ce60e3a358ff2e0cb1d52e99d51a43a174855ba1d98d908ecfa4e1
Instruction Fuzzy Hash: F9A19275E012188FEB68CF6AC944B9DBBF2BF89300F14C1AAD40DA7255DB345A85CF60

Function 0659BD38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9fafc960c178ab5dac64a516711cf6a0d4c2fff77da24f92e7fcc59d9b4814
Instruction ID: 2878167582b685a799d9ebfed949663c62ab82694d1395366b621135a3786a39
Opcode Fuzzy Hash: 7c9fafc960c178ab5dac64a516711cf6a0d4c2fff77da24f92e7fcc59d9b4814
Instruction Fuzzy Hash: 8CA19575E012188FEB68CF6AD944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF50

Function 0659C9D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18b758e11f3f59bffc6522b1dd3a598a49a00e07255172fc465a290ae815957
Instruction ID: b129215ef654d13118f598ad1f051ee5bc9966efffaa23279a89aec7bdf51aef
Opcode Fuzzy Hash: a18b758e11f3f59bffc6522b1dd3a598a49a00e07255172fc465a290ae815957
Instruction Fuzzy Hash: 0DA18275E012188FEB68CF6AD944B9DBBF2BF89300F14C1AAD40DA7255DB345A85CF60

Function 0659AA58 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408b67e0c80c2e6ec59514cc39b7a2101387d0fa0b7f8c66f4fc880f77b4430d
Instruction ID: efc835815db9bceafd5ab4781631b2bcaa2da4e4da564e604c6fa0e4871edeb8
Opcode Fuzzy Hash: 408b67e0c80c2e6ec59514cc39b7a2101387d0fa0b7f8c66f4fc880f77b4430d
Instruction Fuzzy Hash: C1A18375E012188FEB68CF6AD944B9DBBF2BF89300F14C0AAD40DA7255DB345A85CF60

Function 0659D028 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b568e282d039ba5e056156705f589585b7d0d4455318761b06bbcb01f1ed8ee
Instruction ID: a73bb581c9b117c29583f3bf4adbfe465283aeca2442a680f707c9c3a8e1211b
Opcode Fuzzy Hash: 8b568e282d039ba5e056156705f589585b7d0d4455318761b06bbcb01f1ed8ee
Instruction Fuzzy Hash: F6A18175E016188FEB68CF6AC944B9DBBF2BF89300F14C1AAD40DA7255DB345A85CF60

Function 0659B0A0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f5541824463280130b4004a880238e9237b2be4eb0e772bfe6d78eba89153f
Instruction ID: f01372abbd432d3ac00a93eef224da55d8836a7bf5dab354e21d7e9298048e2e
Opcode Fuzzy Hash: 03f5541824463280130b4004a880238e9237b2be4eb0e772bfe6d78eba89153f
Instruction Fuzzy Hash: DAA19675E012188FEB68DF6AD944B9EBBF2BF89300F14C1AAD40CA7255DB345A85CF50

Function 0299BEB0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4665d1707f07ed09b362e27c99f1d60c6a8e47d59d3e8ba5b1459a14618e59
Instruction ID: f9f09702933dee4d0ff04799512392b7be72f1c6ed99b09aa7e0d9c95c5f0bc6
Opcode Fuzzy Hash: cd4665d1707f07ed09b362e27c99f1d60c6a8e47d59d3e8ba5b1459a14618e59
Instruction Fuzzy Hash: C981A174E00218CFDF18DFA9D994A9DBBB2BF89314F14C06AE419AB265DB349942CF50

Function 0299C751 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e323dfb43e743640920c4fcfc14b972f6cdf2fd9a91f363452f26a799a9fb23b
Instruction ID: 6bf071648fc83094fecd427eee7f8d13a405dbf9b3205e1f50b29f2f0f9f8ccf
Opcode Fuzzy Hash: e323dfb43e743640920c4fcfc14b972f6cdf2fd9a91f363452f26a799a9fb23b
Instruction Fuzzy Hash: D281A374E00218DFDB18DFAAD994A9DBBF2BF89310F14C46AE419AB365DB309941CF50

Function 0299C190 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2aad3ee71b2a40d90a726c78ff6409dfe174096392925925e1d5beaf4571ae8
Instruction ID: a93f6a2552a67115f802ea868a4083a217245e235d5c8c8473acb6cb212d9de7
Opcode Fuzzy Hash: d2aad3ee71b2a40d90a726c78ff6409dfe174096392925925e1d5beaf4571ae8
Instruction Fuzzy Hash: B381C474E00208CFEB14DFAAD994A9DBBF2BF89314F14C46AE409AB365DB309941CF54

Function 0299BBD2 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13789d2c5440026f6160c451ff233465ff17b44a0602b806b928a5e8e8c721d
Instruction ID: b7b18061cc4ab5b50a6a8dee99ba4b03697072c3a74cee4354aad16a445cbd26
Opcode Fuzzy Hash: a13789d2c5440026f6160c451ff233465ff17b44a0602b806b928a5e8e8c721d
Instruction Fuzzy Hash: E881B2B4E00208CFEF18DFAAD994A9DBBB2BF89314F14C069D509AB365DB349941CF50

Function 0299C470 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cd50cba7b45e6fd92c45fc9bb1a821d5a6a1e3dc8cf3b23d479e8feed1fe31
Instruction ID: 62c5bbaf8674f4d418bb65d3b475f50aecd70bd5a0ce7fd510bd4741bec9b562
Opcode Fuzzy Hash: 31cd50cba7b45e6fd92c45fc9bb1a821d5a6a1e3dc8cf3b23d479e8feed1fe31
Instruction Fuzzy Hash: 8881B474E00218DFDB14DFA9D994A9DBBF2BF88310F24D46AD419AB365DB309941CF10

Function 02994AD9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5108a73be088f42a51a88d3ea434a80fa1a13327e44ec65c185a86409e5bb87d
Instruction ID: 7a5ad8cb38ba3ae0a52724430fdbfb2c4f257924ef195b164bb0cca06ffb9811
Opcode Fuzzy Hash: 5108a73be088f42a51a88d3ea434a80fa1a13327e44ec65c185a86409e5bb87d
Instruction Fuzzy Hash: B781B374E00218DFDB15DFAAD984A9DBBF2BF88311F14D069D419AB365EB309942CF50

Function 0299CA31 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630d89c94fcc86f4f1586ba2e4517c2995257ef99623fda95bcfe6f74f7c5b57
Instruction ID: 95749202a94b5b185d18ca1edf9205dce298c5cdc00595f00d903ae1e335e080
Opcode Fuzzy Hash: 630d89c94fcc86f4f1586ba2e4517c2995257ef99623fda95bcfe6f74f7c5b57
Instruction Fuzzy Hash: 82818474E00218DFEB14DFA9D994A9DBBF2BF88314F14C46AD419AB365EB309941CF50

Function 06598C51 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a441525c3b145cab4300c83b93eeb6a82e272a1172bd32c727cc2f44b011efb1
Instruction ID: ba42a4337e814f7552b086289410a1456daf23efe9ec26508bddd90016524d31
Opcode Fuzzy Hash: a441525c3b145cab4300c83b93eeb6a82e272a1172bd32c727cc2f44b011efb1
Instruction Fuzzy Hash: 4881E074E01218CFDF58CFAAD854BAEBBB2BF89300F20856AD419AB354DB345946CF50

Function 06591191 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ec0571f13b632eac1ca793984479ab2c3d650f619f792bcafacc3e86a33156
Instruction ID: 090529871352fab6b8d4ea4b3aad235bba8cb5741e0ff82046db423a8c1a5e8b
Opcode Fuzzy Hash: 35ec0571f13b632eac1ca793984479ab2c3d650f619f792bcafacc3e86a33156
Instruction Fuzzy Hash: B581A174E012299FDBA5DF29D991BDDBBB2BB89300F1080EAD809A7254DB315E81CF50

Function 0659D018 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff3d66bce7dd4512ed6c737571e9262869366c913cdc5bdc4827c0daf1150eb
Instruction ID: 81e12deddf67d1703fd39270607b5c5d19678174c8dd56e814a2236482c6067a
Opcode Fuzzy Hash: 7ff3d66bce7dd4512ed6c737571e9262869366c913cdc5bdc4827c0daf1150eb
Instruction Fuzzy Hash: 44719371E016188FEB68CF6AC954B9EBBF2BF89300F14C5AAD40DA7254DB344A85CF51

Function 0659B08F Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e1cd4ec9490ce01d33b3e098635ba2130225b0b0adc3fadb8395ee51557ef2
Instruction ID: 7ec313243e1a5d35275dc37130958cec6c908cdf16d4f958bfa03e0753016ccf
Opcode Fuzzy Hash: 50e1cd4ec9490ce01d33b3e098635ba2130225b0b0adc3fadb8395ee51557ef2
Instruction Fuzzy Hash: 42718571E016188FEB68CF6AD944B9EBBF2BF89300F14C5AAD40DA7255DB344A85CF50

Function 0659AA48 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0696ce8f1f60f5b465f9a4890db3d576ffe5a683e684867b796a1baf4b3ca13c
Instruction ID: 78d7a7206ef7ffdfa1bcd64f1b2090e8c9d553052254896e680e67d07b698233
Opcode Fuzzy Hash: 0696ce8f1f60f5b465f9a4890db3d576ffe5a683e684867b796a1baf4b3ca13c
Instruction Fuzzy Hash: BE717471E016188FEB68CF6AC944B99BBF2BF89300F14C0AAD40DA7255DB344A85CF61

Function 0659C378 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed85c4ea60238d04babf7b0b8f6154ed822897d70feaffc615d3674850e9cdc1
Instruction ID: fdec761c25a05736020fe55e37c55a38f0abd2396a3a22e0fda208d8a031b374
Opcode Fuzzy Hash: ed85c4ea60238d04babf7b0b8f6154ed822897d70feaffc615d3674850e9cdc1
Instruction Fuzzy Hash: BB519B71D016189FEB58CF6BCD557DAFAF3AFC9200F14C0AAD40CAA255DB7409868F61

Function 0659C9C8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4a1fed8888395619217ec22e796fa47f574bbbc970294d6f730ace479954d7
Instruction ID: fa40fc74624782311e1d786192f2df30db90128de6e08f42c7f85ab5571883d0
Opcode Fuzzy Hash: db4a1fed8888395619217ec22e796fa47f574bbbc970294d6f730ace479954d7
Instruction Fuzzy Hash: 1A517971E016188BEB58CF6BDD547DAFAF3AFC9310F04C1AAC50CA6265DB340A868F51

Function 06598602 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b835b5e1c2e5456d9cfb1546b60f07a0ce2b36a4df0ee8f8b51e0f84bba98522
Instruction ID: e339abbddea9660b44ae5cf9d4781b774509733472f90698171d3fda3892b977
Opcode Fuzzy Hash: b835b5e1c2e5456d9cfb1546b60f07a0ce2b36a4df0ee8f8b51e0f84bba98522
Instruction Fuzzy Hash: E141C2B0E006088BEB58DFAAD8547DEBBB2BF89300F14C469C418BB254DB754946CF64

Function 0659BD28 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4e8992da84010be3ac10447f5bb4315dc33763ea21ea7b0d54131973fe2f10
Instruction ID: 90e7b023ae5246e3ec0acf52f21067a398087ac136ee8b040bcb859756c6d610
Opcode Fuzzy Hash: 5e4e8992da84010be3ac10447f5bb4315dc33763ea21ea7b0d54131973fe2f10
Instruction Fuzzy Hash: F64179B1D016188FEB58DF6BD9557DAFAF3AFC9310F14C0AAC50CA6255DB340A868F50

Function 0659D662 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb4ed02dcb3f99d4765d87adc38e5cab1055808c1ce931301e4c065c6e9d667
Instruction ID: 6d7aa54af685365ab7d3ecd6ae626d7f69914f68cc5a982cc09acd907dd863e5
Opcode Fuzzy Hash: 9bb4ed02dcb3f99d4765d87adc38e5cab1055808c1ce931301e4c065c6e9d667
Instruction Fuzzy Hash: 354178B1E016188BEB58CF6BCD447DAFAF3AFC9300F14C1AAD50CA6254DB740A858F50

Function 0659A3F8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc0105deb99f1f0bbb92e42ebe4f187366b7bc72af6943382ce8202e644a935
Instruction ID: c68765ec776fcc7f57e6ede262a2d1311f3dc58efe556aa50f1f668f83286450
Opcode Fuzzy Hash: 9fc0105deb99f1f0bbb92e42ebe4f187366b7bc72af6943382ce8202e644a935
Instruction Fuzzy Hash: 604166B1E016188BEB58CF6BC9457CAFAF3AFC8300F14C1AAC50CA6265DB740A858F51

Function 0659B6D9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d2c9199b83fd4e6fb196f6a9fe5b59d6784c1a6e9b6d06806c3f8014120321
Instruction ID: e285cf29fce8a8b768c35b721e568a83fda762ceedd2c2f6ca9f12f989238e3b
Opcode Fuzzy Hash: d0d2c9199b83fd4e6fb196f6a9fe5b59d6784c1a6e9b6d06806c3f8014120321
Instruction Fuzzy Hash: FA4169B1D016188BEB58CF6BD9547DAFAF3AFC9310F14C1AAD50CA6264DB740A86CF50

Function 055F8174 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 055F82B6

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3dd19e3a4ee5024c5e7940a5eaa7c02b1ab7646801921c38afd838303dfdd726
Instruction ID: 814a8bb501da847ac00c5f8ca21d3404435bf1756d1a4867e4cba238d02c6967
Opcode Fuzzy Hash: 3dd19e3a4ee5024c5e7940a5eaa7c02b1ab7646801921c38afd838303dfdd726
Instruction Fuzzy Hash: A8114C74E012099FDB14DBE8D884EADB7F6FF89318F548165EA48E7345D730A941CB60

Function 029977F0 Relevance: .7, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38b04f83274c53de1f8d2e23096c3d0fe99df2e47cead9ba0be1ced6ad37603
Instruction ID: b8bf6bca0db94076c46794e68eba29b582c64e12351704ce78aa6bc02589e9d3
Opcode Fuzzy Hash: d38b04f83274c53de1f8d2e23096c3d0fe99df2e47cead9ba0be1ced6ad37603
Instruction Fuzzy Hash: CE521D34A00218CFFB159FA4C860BAEBB76EF89710F1081ADD20AAB395DB359D45DF51

Function 029987E9 Relevance: .5, Instructions: 503
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ae243a904dbf6eea9b839c0cd0c8d11cce1b801cb302c712127a5eea121f41
Instruction ID: ea6b5e0dd53de47cbaa50d24883a09c0dfebcfb83130e736ab36cd34bc551fd5
Opcode Fuzzy Hash: 86ae243a904dbf6eea9b839c0cd0c8d11cce1b801cb302c712127a5eea121f41
Instruction Fuzzy Hash: E4F15B703152018FDF199A3EC958B39779ABF86625F1944AEE502CF3A2EB29CC42C751

Function 02996E58 Relevance: .5, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75dc7f425b2daa4f3687173772cb7b73f8824aaff4ee37522e5cc7550d1285f1
Instruction ID: a746463732a9da469310bf6e948e27601b6e6d9ac8c056367b14e88ce09e81f8
Opcode Fuzzy Hash: 75dc7f425b2daa4f3687173772cb7b73f8824aaff4ee37522e5cc7550d1285f1
Instruction Fuzzy Hash: A6125A70A10209DFCF14DFA9D884A9EBBF6FF88324F148569E8099B261DB31ED41CB50

Function 0299A818 Relevance: .4, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef673c546b2bcad0eeec06f012dcd63c78301cc82857b8cc8724ee2c8e8e49e
Instruction ID: d1008273fabc7cb2990276d183bd6c87a000b2597f4b950ae2c6378340d271f2
Opcode Fuzzy Hash: 8ef673c546b2bcad0eeec06f012dcd63c78301cc82857b8cc8724ee2c8e8e49e
Instruction Fuzzy Hash: D7F10B75E001158FCB04DF6DC988AADBBF6FF88324B1A8069E519AB365DB35EC41CB50

Function 02990C8F Relevance: .4, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf9a1b9b16a7bd18402ea394d8ea4a4c039166b4619ab7e2e6ab704c796082e
Instruction ID: adece0c4a06ec17b6aeda90050876cd620d05afb0907da2567ceeaf9b2b50af3
Opcode Fuzzy Hash: fbf9a1b9b16a7bd18402ea394d8ea4a4c039166b4619ab7e2e6ab704c796082e
Instruction Fuzzy Hash: C3220874A0421ACFCB95EF65E995B9DBBB2FF48301F1086A9D409AB318EB306D45CF50

Function 02990CA0 Relevance: .4, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa318ee4cda9e84bd54e00c080e3f955a6f2c229a45e556c213643f6f94ce276
Instruction ID: cfb426704e690e9eee07082294b672882272609134627add27dc0f4151821283
Opcode Fuzzy Hash: aa318ee4cda9e84bd54e00c080e3f955a6f2c229a45e556c213643f6f94ce276
Instruction Fuzzy Hash: 5622F774A0421ACFCB95EF65E995B9DBBB2FF48301F1086A9D409AB318EB306D45CF50

Function 029956A8 Relevance: .3, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38696041848d66bcf7adfceddcb2e92af064d2a6b6d2b1959bbda6ca60e1dd4a
Instruction ID: 514e3cb255b70de4de4216f67eb104d7b2195a8a7d631cad47304503d61b0738
Opcode Fuzzy Hash: 38696041848d66bcf7adfceddcb2e92af064d2a6b6d2b1959bbda6ca60e1dd4a
Instruction Fuzzy Hash: E5B1BE707042108FDF169F7AC894B7F7BA6EB88225F568969E506CB395DB35CC01CB90

Function 065923E0 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20629550978f3d577c62a5e75d12826ae35b68eddf4bc3fc50235886a53b2827
Instruction ID: 611e618b42a1d2143dee65794efad8e9b381470dc963d09d417eb83af8a67986
Opcode Fuzzy Hash: 20629550978f3d577c62a5e75d12826ae35b68eddf4bc3fc50235886a53b2827
Instruction Fuzzy Hash: F581BF30B211069FCB48EF39D85496E77B6FF89610B1581AAE419DB3A5EB31DD01CBA0

Function 02995C08 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae8b2a47822eb6b28d95955640a89cd8d76bb43a3a766dc9f09f3fb20444195
Instruction ID: e62448dff82c0d6e5d668dffa4e47e3c6832c3930451cee6c8fc5d34b046c48a
Opcode Fuzzy Hash: 9ae8b2a47822eb6b28d95955640a89cd8d76bb43a3a766dc9f09f3fb20444195
Instruction Fuzzy Hash: 8E819F30A00105DFDF15DFADC488A6AB7BAFF89224B968169D405EB365D731E841CBA0

Function 06599510 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afbe33136d2dd7f5a50c30923827f81f644cc6e3565b49c91bdf4670c445e37
Instruction ID: 1869939d84f55340fb8d21e8b88212dab3de27d0a71f6f95353ab6f5ef358222
Opcode Fuzzy Hash: 7afbe33136d2dd7f5a50c30923827f81f644cc6e3565b49c91bdf4670c445e37
Instruction Fuzzy Hash: AF719131F002199BDF59DFA9C8546AEBBB2BFC9710F144529D406AB380EF319D42CBA5

Function 02997438 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa03f3097dc10d774d7a85b0efd5e729a5ebdc0ee165fcd80d810c015e54601b
Instruction ID: 168e077a74d562ba0d3ade580720b8175217067886fabaaf1f74c526ccc12f94
Opcode Fuzzy Hash: fa03f3097dc10d774d7a85b0efd5e729a5ebdc0ee165fcd80d810c015e54601b
Instruction Fuzzy Hash: 487119747102058FCF54DFADC884AADBBEAAF49625B1940A5E405CB371DF74EC41CBA1

Function 0299CEC7 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7ca6df2e36c071ad52016f2e98c0d1638881cf1ca88960efe1df9a0fcf568b
Instruction ID: 75a8933f331fa12fcbb0bba063e620eba9ae23145e5bd5d171f1815c1be8d57e
Opcode Fuzzy Hash: 1d7ca6df2e36c071ad52016f2e98c0d1638881cf1ca88960efe1df9a0fcf568b
Instruction Fuzzy Hash: 8051AE74861307CFD7463B63F9ADA7EBBA5FB1F327780AD04B01E890199B395859CA10

Function 0299CED8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed960ea9d5b7f91ea944215eff7d7c2cb21c7c9f2167749c922065ce025b7b5e
Instruction ID: 8ee3fa2a926ca3a9ac6849845e3a8fb73f9e29cb0f6b841cc0075bca22b935f4
Opcode Fuzzy Hash: ed960ea9d5b7f91ea944215eff7d7c2cb21c7c9f2167749c922065ce025b7b5e
Instruction Fuzzy Hash: E4518E70861307CFD7423B63F9ADA7EBBA5FB5F327780AD04B01E894199B395859CA10

Function 0299E2D9 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d86ad025676b2e8e3ad22d87433a0ba74c4437cfd4f24df2b31974d8c695d5
Instruction ID: a608380628d80a7d48a30ebb451c27d37b903a2ccf3bdcd01b6cf9ea5e799bd9
Opcode Fuzzy Hash: 96d86ad025676b2e8e3ad22d87433a0ba74c4437cfd4f24df2b31974d8c695d5
Instruction Fuzzy Hash: D6516370D00209DFEB15DFA5D894AADBBB2FF88304F208529E809AB354DB399D46CF40

Function 0299CD10 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f410e9b1ecb5693c82ae8e8866f53c7a17180b5edc5df1acf5522225fead4bfb
Instruction ID: d91b8b354a1655b8004f856013cb371111b93b4c54ffba4d89ca825b184051bc
Opcode Fuzzy Hash: f410e9b1ecb5693c82ae8e8866f53c7a17180b5edc5df1acf5522225fead4bfb
Instruction Fuzzy Hash: 3D518274E01218DFDB44DFA9D99499DBBF2BF89310F20816AE419AB365DB31A901CF50

Function 0659DCC0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9b6079ba1863f24200c949006b0205fa88bb0651ef7f064de5fb7771c1bfac
Instruction ID: af2a3eda1dee2912e82cfc528081ab382cb2f025a4b384b7055b319257d270b0
Opcode Fuzzy Hash: 2e9b6079ba1863f24200c949006b0205fa88bb0651ef7f064de5fb7771c1bfac
Instruction Fuzzy Hash: 3D413A31D41319CFDB05AFA4D45CBEE7BB1FB9A312F908929D10167294CB790A44CFA0

Function 02993908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231d042c1e990126b7bdae1c0bcfb8c204502be2d0f7b70f9529d0fa847e493f
Instruction ID: 4d71a82cf707dec89a135478dc4f887bf661869b62cff57660fcefd72b5a9704
Opcode Fuzzy Hash: 231d042c1e990126b7bdae1c0bcfb8c204502be2d0f7b70f9529d0fa847e493f
Instruction Fuzzy Hash: 48519374E01208CFCF48DFA9D59099DBBB2FF89710B209469E819AB364DB35AC46CF54

Function 06599A49 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d48810301cb751586e1da4214415a22390b19710e803f0bd529b298964a1960
Instruction ID: b13f7d7a7d132be1663f8a0098d537e4433050b48d8ff301331ae434ca34a46c
Opcode Fuzzy Hash: 6d48810301cb751586e1da4214415a22390b19710e803f0bd529b298964a1960
Instruction Fuzzy Hash: B751F379D00209CFDB04DFA5E594AEDBBF2FB49310F24802AD415A7294DB385A46CF60

Function 0299A650 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b0e4e1a49d5b99b955dd8429047ed43fd2c3be4c649cae20d2d16a42615415
Instruction ID: 4336a67b05b39384e114bfcdf85ace8644c2004ab7b84c03f50cbb98656ce169
Opcode Fuzzy Hash: 98b0e4e1a49d5b99b955dd8429047ed43fd2c3be4c649cae20d2d16a42615415
Instruction Fuzzy Hash: 4441E3317002049FDB15AF6AD8556AE7BF7EFC8221F148479E506EB391DE359C06CBA0

Function 02999A63 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744b4639199cef4224b35219925332c360fa4061b9a07d412dfcdf29536ff3f5
Instruction ID: def9a232f2e3682f35c9e53e086b88b47cc4e43c76829b82cbf91af9bd920f68
Opcode Fuzzy Hash: 744b4639199cef4224b35219925332c360fa4061b9a07d412dfcdf29536ff3f5
Instruction Fuzzy Hash: 1E41DF31A04249DFEF11CFA9C844B9DBFB6EF49324F048569E8159B295E335E950CBA0

Function 06599500 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e6b8c0193885f1c44793646c5cfe1daa5590d9507848e32c680b646f1c7e4c
Instruction ID: 2fe4607763a37395113d914bf70436e164af11c0eef0eaa7d558cf73b42be156
Opcode Fuzzy Hash: 16e6b8c0193885f1c44793646c5cfe1daa5590d9507848e32c680b646f1c7e4c
Instruction Fuzzy Hash: 46413031E0031A9BDF54DFA5C880ADEB7F5BF89710F198529E415B7380EB70A945CBA0

Function 0299E134 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2ad0b43e8654ce963af74756e56ae0253951c1104391ee57268b5769c1baf0
Instruction ID: d0c13155a0f843eec28870a047c1790469502fe2c8b3b6def9a6b913f92d9b9c
Opcode Fuzzy Hash: 7b2ad0b43e8654ce963af74756e56ae0253951c1104391ee57268b5769c1baf0
Instruction Fuzzy Hash: 0B414870D09208CBDF14DFACD484AEDBBB2FF49324F20941AD489AB254DB759842CF64

Function 0299D7CE Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb37e7d16050f60d855fad6af77817bf1400b9c5aed745bf6374daa07342f737
Instruction ID: ef3ecc5c84233e7c3bc2debfceac2cbc46ba0e5428816a19b6408a2b67503d64
Opcode Fuzzy Hash: bb37e7d16050f60d855fad6af77817bf1400b9c5aed745bf6374daa07342f737
Instruction Fuzzy Hash: A34112B4D04208CBCF00EFADD4C4AADBBB2FB49325F609519E40AAB245D7369842CF64

Function 02993428 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2577a7ac71d1c206ef1381a274f8c223dbe7be7d9f17c58fcedee5713a455b
Instruction ID: 8aeb273d10d4acea484e0d3c9c3a5bf22237300d694aae8f2b53c0a54e76a60d
Opcode Fuzzy Hash: 8e2577a7ac71d1c206ef1381a274f8c223dbe7be7d9f17c58fcedee5713a455b
Instruction Fuzzy Hash: 8431F531B003158BEF1D9E7E999437E66DAABC9224F19447DD80AC7380DB74CC0086A9

Function 06599A58 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabc0ef7fe2c8f47207b12b2d1ae431793a5fa763bf288ee5e5cfcc968730970
Instruction ID: 7eb015a3c09f66713661902ddf461f7bd85f468068876a3391adc6c5727d1ecd
Opcode Fuzzy Hash: eabc0ef7fe2c8f47207b12b2d1ae431793a5fa763bf288ee5e5cfcc968730970
Instruction Fuzzy Hash: 1441CE74E00208CFDF44DFA9D594AEDBBF2FB89300F24812AD415AB294EB785A46CF50

Function 0299E0D4 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa01cf463f8a6a3b0bf65b50f4ec6be8b4e8dada346993950a730e51ef700a3e
Instruction ID: a7ee2e8535e65496a937d06d3f75b0a8429dd837df02a10462c8578e56a7bed8
Opcode Fuzzy Hash: aa01cf463f8a6a3b0bf65b50f4ec6be8b4e8dada346993950a730e51ef700a3e
Instruction Fuzzy Hash: 53413670D09208CFDF14DFACD584AEDB7B6BF49324F20952AE849AB250D7759841CF64

Function 0299D76E Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b01dca93e6e87bc81cfc98b484e8dc959df8a18c14e61cdc45160989ee140e
Instruction ID: e260896c21dcedbbb29592f189f55ee394db3a0bd6137dcd0f5be6c187e63685
Opcode Fuzzy Hash: 24b01dca93e6e87bc81cfc98b484e8dc959df8a18c14e61cdc45160989ee140e
Instruction Fuzzy Hash: CF41EFB0D05208CFDF00EFADE584AEDBBB2FB49325F209529E409AB255D7759842CF64

Function 0299D620 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0591f1fc10061747ed031a7b39153553c33034d65fa419072538149b768a86d
Instruction ID: 623f5224a98a09f49c60c635666bc46775f22865e520c332c719a277b49204e0
Opcode Fuzzy Hash: d0591f1fc10061747ed031a7b39153553c33034d65fa419072538149b768a86d
Instruction Fuzzy Hash: DC4104B0D00208CFDB04EFAED484AEEFBB2BB89315F14D529D408AB255DB759842CF64

Function 0299DF88 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc30942bf40fd45dd35a09eb822cc512583c8fc292c716f221bc1314475742ab
Instruction ID: 0a928e3d166d742d2f63d55b04089890db31f8104de34213558ce1bc7857c549
Opcode Fuzzy Hash: fc30942bf40fd45dd35a09eb822cc512583c8fc292c716f221bc1314475742ab
Instruction Fuzzy Hash: 8D313770D052088BDF18EFAED484AEEB7B6BF89314F14D52AD804AB254DB719842CF64

Function 02994DC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 395840b63d59a91769780789bc7be5b8ec4be1db362ce462e1fdd6ee3cb1521b
Instruction ID: 477c8a14f7be3b7f42a0fa88f55b636c8db55fbb8e0b96481af29122fc2eff89
Opcode Fuzzy Hash: 395840b63d59a91769780789bc7be5b8ec4be1db362ce462e1fdd6ee3cb1521b
Instruction Fuzzy Hash: FF31B5716041099FDF069FAAD454ABF7BABFF88325F004468F9058B254CB35DC22CBA0

Function 0659DCB1 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 023ccd3874819bdf413201a71ce2673d7ab5d982bc96cf08efa54fc17f6b08b5
Instruction ID: f0798331921a75fb8b598dad1fad7e18b40227f90e480d39c43845014cfd6a7a
Opcode Fuzzy Hash: 023ccd3874819bdf413201a71ce2673d7ab5d982bc96cf08efa54fc17f6b08b5
Instruction Fuzzy Hash: EB316930D41309DFDB05AFA5D468BEEBBB1FF4A312F408969D1116A391CBB80A44CFA0

Function 029976D0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ab4e617c94762cc5d389e8e1e395f0d8d8841b05b8847dd9c44cc8ff4756fe
Instruction ID: 6f625314c9687e82d2ef0d023fa359e8184290d207a172802a2a1c46e3b54f4b
Opcode Fuzzy Hash: e9ab4e617c94762cc5d389e8e1e395f0d8d8841b05b8847dd9c44cc8ff4756fe
Instruction Fuzzy Hash: EC21F5743242009BEF25567E8894BFDB79B9FC4629B184079D502CBB55EF2BCC42D781

Function 0299A809 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1e1fd8aa0ca627c13d38b0ee334d0d7286be7b358803d703d7af6e880d17e8
Instruction ID: e7d54e4e94b3fbb786f675551a37e63c681287a6732564e1c08b994c57019c6f
Opcode Fuzzy Hash: 3b1e1fd8aa0ca627c13d38b0ee334d0d7286be7b358803d703d7af6e880d17e8
Instruction Fuzzy Hash: D2318070A005198FCF08DF6DC8889AEBBB7FF88764B158169E5159B3A5CB35DC42CB90

Function 029976E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810e9fb833979ebdda27493614c28adf974dc3bcdf9953f10fbddd1e4fec4eac
Instruction ID: e3b34c729557c563a34515a9f8a0cf76bdefa650f6f0382a16a266deff8e7a31
Opcode Fuzzy Hash: 810e9fb833979ebdda27493614c28adf974dc3bcdf9953f10fbddd1e4fec4eac
Instruction Fuzzy Hash: C221B3783242005BEF14566E8894BBEB68B9FC4729F144079D502CB798EF2BCC41D381

Function 02995A60 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3991416f9faf88e917bffa7475b70786184c07a03d43b86ed8ad41502a63dfe9
Instruction ID: 82ff1485a96526f213590e637233dbfec37e3feb66947c94a42866df0dea884b
Opcode Fuzzy Hash: 3991416f9faf88e917bffa7475b70786184c07a03d43b86ed8ad41502a63dfe9
Instruction Fuzzy Hash: 592103313026118FDB16AA2AD4A453BB7A7EFC4621B4681BDE806DB354CF34DC06C7C0

Function 02992060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f6bcf82bc5855a5db6966324bef22e8e411387955fde4b1885460c97c41ef0
Instruction ID: c95b8b42b0eafb23144aca9b543322c615b739cd808dd057e0b51905c3a26b5c
Opcode Fuzzy Hash: 13f6bcf82bc5855a5db6966324bef22e8e411387955fde4b1885460c97c41ef0
Instruction Fuzzy Hash: 0121A475E00215EFCF14EF28C840AAE77A9EB99260F10C419DC09DB344EB36EA41CBD1

Function 027BD007 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4542782571.00000000027BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_27bd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958f752eb63d4492e7a82da955e24f1e8c0cb31349ebf8f8d5a8b838423972b7
Instruction ID: e997b2f3fd6a7b44b7c0fba274c436de38bc10c6a29892c00e6f01cb13dc35b2
Opcode Fuzzy Hash: 958f752eb63d4492e7a82da955e24f1e8c0cb31349ebf8f8d5a8b838423972b7
Instruction Fuzzy Hash: 34312F7550E3C48FCB13CB20C9A4755BF71AF47214F1985DBD8898F2A7C23A984ACB62

Function 027BD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4542782571.00000000027BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_27bd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d6de567af25977787e698a218ec09b27110cd93d9550c675ebf3830a2b9180
Instruction ID: d6626465aef268ad0dd807135eff27a5c75fdb49311a18083fd97ee7615f4743
Opcode Fuzzy Hash: b6d6de567af25977787e698a218ec09b27110cd93d9550c675ebf3830a2b9180
Instruction Fuzzy Hash: B0212671504208EFDB26DF24D9C0B66BB65FF88314F24C5ADE94A4B242C77AD447CB61

Function 0299215C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8125f454a9846b939fdadc492c1ce27ba2cc01d7526abca28e31d808b5e8527f
Instruction ID: 0f082364be0a532834701684dde33cf76b1415183145914a72be5a8fa347d96c
Opcode Fuzzy Hash: 8125f454a9846b939fdadc492c1ce27ba2cc01d7526abca28e31d808b5e8527f
Instruction Fuzzy Hash: 55115932E0425D9FCF01EBF89C104DEBB74FF89220B258756D525B7151EA321906C7A0

Function 02991F08 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ab32d2dd3c3f0ab4d6ac9612faf9a7c5e10cfd51e2b63c0298bc36d1372f70
Instruction ID: d7c4a1928d777585ad24a2a0a5fb46554bc3eac60f7ec21df4114fea2f706ce6
Opcode Fuzzy Hash: 86ab32d2dd3c3f0ab4d6ac9612faf9a7c5e10cfd51e2b63c0298bc36d1372f70
Instruction Fuzzy Hash: F8214674C0420A8FCB11EFA9C8545EEBFF4FF49325F14456AD405A7218EB311A45CBA1

Function 02994DB9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fd1ee848b9b3308044154a52aed480a7a750c822bb35e93deb492190ab0fcc
Instruction ID: ce78087bcfe269256f0af3ae5ecf88498f6707715e3fd693c074b4cf56a5e02c
Opcode Fuzzy Hash: 50fd1ee848b9b3308044154a52aed480a7a750c822bb35e93deb492190ab0fcc
Instruction Fuzzy Hash: FB2102716081059FEF169FA9E454B7B7BABEF88325F005069F8098B254CB38DC56CBE1

Function 0299D60F Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e04b8a71f053cca6af246105f4874920f94688f25a43d833934caa1690363e
Instruction ID: 612ea8c702b23cd9838453b0d85e68f979d94f2208a43e19c996761b82ea5b53
Opcode Fuzzy Hash: e4e04b8a71f053cca6af246105f4874920f94688f25a43d833934caa1690363e
Instruction Fuzzy Hash: 76113AB1D002098FDF08EFAE98846EEB7F6ABC9311F04D035D418B7259D73049078A64

Function 065996F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec6415c2a785a05518239bb873967cbbd15d734139d33a5d5daec9a3cd3d38c
Instruction ID: dcde18112c99230e0b2693d5f156b87367949262c7590da8f0cbeb77cc4953f7
Opcode Fuzzy Hash: eec6415c2a785a05518239bb873967cbbd15d734139d33a5d5daec9a3cd3d38c
Instruction Fuzzy Hash: 32115C367042545FCF4B5FB858282AF3BE3EFC8260B54442AD909DB3C1DE354D1287A5

Function 0299E1F8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810173e2e6a0571c31badb666bb710b87c213ccf501cf8d0e793172035b3e463
Instruction ID: ef68f4453f5a264766fba3ad9c4f0f9de70704b42649af2d3c02bb7dd620d42d
Opcode Fuzzy Hash: 810173e2e6a0571c31badb666bb710b87c213ccf501cf8d0e793172035b3e463
Instruction Fuzzy Hash: F5214D70D0420ADFEB46EFB8D591B9EBBF2FB85304F0485AAD0549B355EB705A06CB81

Function 0659E0C0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951897b8c1c8cb50aeae51df68664217aad48914cd701a2bd477c265a929cd49
Instruction ID: e204ec080a506acc3c7e749860b444983146605a6325df6438882a311f84be89
Opcode Fuzzy Hash: 951897b8c1c8cb50aeae51df68664217aad48914cd701a2bd477c265a929cd49
Instruction Fuzzy Hash: BF1104303052409FE7051B7B98285BBBBABFFCA311B188477F546C7286DD288C0693B0

Function 02995A70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74985f73bebb19a63393ef518b0f9a4fc296a32bdb0fc35a85b0ffb6c3085543
Instruction ID: 6a0820b626220fe1b5bfad731b1dc13e2ac80f93aaa531a11b0c53fcc7115eeb
Opcode Fuzzy Hash: 74985f73bebb19a63393ef518b0f9a4fc296a32bdb0fc35a85b0ffb6c3085543
Instruction Fuzzy Hash: 1411C2313025128BCB165A2AC4A893FB7AAFFC466174A41BDE806CB350DF35DC0287D0

Function 02991F61 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86384c69432fe00dd7acd79f31b409451130a664571589433430d2fb7527334b
Instruction ID: 9b439884b64e7c90e67e6857276917a8ed85c7e042221d272e04777a2b871adb
Opcode Fuzzy Hash: 86384c69432fe00dd7acd79f31b409451130a664571589433430d2fb7527334b
Instruction Fuzzy Hash: E621EDB4C0420A8FCB00EFAAD8455EEBFF0FB0A311F10556AD809B7215EB345A85CBA1

Function 06592670 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a585fc0f70bca053ceb37efc39374907b6fab009a5bd4c1259e7b5b16103f7a
Instruction ID: 2992dc615fe5af9afec92ed0db95c4f3262486124c134b583b1f11b9bbba0365
Opcode Fuzzy Hash: 9a585fc0f70bca053ceb37efc39374907b6fab009a5bd4c1259e7b5b16103f7a
Instruction Fuzzy Hash: C011A175A102119FC790AF79E80899E7BF4FF89611B040569F409DB316EB35CD05CBE1

Function 06599350 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b84d320696f4a13300f9e59183d4b42a42a34a6bb92f83e49a30d7064c8ff7c
Instruction ID: 81d1e02dfa99fd5de36c902368c6bc4e9a92af34efc75ce1126078057b6c19a2
Opcode Fuzzy Hash: 5b84d320696f4a13300f9e59183d4b42a42a34a6bb92f83e49a30d7064c8ff7c
Instruction Fuzzy Hash: 551153B2800249DFDF10DF99C844BEEBBF4FB48320F14841AEA18A7250C339A954CFA5

Function 06599999 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c709af270932f88500c4aaa601e65d90e97aeea829661080591def95e701767
Instruction ID: 7fdb1a7a445c440a0564ea8d4272fc86a72b3904a1dcb23a51eac500450f41bb
Opcode Fuzzy Hash: 7c709af270932f88500c4aaa601e65d90e97aeea829661080591def95e701767
Instruction Fuzzy Hash: 831126B6800249DFDF10DF99D945BEEBBF4EF48320F14841AE624A7250D339A554CFA0

Function 0299E208 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf4946d1ea12c7daa968227e3e10456b00d3038cf34d890c728596342cddc0b
Instruction ID: 79e93a27d484c0691aaa6fe44888733de553b17d18e4db5056829973b57326c9
Opcode Fuzzy Hash: cbf4946d1ea12c7daa968227e3e10456b00d3038cf34d890c728596342cddc0b
Instruction Fuzzy Hash: E8114C70D0020ADFEB45EFB8D591B9EBBF2FB85304F00C5AAD0549B354EB705A068B80

Function 06598EC1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0154b9cb17cde9c56ed8ebdfef971a44ed25752216d370030d1a71a644c632e
Instruction ID: c2dad79ae094ea95e221ffa039380be3acf80ee6490b0ecf951a821f3f115863
Opcode Fuzzy Hash: f0154b9cb17cde9c56ed8ebdfef971a44ed25752216d370030d1a71a644c632e
Instruction Fuzzy Hash: B211FE74E401498FEF14DBF8D850BAEBBB6BB49315F009455E908AB345E63199428B60

Function 02995607 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d388bd463534e80b457a51fb7274473ead45a0ec459dcdeca80853353564b0e0
Instruction ID: a3ed26bfe0aaf5ed94cf816a6f580ad9886ba7fcc10ebb39e95a03c216fb823c
Opcode Fuzzy Hash: d388bd463534e80b457a51fb7274473ead45a0ec459dcdeca80853353564b0e0
Instruction Fuzzy Hash: 78012872B040146FDF039E6A9814AFF3FA7DBC8761B19806EF505D7284DA71CC028BA0

Function 0299D449 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c865d22358160f7341c62fd67defa542fb710bc2825a5ed2a4dc7cc11e219e
Instruction ID: c1bf5e08e9ad6b8f2fca14e865f256ae7aa47e0fbc7972c9c408ac9c00c85954
Opcode Fuzzy Hash: 46c865d22358160f7341c62fd67defa542fb710bc2825a5ed2a4dc7cc11e219e
Instruction Fuzzy Hash: 57E0E530D941058FEF09B96CA8466F9B3799787310F84B834C209F3581DB3091178A90

Function 0299DF08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf2018b8b52fd04f4bb56731fe6672be11e34124ce68ab230572d2c3b6b26e1
Instruction ID: 58473dac530c9414c403162097814411df4e3471c33ec7cf6d0ce77c6f234384
Opcode Fuzzy Hash: 5bf2018b8b52fd04f4bb56731fe6672be11e34124ce68ab230572d2c3b6b26e1
Instruction Fuzzy Hash: 06E0ED30D241099FDB05BE6CA8567FAB374EB86301F80A835D101B3192EB70D52B89A0

Function 065925E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eed1e03eb91a49435a7b381e17af917f5b11d28964aaa7625924de03a7fb579
Instruction ID: ef26afc4137147a492e19a5032e01d37b320d18a64e2e3ccc00c439465c646af
Opcode Fuzzy Hash: 4eed1e03eb91a49435a7b381e17af917f5b11d28964aaa7625924de03a7fb579
Instruction Fuzzy Hash: EA01E470E00219DFCF44EFB9C8006AEBBF5BF48200F50856AD419E7250EB349A01CBA0

Function 06599760 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e2c5865cb9721b311881628c1c38664dc565fd71de0f5da33d6fac5f4df96ac
Instruction ID: 4e242b9bba35ed2c8cfbe9c105d3bd16e9978cdb6ada764de1f76c972faf7c8c
Opcode Fuzzy Hash: 2e2c5865cb9721b311881628c1c38664dc565fd71de0f5da33d6fac5f4df96ac
Instruction Fuzzy Hash: F2F0B4367001186B8F055E9898509AF7BABFBC8220B044429FA0987250CE325C1197A5

Function 0299DEB0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888cc7b88a649b97b2abd2abb3355d5aaaefc109ec447257e94474cece34b6c7
Instruction ID: 5c9feec4ab6ba740b14ee6ec3e908041250a50058f0ed8f93144566007e251a2
Opcode Fuzzy Hash: 888cc7b88a649b97b2abd2abb3355d5aaaefc109ec447257e94474cece34b6c7
Instruction Fuzzy Hash: 46F03A70A11125CFCB84EFBCC48465E77F4AF0822072144E9D509DB321EB31D9008BD0

Function 02992010 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50bc0ea34030056b024b3c7687609ac9fd7bd6a9534e19534bee873613e06b78
Instruction ID: cdb55d03e79a50a99387ffa9dbf0bdf75fe8febb444186a91c958bb391d9f701
Opcode Fuzzy Hash: 50bc0ea34030056b024b3c7687609ac9fd7bd6a9534e19534bee873613e06b78
Instruction Fuzzy Hash: D2E0D835D242975BCB01A7B19C440DDBB75ED972A0B414566D02077141FB79164BC391

Function 0299D4B4 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c3dcc291105c9f8ef6a6cd3b2913c89058baa3b840117bb6e9a77345d628c9
Instruction ID: 285bb5547e669ced54cbc3577f91667131c9c9d18d34f4019704d6453bb2e0d8
Opcode Fuzzy Hash: 87c3dcc291105c9f8ef6a6cd3b2913c89058baa3b840117bb6e9a77345d628c9
Instruction Fuzzy Hash: 25E068E3C08140CBEB106FAA54A2078BB34CED322474864C7C08CD7164D224D112C721

Function 02992020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc33b1f63e250f3f22ed60c98e73c4a59f3ba0ff5cdb5f628e7c5aee39f4d27a
Instruction ID: cadcff72579d7f552519d570ba00b008b5b76ef7f05123bd900fe4f392f2191d
Opcode Fuzzy Hash: fc33b1f63e250f3f22ed60c98e73c4a59f3ba0ff5cdb5f628e7c5aee39f4d27a
Instruction Fuzzy Hash: CED05E32E2022B97CB00EBA5EC048EFF738EED6661B908626D52537140FB713659C7E1

Function 02998258 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: e8d3ced4851fe4f878e09899cfbcba468d331c0dcd1669c577e3f4a192917dfc
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: B6C08C3320C1282AAA34108F7C41EB7BB8CE3C23F4A25013BF91CE3200A842AC8041F8

Function 0299A70D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58af214171ae02d9a2e6a0b2e7d4c14bdc7c56f4b8f579af4b3f4d0b546062f9
Instruction ID: 05f7cd328fb2f934ccb7c7ae823ccefd7c527d56a5a32a42090db6f960cf8eb8
Opcode Fuzzy Hash: 58af214171ae02d9a2e6a0b2e7d4c14bdc7c56f4b8f579af4b3f4d0b546062f9
Instruction Fuzzy Hash: 94D0677AB01008DFCF049F99E8409DDB7B6FB9C222B048126F915A7264C6319925DB60

Function 02995EA8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c7b339051307f05b2e9b5f021a35314fb656fe42d465d37577d6855278a9c6
Instruction ID: 4fd1beeab1eb5ef625b7cf757fdfff4a8f3df0e80173ab469d404adc67bdb38e
Opcode Fuzzy Hash: d6c7b339051307f05b2e9b5f021a35314fb656fe42d465d37577d6855278a9c6
Instruction Fuzzy Hash: 0BD012705083878BD706F771E5655583B22ABC1304B8482A9A9444D11AE97908468791

Function 02995EB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9cfebdab62c591a60107fe98a05d1a04072c9a17730fd16f42ac10286948e0
Instruction ID: e6904a90960378ccfd05f08c3d9beb32c3efb15dfd75c51c75e412d7cb107784
Opcode Fuzzy Hash: 1e9cfebdab62c591a60107fe98a05d1a04072c9a17730fd16f42ac10286948e0
Instruction Fuzzy Hash: 9FC0123010430B87D905FBB6FA59619772AEBC0300F449764B5090D119EE7828444B90

Non-executed Functions

Function 0299E528 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4543015571.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9008b6cf1176fcd8fee62ff62641ee6cc1504f14880d302cbe3b6b956d9d0b55
Instruction ID: 0d18f414ec463b759c408076100e6ccd159e2e761ceeb5bd789e056d0ffaa978
Opcode Fuzzy Hash: 9008b6cf1176fcd8fee62ff62641ee6cc1504f14880d302cbe3b6b956d9d0b55
Instruction Fuzzy Hash: 7B52AC74E01229CFDB64DF69C884B9DBBB2BF89310F1085EAD449AB254DB359E81CF50

Function 055FB940 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbd799b0f91affad256ddc575e3bb63a35649cb753c49abd26d3724d086b25b
Instruction ID: ab48af280513c97c86a693e6532fe355e909969bc1cebd7c3decaf8608e0089e
Opcode Fuzzy Hash: acbd799b0f91affad256ddc575e3bb63a35649cb753c49abd26d3724d086b25b
Instruction Fuzzy Hash: B3C1AF74E00218CFDB14DFA5D994BADBBB2FF88304F2481A9D909AB355DB359A81CF50

Function 055FED60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86151dff4ddd25c5312fbf4b76407299cb03fbf6f5bb430667d4c23f1a299313
Instruction ID: e4a534cd6b1171e9546d8620a3ac4dd067d6eff5c205ec6d2858332ebf88e80a
Opcode Fuzzy Hash: 86151dff4ddd25c5312fbf4b76407299cb03fbf6f5bb430667d4c23f1a299313
Instruction Fuzzy Hash: 69C1CE74E00218CFDB54DFA5C994BADBBB2BF88304F2081A9D509AB365DB359A81CF50

Function 055F0D60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be7aec6424c7da7b40e584084e7f25cce70214b128d0be02ecbbeb994665474
Instruction ID: 26fb0c87181edbd4dd6fecf686b4bc7d9b3649033ee2d44cecd8bbc51aac2051
Opcode Fuzzy Hash: 7be7aec6424c7da7b40e584084e7f25cce70214b128d0be02ecbbeb994665474
Instruction Fuzzy Hash: C4C19174E00218CFDB15DFA5D954BADBBB2FB89300F2481A9D809AB355DB359E81CF50

Function 055FE908 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33661a87f6f27c2a43fef58fe9bec21cfebfa311fc1ce827b4308aa5fa79f6d
Instruction ID: c6820164ad761e0474eb317c246cd75be2a05fc81cb46d09909fcd399a993469
Opcode Fuzzy Hash: a33661a87f6f27c2a43fef58fe9bec21cfebfa311fc1ce827b4308aa5fa79f6d
Instruction Fuzzy Hash: 2AC1BF74E00218CFDB54DFA5C994BADBBB2BF88304F2081A9D509AB365DB359E81CF50

Function 055F0900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccef93ea598c586be8eee206be94ea46f9aec88b4aacd516dd04b420bc95c8ea
Instruction ID: 8c709a93e8e8e29cad3047de0ad8622f4a605d5095b841191f6a528f84d428d6
Opcode Fuzzy Hash: ccef93ea598c586be8eee206be94ea46f9aec88b4aacd516dd04b420bc95c8ea
Instruction Fuzzy Hash: 8FC1B174E00218CFDB15DFA5D994B9DBBB2FB88304F2481A9D809AB355DB359D81CF50

Function 055F11C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f27c62cbb6339110ff6da8fc525a3fdc607308cf53f979371f7be9a96935af4
Instruction ID: ba3eb30a3b9edcd594a309a907f74c30be84b76b552fd94cc417566ecac3468c
Opcode Fuzzy Hash: 6f27c62cbb6339110ff6da8fc525a3fdc607308cf53f979371f7be9a96935af4
Instruction Fuzzy Hash: 32C19174E00218CFDB55DFA5D994B9DBBB2FB89300F2081A9D809AB355DB359E81CF50

Function 055FC1F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fecaeda5a199577e26f1c1dd2ed5d02fce2356aaf7dfe98aa8d45b07dbdd0ea
Instruction ID: 30f1f2ff34a0547da5951082c16f010a2e308c5f4744f82e8a7d6130ca24f09a
Opcode Fuzzy Hash: 0fecaeda5a199577e26f1c1dd2ed5d02fce2356aaf7dfe98aa8d45b07dbdd0ea
Instruction Fuzzy Hash: B0C1AE74E00218CFDB15DFA9C994BADBBB2BF88304F2081A9D509AB355DB359E81CF50

Function 055FBD98 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567a37e21aaeabee6da7ef6b8f9cbdb54e6c4f82a8f423c53873d39f2a43fe6c
Instruction ID: 72fc766c330de05d9b89f6f1eceeca896655d70a99847db2946e90038f050939
Opcode Fuzzy Hash: 567a37e21aaeabee6da7ef6b8f9cbdb54e6c4f82a8f423c53873d39f2a43fe6c
Instruction Fuzzy Hash: 59C1AE74E00218CFEB55DFA5C994BADBBB2BF88304F2081A9D509AB355DB359E81CF50

Function 055FF1B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c788e2967257ca24ce20662a377e775defeab6b719d336a337b2026df5dee64
Instruction ID: 4d6e565f4f3d84daa64dc9a6116c9f209bb6ebc0dbc3f5a4cfa59e252701c622
Opcode Fuzzy Hash: 2c788e2967257ca24ce20662a377e775defeab6b719d336a337b2026df5dee64
Instruction Fuzzy Hash: 98C1AE74E00218CFDB15DFA5C994BADBBB2BF88304F2081A9D909AB355DB359E81CF50

Function 055FE058 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33123632a1ef7f99f3d26072db2e80eaa9ceae6d87af50a368dcfd5bb5fdf3c2
Instruction ID: 95a32814394eceab68de38e65682e9cb58e8e04d79839e3de31fac5caf0294c9
Opcode Fuzzy Hash: 33123632a1ef7f99f3d26072db2e80eaa9ceae6d87af50a368dcfd5bb5fdf3c2
Instruction Fuzzy Hash: A3C1BF74E00218CFDB54DFA5C994BADBBB2BF88304F2081A9D509AB365DB359E81CF50

Function 055F0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d998b85834ee80e028c14c38b7113b7d1c1c9f9c6c6ae85a70be84e8e964a0d8
Instruction ID: a54a916f8144f0521bec32d10ce2013c153b530962ad92d5965a6571a107849b
Opcode Fuzzy Hash: d998b85834ee80e028c14c38b7113b7d1c1c9f9c6c6ae85a70be84e8e964a0d8
Instruction Fuzzy Hash: 67C1A174E00218CFDB15DFA5D994BADBBB2FB89300F2481A9D809AB355DB359D81CF50

Function 055FDC00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4d5404ed76268c3f6191342334b935f9887ee3437f4f5a9d418dba0164d92f
Instruction ID: 016f0a6fa14b400618e8289297d21ab71b83e1c7070adea37a204b1888226cd4
Opcode Fuzzy Hash: bb4d5404ed76268c3f6191342334b935f9887ee3437f4f5a9d418dba0164d92f
Instruction Fuzzy Hash: 89C1BE74E00218CFEB15DFA5C994BADBBB2BF88304F2481A9D509AB355DB359E81CF50

Function 055FB4E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679017621a63028a03032c2eaff36074848b83c57fb516ce0cf2327b68768a07
Instruction ID: e9e2234b8d9c89e89bd2597fb51409353e17461dc1ca13bd071aef05a73b8b53
Opcode Fuzzy Hash: 679017621a63028a03032c2eaff36074848b83c57fb516ce0cf2327b68768a07
Instruction Fuzzy Hash: 50C1AF74E00218CFDB14DFA5D994BADBBB2FF88304F2081A9D509AB355DB359A81CF50

Function 055FE4B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399b9c5238e61bd5ed359aa3ec4c67fe7efd49d1be8cadb21a53f535b645e4f8
Instruction ID: a6c45731445abe89bc334aa50053be047abf10ddcd03309ca5f43bce01ecb663
Opcode Fuzzy Hash: 399b9c5238e61bd5ed359aa3ec4c67fe7efd49d1be8cadb21a53f535b645e4f8
Instruction Fuzzy Hash: AEC1B074E00218CFDB54DFA5D994BADBBB2BF88304F2081A9D509AB365DB359E81CF50

Function 055F04A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba647a040a94366cd763f4c76349171f13d543b08cd7bad9ffa3325bc0049d16
Instruction ID: de0b4e0dd40e062f056a29d0d10e583c7a9c8eb9b468f6aa3685aa41ef53b6d5
Opcode Fuzzy Hash: ba647a040a94366cd763f4c76349171f13d543b08cd7bad9ffa3325bc0049d16
Instruction Fuzzy Hash: 54C1A174E00218CFDB15DFA5D954B9DBBB2FB89300F2481A9D809AB355DB359E81CF50

Function 055FD350 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474331dd3d76393694f879e0d26858e48669974d2f20b0e828216b107e6d82b2
Instruction ID: b6b2e0cbef7f6a1fa47aeb97426a75d76fc97f58e76d39ba12a0ef6a368e1e72
Opcode Fuzzy Hash: 474331dd3d76393694f879e0d26858e48669974d2f20b0e828216b107e6d82b2
Instruction Fuzzy Hash: 1EC1BF74E00218CFDB55DFA5C994BADBBB2BF88304F2081A9D909AB355DB359E81CF50

Function 055FD7A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da6608abfc5aee049011c35cb376f2b8d3b99aac077237c26df771b80722e2a
Instruction ID: 2c06954da6c120c86fd3787e610f5b40b9d234788aefa027f3ff57f029448b52
Opcode Fuzzy Hash: 8da6608abfc5aee049011c35cb376f2b8d3b99aac077237c26df771b80722e2a
Instruction Fuzzy Hash: 6BC1B074E00218CFDB15DFA5C994BADBBB2BF88304F2481A9D509AB355DB359E81CF50

Function 055FC648 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84379ede342dab66aef04b21b01fdbe9fffc024a7a9970ca2b3a07b6e17eefa7
Instruction ID: 2150234b8c9c21f117d23fd0385ddc6e1631c39d2413b2f712e4820d18c5b974
Opcode Fuzzy Hash: 84379ede342dab66aef04b21b01fdbe9fffc024a7a9970ca2b3a07b6e17eefa7
Instruction Fuzzy Hash: 9CC1BF74E00218CFDB54DFA9D994BADBBB2BF88304F2081A9D509AB355DB359E81CF50

Function 055FFA68 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c04624a4039bf47c1e7cb734041c522fdd24e37818e4d7f669b57260ac1d87
Instruction ID: 6866ada29d5a4bace66b5d26ef8382364c05cfc3bf11698a23b0894a2c0d54b8
Opcode Fuzzy Hash: c4c04624a4039bf47c1e7cb734041c522fdd24e37818e4d7f669b57260ac1d87
Instruction Fuzzy Hash: 36C1BF74E00218CFDB54DFA5C994BADBBB2BF88304F2081A9D909AB355DB359E81CF50

Function 055FF610 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d4add79afafdb328da46a52c3bf8a6463190b405fcda4ec17bc00b27028fe9
Instruction ID: 5cb65826e0d2b7ce281cb0ee71839f32d19dadf079c506032fd0adf47e452c3b
Opcode Fuzzy Hash: a8d4add79afafdb328da46a52c3bf8a6463190b405fcda4ec17bc00b27028fe9
Instruction Fuzzy Hash: 95C1BF74E00218CFEB14DFA5D994BADBBB2BF88304F2481A9D509AB355DB359E81CF50

Function 055FCEF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0a5d518322d29ae03e8c4663cc17ef37ac79036464d9af48a24ab305620e54
Instruction ID: 0e5d76a414cdeaf6f2d54a101f91658d344569226444b2a42ef44d5fb5bf7db1
Opcode Fuzzy Hash: 0d0a5d518322d29ae03e8c4663cc17ef37ac79036464d9af48a24ab305620e54
Instruction Fuzzy Hash: 37C1BF74E00218CFEB14DFA5C994BADBBB2BF89304F2081A9D509AB355DB359E81CF50

Function 055FCAA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f767be760b5046eb84efd7d3e637464214899d68d230d7341aeb028173cd6aa
Instruction ID: ed3a940e791e14826a932e0a5a567a51c67b08d8c789411a53053d256a024383
Opcode Fuzzy Hash: 8f767be760b5046eb84efd7d3e637464214899d68d230d7341aeb028173cd6aa
Instruction Fuzzy Hash: ADC1CF74E00218CFEB15DFA5C994BADBBB2BF88304F2481A9D509AB355DB359E81CF50

Function 06595A70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dad412a6c6f7f480f1164ea6159bb3aafa6e9f0a7d05da6fc1470fb0ff2baa2
Instruction ID: 80659ef51f3ddb0ced28b88e1d8a26de98d791385f028059d47a8687755edbdf
Opcode Fuzzy Hash: 2dad412a6c6f7f480f1164ea6159bb3aafa6e9f0a7d05da6fc1470fb0ff2baa2
Instruction Fuzzy Hash: 7CC1BF74E00218CFEB55DFA5C994BADBBB2BF88304F2481A9D409AB355EB355E81CF50

Function 06595618 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd5ec249a8b05aec0924fca60ba2554befead0e953130328a710013571be003
Instruction ID: adfc44a305fbdd945e9a03a276e3a4d5ba76383c3b7881c0dfbb3da228e52358
Opcode Fuzzy Hash: 9fd5ec249a8b05aec0924fca60ba2554befead0e953130328a710013571be003
Instruction Fuzzy Hash: 39C1BF74E00218CFEB55DFA5C994BADBBB2FF88304F2081A9D409AB355EB355A81CF50

Function 06595EC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed8bb916ae46e9374f68ec9f25c25734c83c4b3c15126d165d74f36e16c8863
Instruction ID: 1d727fea0c2a56be06bff0a90b2445107d52564aed3a958d875fa178f92effa7
Opcode Fuzzy Hash: 5ed8bb916ae46e9374f68ec9f25c25734c83c4b3c15126d165d74f36e16c8863
Instruction Fuzzy Hash: 44C1BF74E00218CFEB54DFA5C994BADBBB2FF89304F2081A9D409AB355DB355A85CF50

Function 06596778 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc17865abd7be70aeeb3acde98205ae18191b967df3009634e9fc1cefdaafab7
Instruction ID: b9320667a0aa7c97fb559db9e0628368e0ce4583fd3dc9483b98269da548b116
Opcode Fuzzy Hash: fc17865abd7be70aeeb3acde98205ae18191b967df3009634e9fc1cefdaafab7
Instruction Fuzzy Hash: 30C1AF74E00218CFEB54DFA5C994BADBBB2BF88304F2081A9D419AB355DB359E85CF50

Function 06596320 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8138f4379d4b5692c609f8b72ad9ccdb74003783d942ba116b681d1bfe123c
Instruction ID: 8539618a043345a3f08ddb180bc65d3e891583484fb1fba85e946cba7926f530
Opcode Fuzzy Hash: 5d8138f4379d4b5692c609f8b72ad9ccdb74003783d942ba116b681d1bfe123c
Instruction Fuzzy Hash: 7AC1AE74E00218CFEB54DFA5D994BADBBB2BF88304F2081A9D409AB355DB359A85CF50

Function 06596BD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d053068d9511d536dcea4223e9a27b14a259485e1fd6f87898729c7585af46
Instruction ID: b0ab21457f1d32ae7b43181002a342e49bd8eabace79fa8ca682184d79aeedfd
Opcode Fuzzy Hash: c4d053068d9511d536dcea4223e9a27b14a259485e1fd6f87898729c7585af46
Instruction Fuzzy Hash: BAC1BE74E00218CFEB54DFA5C994BADBBB2FF88304F2081A9D409AB355DB359A85CF50

Function 06597050 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9a30128f2310f7c64e1e63b771621eba445e7ce2159ba2186092028a1b9901
Instruction ID: f2d22964dcfd24b24f882057f632a3b5ace7609de30400860093e2a953635363
Opcode Fuzzy Hash: ab9a30128f2310f7c64e1e63b771621eba445e7ce2159ba2186092028a1b9901
Instruction Fuzzy Hash: 6AC1AF74E00218CFEB54DFA5D994B9DBBB2BF88304F2481AAD409AB355DB355A81CF50

Function 06590040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfe0e02b04528066dcb6cbbdb663fa34f66f1a70eeaa63977e7c6a6ef04c39b
Instruction ID: 66e6029cb8d841739cea1cb8409c690cf2402e4c161a3c4ebf9b048e47704a95
Opcode Fuzzy Hash: bdfe0e02b04528066dcb6cbbdb663fa34f66f1a70eeaa63977e7c6a6ef04c39b
Instruction Fuzzy Hash: 58C1A074E00218CFEB54DFA5D994B9DBBB2FF88304F2481A9D409AB355DB359A81CF50

Function 065908F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df48996f6f7c322b6ad1da967e3f0adc5e4791a1f42af693e9305e545884dfb8
Instruction ID: a4045dbf4ffe77900e13fd5d3120e5fcdab025340be9e1114e75581e46745fae
Opcode Fuzzy Hash: df48996f6f7c322b6ad1da967e3f0adc5e4791a1f42af693e9305e545884dfb8
Instruction Fuzzy Hash: E7C1AF74E00218CFEB54DFA9C994BADBBB2BF88304F2081A9D419AB355DB355E81CF50

Function 06590498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c119bb15c375a2d36af6883bce715a36b62c493ea48de105f240a83d2bcd8b0b
Instruction ID: 8fd9d806071d6eca088703bd2083503fe3c40d4b1e39e5f83166d426ad01cc64
Opcode Fuzzy Hash: c119bb15c375a2d36af6883bce715a36b62c493ea48de105f240a83d2bcd8b0b
Instruction Fuzzy Hash: 34C1AF74E00218CFEB55DFA5C994BADBBB2BF88304F2081A9D419AB355DB359E81CF50

Function 065974A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1131c53af42f35813f1b66d6a11fb393b9a30e4557d1cc492940a988dfca7163
Instruction ID: 43333b6c87105ed1df047bce4cd0fa2a4737cc804b3f4d5fe54dc68611755fb5
Opcode Fuzzy Hash: 1131c53af42f35813f1b66d6a11fb393b9a30e4557d1cc492940a988dfca7163
Instruction Fuzzy Hash: D6C19F74E00218CFEB54DFA5C994BADBBB2BF88304F2481A9D419AB355DB359A81CF50

Function 06597D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320b3f6e429cf0cbe73faf20c7e107a408ce982d78f658c26bbf49eddf117046
Instruction ID: 1ee27d056afe1af2050d2cb2adb01f8156e3433e561ab17639b3ae88a215421e
Opcode Fuzzy Hash: 320b3f6e429cf0cbe73faf20c7e107a408ce982d78f658c26bbf49eddf117046
Instruction Fuzzy Hash: EEC1BD74E00218CFEB54DFA5C994BADBBB2BF89304F2081A9D419AB355DB359E81CF50

Function 06590D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3410e3a104847aa91bd5dc81ad2d90d5add7b705e4288d97c808d70a13e385bc
Instruction ID: f55e82c72cd36d01e336891563645be95c06273059d1e097381733af2488d521
Opcode Fuzzy Hash: 3410e3a104847aa91bd5dc81ad2d90d5add7b705e4288d97c808d70a13e385bc
Instruction Fuzzy Hash: 4EC1BE74E00219CFEB54DFA5C994BADBBB2BF89304F2081A9D409AB355DB359E81CF50

Function 06597900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d21a3eadce8574e2eb645d066a6f653a90e1689dcc726680ece1b1a7dea5777
Instruction ID: 558bf965383bb8f399bff1ea655f2a315560a55351bf5f87f9f42e9aa095688a
Opcode Fuzzy Hash: 2d21a3eadce8574e2eb645d066a6f653a90e1689dcc726680ece1b1a7dea5777
Instruction Fuzzy Hash: FFC1A074E00218CFDB54DFA5D994BADBBB2FF88304F2481AAD409AB355DB359A81CF50

Function 06595198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed243ad8244f00f447f71d82e880b4e1abbec3f3d98108425a7cba8ed762f9fc
Instruction ID: 9fb4cc390f13f12f1ef709bcc1df552a64a3fb4fda199785481a3815cb4d4a69
Opcode Fuzzy Hash: ed243ad8244f00f447f71d82e880b4e1abbec3f3d98108425a7cba8ed762f9fc
Instruction Fuzzy Hash: 58C1B074E00218CFDB55DFA5C994B9DBBB2FF88304F2481A9D409AB355EB359A81CF50

Function 065981B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056c7d4dc59608c842923e42aae16ea6528138fffe67c59bb145a293926d6369
Instruction ID: 96f8457960da6a5fb031f55359df3ff48eaec7ceda667cf3be9145cdfbb6e49a
Opcode Fuzzy Hash: 056c7d4dc59608c842923e42aae16ea6528138fffe67c59bb145a293926d6369
Instruction Fuzzy Hash: 68C1B074E00218CFEB54DFA5C994B9DBBB2FF89304F2481A9D409AB355DB359A81CF50

Function 055F1610 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9406b0abcad415c5c2b3e34264347ec34c4db52f2b0dddcff80aea934d64d55
Instruction ID: 2b83a3bf19833524e14cdad7bc623411dbad42bd426718e95768e1980d3af298
Opcode Fuzzy Hash: e9406b0abcad415c5c2b3e34264347ec34c4db52f2b0dddcff80aea934d64d55
Instruction Fuzzy Hash: 0FA11570D00208CFEB24DFA9C998BDDBBB1FF89304F248269E549AB291DB755985CF50

Function 065933B8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63ade275f7c58b0a039fe3defbe767ca6b0ee5017b97dc702e846c181144dfb
Instruction ID: 8dc6faa7ff740b2bd4bc6b4f301fc760f2e352c107bbaeb8117c0ebc235346a4
Opcode Fuzzy Hash: d63ade275f7c58b0a039fe3defbe767ca6b0ee5017b97dc702e846c181144dfb
Instruction Fuzzy Hash: 70B1A674E00218CFDB54DFA9D894A9DBBB2FF89310F2481A9D819AB365DB30AD41CF50

Function 055F1620 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7eb37ac9f8be030593f85026d242958796aea8a00bdec2200f1a168233d5e66
Instruction ID: 12018e093b63c414709ce4e6f6c1b07e76e3883fc1c6672db746feaa62bc19c8
Opcode Fuzzy Hash: b7eb37ac9f8be030593f85026d242958796aea8a00bdec2200f1a168233d5e66
Instruction Fuzzy Hash: 79A11570D00208CFEB24DFA9C958BDDBBB1FF89314F248269E509AB291DB759985CF50

Function 055F1966 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4544994206.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93fb8c916b9c3e0c20f0e5cfcf1b2e4204be8cebf3a8d9f9a5a2db38e05900a1
Instruction ID: 2340525abcdc833508289587b134b948b1eb4b61df12acda9f4fef691261111c
Opcode Fuzzy Hash: 93fb8c916b9c3e0c20f0e5cfcf1b2e4204be8cebf3a8d9f9a5a2db38e05900a1
Instruction Fuzzy Hash: E3910470D00608CFEB10DFA9C588BDCBBB1FF49314F248269E549AB291DB759985CF64

Function 065933A8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb536dede8d8ee2df9eabc0eb9e9c0a6a16d0fca7c3f31e89ab9ae5acdb2462b
Instruction ID: fec1483bbdfccd561ed3d6ea633c90d4fc79f0c7cee95f593026a054e277c608
Opcode Fuzzy Hash: fb536dede8d8ee2df9eabc0eb9e9c0a6a16d0fca7c3f31e89ab9ae5acdb2462b
Instruction Fuzzy Hash: CD518374E00608CFDB48DFAAD994A9DBBF2FF89300F148169D419AB365DB349942CF50

Function 065936CE Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4545524329.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0adde678cfa606d59b69c061f4bd94dd0efdd599b540b6fbb17e086d9b8de12
Instruction ID: 7f485d7ee2ad4ac6e75d8902e800e5229f539dec4003e100462676a1ee7577a5
Opcode Fuzzy Hash: c0adde678cfa606d59b69c061f4bd94dd0efdd599b540b6fbb17e086d9b8de12
Instruction Fuzzy Hash: 02D06735D0425CCACF10EF58D8503ADB772FF86310F0024968508B7640D7305E508E16

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LETTER OF AUTHORIZATION.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LETTER OF AUTHOR_329154322c784dbb2b1b7cad391c25af57eb70_fa2d1c6a_5a9197ca-ebb7-4c17-b016-25b978ac7f2a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F83.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3188.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31B8.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
LETTER OF AUTHORIZATION.exe

Function 00007FFD348937DC Relevance: 3.0, Strings: 2, Instructions: 468
COMMON

Function 00007FFD34898B40 Relevance: 2.1, Strings: 1, Instructions: 866
COMMON

Function 00007FFD34891608 Relevance: 2.0, Strings: 1, Instructions: 700
COMMON

Function 00007FFD348A31C7 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Function 00007FFD3489B661 Relevance: 1.1, Instructions: 1133
COMMON

Function 00007FFD3496026B Relevance: 1.7, Strings: 1, Instructions: 432
COMMON

Function 00007FFD348A7829 Relevance: 1.6, APIs: 1, Instructions: 120
memoryCOMMON

Function 055F7B70 Relevance: 2.0, APIs: 1, Instructions: 532
COMMON