Edit tour

Windows Analysis Report
Q3FGHfhdgU.exe

Overview

General Information

Sample name:	Q3FGHfhdgU.exe renamed because original name is a hash value
Original sample name:	488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
Analysis ID:	1511614
MD5:	e02fd1eee5d9fc50ac508abf6896982e
SHA1:	7c93d2e15ef9201a6f7154f924f2acd05b62511c
SHA256:	488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779
Tags:	ArkeiStealerexe
Infos:

Detection

Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Q3FGHfhdgU.exe (PID: 4340 cmdline: "C:\Users\user\Desktop\Q3FGHfhdgU.exe" MD5: E02FD1EEE5D9FC50AC508ABF6896982E)

WerFault.exe (PID: 2064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 804 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7200 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 824 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7336 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 836 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7392 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 844 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1008 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7520 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1104 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7612 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1560 MD5: C31336C1EFC2CCB44B4326EA793040F2)

icacls.exe (PID: 7648 cmdline: icacls "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

WerFault.exe (PID: 7700 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2080 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2160 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Q3FGHfhdgU.exe (PID: 7924 cmdline: "C:\Users\user\Desktop\Q3FGHfhdgU.exe" --Admin IsNotAutoStart IsNotTask MD5: E02FD1EEE5D9FC50AC508ABF6896982E)

WerFault.exe (PID: 8064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 764 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2128 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Q3FGHfhdgU.exe (PID: 7712 cmdline: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe --Task MD5: E02FD1EEE5D9FC50AC508ABF6896982E)

WerFault.exe (PID: 7896 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 848 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://ring2.ug/files/cost/updatewin1.exe", "http://ring2.ug/files/cost/updatewin2.exe", "http://ring2.ug/files/cost/updatewin.exe", "http://ring2.ug/files/cost/3.exe", "http://ring2.ug/files/cost/4.exe", "http://ring2.ug/files/cost/5.exe"], "C2 url": "http://ring2.ug/As73yhsyU34578hxxx1/SDf565g/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-UdTNsLeiJA\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nhelpmanager@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\nhelpmanager@iran.ir\r\n\r\nYour personal ID:\r\n0199a7d6a8sda", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1nRLKUg1DQPapCekDhTf\\\\noUCgkn+rYedfKQ2grOUCZupb9MXIMn6mejNjK5hFTIDwygKX\\/tlcMRQK94QixocC\\\\n5Cw2Jn+YSsGRuqo3Da5Th9hjTfXBrEl3bg+7BqVtJpOFdg5oXR2STRjq9q+k5U\\/M\\\\n9Dhm88qSQSe0nCBL6VLLHcU\\/ErVL4X8LO3clm1x6\\/XM9dOOr6hJmsdEKURryzcB2\\\\nbqxUeOF1DtFts1Tlk5g7lSE9Xacs+Le\\/q2lefqAbTKHCdk7DP0NtuJv81MunNoMO\\\\n3nYiW2AXw\\/2srR47\\/UujjGmJd2Vcf1e+GqjvijUzF2p3adhVimDs\\/UPb2Ud7qYfx\\\\ntwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001C.00000002.1721419993.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000022.00000002.1707372254.0000000000A74000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105378:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xdc3f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xdab28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105378:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xdc3f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xdab28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xdab28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105378:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xdc3f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: Q3FGHfhdgU.exe PID: 4340	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Q3FGHfhdgU.exe PID: 4340	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4acf7:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x9dd7f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd1169:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Q3FGHfhdgU.exe PID: 7712	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Q3FGHfhdgU.exe PID: 7712	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3163d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x6e351:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xa790c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Q3FGHfhdgU.exe PID: 7924	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Q3FGHfhdgU.exe PID: 7924	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37201:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x81f49:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcace6:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.Q3FGHfhdgU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.Q3FGHfhdgU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
5.2.Q3FGHfhdgU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.2.Q3FGHfhdgU.exe.af0e50.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.2.Q3FGHfhdgU.exe.af0e50.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
28.2.Q3FGHfhdgU.exe.af0e50.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.Q3FGHfhdgU.exe.b00e50.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.Q3FGHfhdgU.exe.b00e50.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.Q3FGHfhdgU.exe.b00e50.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.2.Q3FGHfhdgU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.2.Q3FGHfhdgU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
28.2.Q3FGHfhdgU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
34.3.Q3FGHfhdgU.exe.c30000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.3.Q3FGHfhdgU.exe.c30000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
34.3.Q3FGHfhdgU.exe.c30000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
34.2.Q3FGHfhdgU.exe.b10e50.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.2.Q3FGHfhdgU.exe.b10e50.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
34.2.Q3FGHfhdgU.exe.b10e50.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.3.Q3FGHfhdgU.exe.c20000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.3.Q3FGHfhdgU.exe.c20000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.3.Q3FGHfhdgU.exe.c20000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.3.Q3FGHfhdgU.exe.c10000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.3.Q3FGHfhdgU.exe.c10000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
28.3.Q3FGHfhdgU.exe.c10000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
34.2.Q3FGHfhdgU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.2.Q3FGHfhdgU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
34.2.Q3FGHfhdgU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 40 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Q3FGHfhdgU.exe, ProcessId: 4340, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-16T00:22:45.157930+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-16T00:22:59.584061+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49712	188.114.96.3	443	TCP
2024-09-16T00:23:03.191518+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49713	188.114.96.3	443	TCP
2024-09-16T00:23:06.839513+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49715	188.114.96.3	443	TCP
2024-09-16T00:23:10.816902+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49720	188.114.96.3	443	TCP
2024-09-16T00:23:28.718835+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49731	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Q3FGHfhdgU.exe

Avira: detected

Found malware configuration

Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://ring2.ug/files/cost/updatewin1.exe", "http://ring2.ug/files/cost/updatewin2.exe", "http://ring2.ug/files/cost/updatewin.exe", "http://ring2.ug/files/cost/3.exe", "http://ring2.ug/files/cost/4.exe", "http://ring2.ug/files/cost/5.exe"], "C2 url": "http://ring2.ug/As73yhsyU34578hxxx1/SDf565g/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-UdTNsLeiJA\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nhelpmanager@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\nhelpmanager@iran.ir\r\n\r\nYour personal ID:\r\n0199a7d6a8sda", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\"

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe

ReversingLabs: Detection: 97%

Multi AV Scanner detection for submitted file

Source: Q3FGHfhdgU.exe	ReversingLabs: Detection: 97%
Source: Q3FGHfhdgU.exe	Virustotal: Detection: 90%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: Q3FGHfhdgU.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B11210 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlen,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_malloc,_memset,_sprintf,lstrcat,CryptDestroyHash,CryptReleaseContext,	5_2_00B11210
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B113C8 CryptDestroyHash,CryptReleaseContext,	5_2_00B113C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0EAC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	5_2_00B0EAC0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0ECA1 CryptDestroyHash,CryptReleaseContext,	5_2_00B0ECA1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0ECF0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	5_2_00B0ECF0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0EEB8 CryptDestroyHash,CryptReleaseContext,	5_2_00B0EEB8
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B01210 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlen,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_malloc,_memset,_sprintf,lstrcat,CryptDestroyHash,CryptReleaseContext,	28_2_00B01210
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B013C8 CryptDestroyHash,CryptReleaseContext,	28_2_00B013C8
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFEAC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	28_2_00AFEAC0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFECA1 CryptDestroyHash,CryptReleaseContext,	28_2_00AFECA1
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFECF0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	28_2_00AFECF0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFEEB8 CryptDestroyHash,CryptReleaseContext,	28_2_00AFEEB8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B21210 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlen,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_malloc,_memset,_sprintf,lstrcat,CryptDestroyHash,CryptReleaseContext,	34_2_00B21210
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B213C8 CryptDestroyHash,CryptReleaseContext,	34_2_00B213C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1EAC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,__CxxThrowException@8,_memset,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	34_2_00B1EAC0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Unpacked PE file: 5.2.Q3FGHfhdgU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Unpacked PE file: 28.2.Q3FGHfhdgU.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Unpacked PE file: 34.2.Q3FGHfhdgU.exe.400000.0.unpack

Source: Q3FGHfhdgU.exe

Static PE information: EXECUTABLE_IMAGE, AGGRESIVE_WS_TRIM, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49731 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: Q3FGHfhdgU.exe, Q3FGHfhdgU.exe, 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: Q3FGHfhdgU.exe, 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B103B0 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_00B103B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0F980 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_00B0F980
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0FDE8 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	5_2_00B0FDE8
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B003B0 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	28_2_00B003B0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFF980 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	28_2_00AFF980
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFFDE8 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	28_2_00AFFDE8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B203B0 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	34_2_00B203B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1F980 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	34_2_00B1F980

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://ring2.ug/As73yhsyU34578hxxx1/SDf565g/get.php

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49715 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49720 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49712 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49731 -> 188.114.96.3:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B0D160 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,

5_2_00B0D160

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: ring2.ug

Source: Q3FGHfhdgU.exe, 00000005.00000003.1392250317.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000003.1392348298.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftN
Source: Q3FGHfhdgU.exe, 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.0000000000596000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.0000000000643000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707074273.000000000076C000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1536934972.000000000076B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-Agent:
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json2
Source: Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=H
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.000000000076C000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1536934972.000000000076B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonD
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonT
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonZ
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonp)(
Source: Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.0000000000643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont
Source: Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.0000000000643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonv
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.0000000000596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/i

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

5_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 5.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Q3FGHfhdgU.exe.af0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Q3FGHfhdgU.exe.b00e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Q3FGHfhdgU.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Q3FGHfhdgU.exe.b10e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.Q3FGHfhdgU.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.Q3FGHfhdgU.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Q3FGHfhdgU.exe PID: 4340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Q3FGHfhdgU.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Q3FGHfhdgU.exe PID: 7924, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 34.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.1721419993.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000022.00000002.1707372254.0000000000A74000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: Process Memory Space: Q3FGHfhdgU.exe PID: 4340, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Q3FGHfhdgU.exe PID: 7712, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Q3FGHfhdgU.exe PID: 7924, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B1BD30 PostQuitMessage,NtdllDefWindowProc_W,NtdllDefWindowProc_W,_malloc,GetComputerNameW,_free,CreateThread,IsWindow,DestroyWindow,IsWindow,DestroyWindow,NtdllDefWindowProc_W,		5_2_00B1BD30
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B0BD30 PostQuitMessage,NtdllDefWindowProc_W,NtdllDefWindowProc_W,_malloc,GetComputerNameW,_free,CreateThread,IsWindow,DestroyWindow,IsWindow,DestroyWindow,NtdllDefWindowProc_W,		28_2_00B0BD30

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0040C070	5_2_0040C070
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0042E003	5_2_0042E003
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00408030	5_2_00408030
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00496150	5_2_00496150
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00458110	5_2_00458110
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004C8113	5_2_004C8113
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004021C0	5_2_004021C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0046E2E0	5_2_0046E2E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0044237E	5_2_0044237E
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004084C0	5_2_004084C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004344FF	5_2_004344FF
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004A6550	5_2_004A6550
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0043E5A3	5_2_0043E5A3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004A85B0	5_2_004A85B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0040A660	5_2_0040A660
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004326AC	5_2_004326AC
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00406740	5_2_00406740
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00402750	5_2_00402750
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0040A710	5_2_0040A710
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004687F0	5_2_004687F0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00408780	5_2_00408780
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00496780	5_2_00496780
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0042C804	5_2_0042C804
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00406880	5_2_00406880
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004349F3	5_2_004349F3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00468A70	5_2_00468A70
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00406A00	5_2_00406A00
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00406B80	5_2_00406B80
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00402B80	5_2_00402B80
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0046AC20	5_2_0046AC20
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0044ACFF	5_2_0044ACFF
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0042CE51	5_2_0042CE51
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00434E0B	5_2_00434E0B
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00406EE0	5_2_00406EE0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00405057	5_2_00405057
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0042F010	5_2_0042F010
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0046B0D0	5_2_0046B0D0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004070E0	5_2_004070E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004870B0	5_2_004870B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004391F6	5_2_004391F6
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00435240	5_2_00435240
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0046B209	5_2_0046B209
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004C9343	5_2_004C9343
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00405447	5_2_00405447
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00405457	5_2_00405457
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00449506	5_2_00449506
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0044B5B1	5_2_0044B5B1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00435675	5_2_00435675
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00409686	5_2_00409686
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0044D7A1	5_2_0044D7A1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00481920	5_2_00481920
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0044D9DC	5_2_0044D9DC
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00449A71	5_2_00449A71
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00443B40	5_2_00443B40
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00477BB0	5_2_00477BB0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00409CF9	5_2_00409CF9
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00495CA0	5_2_00495CA0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0040BDC0	5_2_0040BDC0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00409DFA	5_2_00409DFA
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00409F76	5_2_00409F76
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_0046BFE0	5_2_0046BFE0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00449FE3	5_2_00449FE3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B2D0A1	5_2_00B2D0A1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0C010	5_2_00B0C010
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0A04A	5_2_00B0A04A
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B21180	5_2_00B21180
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B1A1E0	5_2_00B1A1E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0A1C6	5_2_00B0A1C6
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B07130	5_2_00B07130
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B052A7	5_2_00B052A7
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B08280	5_2_00B08280
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0C2C0	5_2_00B0C2C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B2F260	5_2_00B2F260
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B2E253	5_2_00B2E253
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B103B0	5_2_00B103B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B07330	5_2_00B07330
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0D490	5_2_00B0D490
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B02410	5_2_00B02410
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B425CE	5_2_00B425CE
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B056A7	5_2_00B056A7
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B05697	5_2_00B05697
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B08710	5_2_00B08710
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B3474F	5_2_00B3474F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0A8B0	5_2_00B0A8B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B1E8E0	5_2_00B1E8E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B098D6	5_2_00B098D6
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B029A0	5_2_00B029A0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B06990	5_2_00B06990
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0F980	5_2_00B0F980
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B4D9F1	5_2_00B4D9F1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B089D0	5_2_00B089D0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0A960	5_2_00B0A960
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B06AD0	5_2_00B06AD0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B2CA54	5_2_00B2CA54
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B81B70	5_2_00B81B70
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B4DC2C	5_2_00B4DC2C
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B06C43	5_2_00B06C43
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B02DD0	5_2_00B02DD0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B06DD0	5_2_00B06DD0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B1D0A1	28_2_00B1D0A1
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFC010	28_2_00AFC010
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFA04A	28_2_00AFA04A
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B11180	28_2_00B11180
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B0A1E0	28_2_00B0A1E0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFA1C6	28_2_00AFA1C6
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF7130	28_2_00AF7130
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF52A7	28_2_00AF52A7
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF8280	28_2_00AF8280
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFC2C0	28_2_00AFC2C0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B1F260	28_2_00B1F260
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B1E253	28_2_00B1E253
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B003B0	28_2_00B003B0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF7330	28_2_00AF7330
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFD490	28_2_00AFD490
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF2410	28_2_00AF2410
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B325CE	28_2_00B325CE
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF56A7	28_2_00AF56A7
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF5697	28_2_00AF5697
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF8710	28_2_00AF8710
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B2474F	28_2_00B2474F
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFA8B0	28_2_00AFA8B0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B0E8E0	28_2_00B0E8E0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF98D6	28_2_00AF98D6
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF29A0	28_2_00AF29A0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFF980	28_2_00AFF980
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF6990	28_2_00AF6990
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B3D9F1	28_2_00B3D9F1
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF89D0	28_2_00AF89D0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFA960	28_2_00AFA960
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF6AD0	28_2_00AF6AD0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B1CA54	28_2_00B1CA54
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B71B70	28_2_00B71B70
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B3DC2C	28_2_00B3DC2C
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF6C43	28_2_00AF6C43
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF2DD0	28_2_00AF2DD0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF6DD0	28_2_00AF6DD0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFDF90	28_2_00AFDF90
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF9F49	28_2_00AF9F49
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B3AF4F	28_2_00B3AF4F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0040C070	34_2_0040C070
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0042E003	34_2_0042E003
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00408030	34_2_00408030
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00496150	34_2_00496150
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00458110	34_2_00458110
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004C8113	34_2_004C8113
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004021C0	34_2_004021C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0046E2E0	34_2_0046E2E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0044237E	34_2_0044237E
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004084C0	34_2_004084C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004344FF	34_2_004344FF
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004A6550	34_2_004A6550
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0043E5A3	34_2_0043E5A3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004A85B0	34_2_004A85B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0040A660	34_2_0040A660
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004326AC	34_2_004326AC
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00406740	34_2_00406740
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00402750	34_2_00402750
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0040A710	34_2_0040A710
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004687F0	34_2_004687F0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00408780	34_2_00408780
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00496780	34_2_00496780
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0042C804	34_2_0042C804
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00406880	34_2_00406880
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004349F3	34_2_004349F3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00468A70	34_2_00468A70
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00406A00	34_2_00406A00
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00406B80	34_2_00406B80
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00402B80	34_2_00402B80
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0046AC20	34_2_0046AC20
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0044ACFF	34_2_0044ACFF
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0042CE51	34_2_0042CE51
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00434E0B	34_2_00434E0B
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00406EE0	34_2_00406EE0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00405057	34_2_00405057
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0042F010	34_2_0042F010
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0046B0D0	34_2_0046B0D0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004070E0	34_2_004070E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004870B0	34_2_004870B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004391F6	34_2_004391F6
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00435240	34_2_00435240
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0046B209	34_2_0046B209
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004C9343	34_2_004C9343
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00405447	34_2_00405447
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00405457	34_2_00405457
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00449506	34_2_00449506
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0044B5B1	34_2_0044B5B1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00435675	34_2_00435675
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00409686	34_2_00409686
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0044D7A1	34_2_0044D7A1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00481920	34_2_00481920
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0044D9DC	34_2_0044D9DC
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00449A71	34_2_00449A71
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00443B40	34_2_00443B40
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00477BB0	34_2_00477BB0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00409CF9	34_2_00409CF9
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00495CA0	34_2_00495CA0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0040BDC0	34_2_0040BDC0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00409DFA	34_2_00409DFA
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00409F76	34_2_00409F76
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_0046BFE0	34_2_0046BFE0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00449FE3	34_2_00449FE3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B3D0A1	34_2_00B3D0A1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1C010	34_2_00B1C010
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1A04A	34_2_00B1A04A
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B31180	34_2_00B31180
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B2A1E0	34_2_00B2A1E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1A1C6	34_2_00B1A1C6
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B17130	34_2_00B17130
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B152A7	34_2_00B152A7
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B18280	34_2_00B18280
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1C2C0	34_2_00B1C2C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B3F260	34_2_00B3F260
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B3E253	34_2_00B3E253
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B203B0	34_2_00B203B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B17330	34_2_00B17330
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1D490	34_2_00B1D490
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B12410	34_2_00B12410
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B525CE	34_2_00B525CE
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B156A7	34_2_00B156A7
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B15697	34_2_00B15697
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B18710	34_2_00B18710
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B4474F	34_2_00B4474F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1A8B0	34_2_00B1A8B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B2E8E0	34_2_00B2E8E0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B198D6	34_2_00B198D6
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B129A0	34_2_00B129A0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B16990	34_2_00B16990
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1F980	34_2_00B1F980
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B5D9F1	34_2_00B5D9F1
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B189D0	34_2_00B189D0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1A960	34_2_00B1A960
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B16AD0	34_2_00B16AD0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B3CA54	34_2_00B3CA54

Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: String function: 00B18770 appears 57 times
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: String function: 00B1FA10 appears 50 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 004702F0 appears 124 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 0046FDC0 appears 104 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00456780 appears 36 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00B28770 appears 55 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00B2FA10 appears 49 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00472140 appears 118 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 004547A0 appears 370 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00B38770 appears 39 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00B3FA10 appears 37 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 0042F7C0 appears 506 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00454E50 appears 248 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00454C00 appears 32 times
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: String function: 00462A60 appears 34 times

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 804

Source: Q3FGHfhdgU.exe	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: Q3FGHfhdgU.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: Q3FGHfhdgU.exe

Static PE information: EXECUTABLE_IMAGE, AGGRESIVE_WS_TRIM, 32BIT_MACHINE

Source: 5.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.Q3FGHfhdgU.exe.b00e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.3.Q3FGHfhdgU.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.3.Q3FGHfhdgU.exe.c20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.3.Q3FGHfhdgU.exe.c10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.2.Q3FGHfhdgU.exe.b10e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.2.Q3FGHfhdgU.exe.af0e50.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 34.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.2.Q3FGHfhdgU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.1721419993.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000022.00000002.1707372254.0000000000A74000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: Process Memory Space: Q3FGHfhdgU.exe PID: 4340, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Q3FGHfhdgU.exe PID: 7712, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Q3FGHfhdgU.exe PID: 7924, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: Q3FGHfhdgU.exe	Static PE information: Section: .data ZLIB complexity 0.9916513480392157
Source: Q3FGHfhdgU.exe.5.dr	Static PE information: Section: .data ZLIB complexity 0.9916513480392157

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@18/52@5/1

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B11B50 GetLastError,FormatMessageW,LocalAlloc,lstrcpyW,lstrlenW,_memset,lstrcpynW,MessageBoxW,

5_2_00B11B50

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_008D17C6 CreateToolhelp32Snapshot,Module32First,

5_2_008D17C6

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B0D490 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,_wcsftime,swprintf,CoUninitialize,CoUninitialize,

5_2_00B0D490

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\geo[1].json

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4340
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7924
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7712

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a2c833df-2d31-4e0f-ab59-c3b4c9e0d8eb

Jump to behavior

Source: Q3FGHfhdgU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Q3FGHfhdgU.exe	ReversingLabs: Detection: 97%
Source: Q3FGHfhdgU.exe	Virustotal: Detection: 90%

Source: Q3FGHfhdgU.exe	String found in binary or memory: set-addPolicy
Source: Q3FGHfhdgU.exe	String found in binary or memory: id-cmc-addExtensions
Source: Q3FGHfhdgU.exe	String found in binary or memory: set-addPolicy
Source: Q3FGHfhdgU.exe	String found in binary or memory: id-cmc-addExtensions
Source: Q3FGHfhdgU.exe	String found in binary or memory: set-addPolicy
Source: Q3FGHfhdgU.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

File read: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Q3FGHfhdgU.exe "C:\Users\user\Desktop\Q3FGHfhdgU.exe"
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 804
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 824
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 836
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 844
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1008
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1104
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1560
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2080
Source: unknown	Process created: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe --Task
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2160
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 848
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Users\user\Desktop\Q3FGHfhdgU.exe "C:\Users\user\Desktop\Q3FGHfhdgU.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2128
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 764
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process created: C:\Users\user\Desktop\Q3FGHfhdgU.exe "C:\Users\user\Desktop\Q3FGHfhdgU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: Q3FGHfhdgU.exe, Q3FGHfhdgU.exe, 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: Q3FGHfhdgU.exe, 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp

Source: Q3FGHfhdgU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Q3FGHfhdgU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Q3FGHfhdgU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Q3FGHfhdgU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Q3FGHfhdgU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Unpacked PE file: 5.2.Q3FGHfhdgU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.wexetoc:W;.numokef:W;.fayecef:W;.ruk:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Unpacked PE file: 28.2.Q3FGHfhdgU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.wexetoc:W;.numokef:W;.fayecef:W;.ruk:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Unpacked PE file: 34.2.Q3FGHfhdgU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.wexetoc:W;.numokef:W;.fayecef:W;.ruk:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Unpacked PE file: 5.2.Q3FGHfhdgU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Unpacked PE file: 28.2.Q3FGHfhdgU.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Unpacked PE file: 34.2.Q3FGHfhdgU.exe.400000.0.unpack

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

5_2_00481920

Source: Q3FGHfhdgU.exe	Static PE information: section name: .wexetoc
Source: Q3FGHfhdgU.exe	Static PE information: section name: .numokef
Source: Q3FGHfhdgU.exe	Static PE information: section name: .fayecef
Source: Q3FGHfhdgU.exe	Static PE information: section name: .ruk
Source: Q3FGHfhdgU.exe.5.dr	Static PE information: section name: .wexetoc
Source: Q3FGHfhdgU.exe.5.dr	Static PE information: section name: .numokef
Source: Q3FGHfhdgU.exe.5.dr	Static PE information: section name: .fayecef
Source: Q3FGHfhdgU.exe.5.dr	Static PE information: section name: .ruk

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_008D7713 push 00000015h; ret	5_2_008D7732
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_008D3E10 push ecx; retf	5_2_008D3E13
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B287B5 push ecx; ret	5_2_00B287C8
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00A5FE10 push ecx; retf	28_2_00A5FE13
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00A63713 push 00000015h; ret	28_2_00A63732
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B187B5 push ecx; ret	28_2_00B187C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00A7A713 push 00000015h; ret	34_2_00A7A732
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00A76E10 push ecx; retf	34_2_00A76E13
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B387B5 push ecx; ret	34_2_00B387C8

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

File created: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_004326AC GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_004326AC

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00401178 rdtsc

5_2_00401178

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	5_2_00B0E8C0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	28_2_00AFE8C0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	34_2_00B1E8C0

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	API coverage: 1.0 %
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	API coverage: 1.5 %
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	API coverage: 0.8 %

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B103B0 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_00B103B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0F980 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_00B0F980
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0FDE8 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	5_2_00B0FDE8
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B003B0 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	28_2_00B003B0
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFF980 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	28_2_00AFF980
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AFFDE8 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	28_2_00AFFDE8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B203B0 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	34_2_00B203B0
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1F980 PathAppendW,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	34_2_00B1F980

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.000000000054E000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000002.1708845166.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.000000000069B000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1536934972.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707074273.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.0000000000596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.0000000000596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V%
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Q3FGHfhdgU.exe, 00000005.00000002.1708845166.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2x\.
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00401178 rdtsc

5_2_00401178

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_0044835A LdrInitializeThunk,__handle_exc,__cfltcvt,__ctrlfp,

5_2_0044835A

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B243B8 _memset,IsDebuggerPresent,

5_2_00B243B8

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B2A7CA ___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,

5_2_00B2A7CA

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

5_2_00481920

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_008D10A3 push dword ptr fs:[00000030h]	5_2_008D10A3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B0092B mov eax, dword ptr fs:[00000030h]	5_2_00B0092B
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B00D90 mov eax, dword ptr fs:[00000030h]	5_2_00B00D90
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00A5D0A3 push dword ptr fs:[00000030h]	28_2_00A5D0A3
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF092B mov eax, dword ptr fs:[00000030h]	28_2_00AF092B
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00AF0D90 mov eax, dword ptr fs:[00000030h]	28_2_00AF0D90
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00A740A3 push dword ptr fs:[00000030h]	34_2_00A740A3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_00B1092B mov eax, dword ptr fs:[00000030h]	34_2_00B1092B

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00447CAC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

5_2_00447CAC

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_004329EC
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_004329BB SetUnhandledExceptionFilter,	5_2_004329BB
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B32C3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00B32C3C
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 5_2_00B32C0B SetUnhandledExceptionFilter,	5_2_00B32C0B
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B22C3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00B22C3C
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: 28_2_00B22C0B SetUnhandledExceptionFilter,	28_2_00B22C0B
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_004329EC
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: 34_2_004329BB SetUnhandledExceptionFilter,	34_2_004329BB

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Process created: C:\Users\user\Desktop\Q3FGHfhdgU.exe "C:\Users\user\Desktop\Q3FGHfhdgU.exe" --Admin IsNotAutoStart IsNotTask

Jump to behavior

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B279A6 cpuid

5_2_00B279A6

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtGetStringTypeA,	5_2_0043404A
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	5_2_00438178
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: __crtGetLocaleInfoA_stat,	5_2_00440116
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004382A2
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	5_2_0043834F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00438423
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	5_2_004387C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,	5_2_0043884E
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_00432B6D
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	5_2_00432FAD
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_004335E7
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,_LcidFromHexString,GetLocaleInfoW,	5_2_00437BB3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	5_2_00437E27
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	5_2_00437E83
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	5_2_00437F00
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,	5_2_0042BF17
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	5_2_00437F83
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	5_2_00B380D3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	5_2_00B38077
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_00B331FD
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	5_2_00B381D3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	5_2_00B2C167
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	5_2_00B38150
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_00B3429A
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	5_2_00B383C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_00B40366
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00B384F2
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	5_2_00B3859F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_00B33837
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,	5_2_00B38A9E
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	5_2_00B38A18
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	5_2_00B37E03
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	28_2_00B280D3
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	28_2_00B28077
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	28_2_00B231FD
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	28_2_00B281D3
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	28_2_00B1C167
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	28_2_00B28150
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	28_2_00B2429A
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	28_2_00B283C8
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	28_2_00B30366
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	28_2_00B284F2
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	28_2_00B2859F
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	28_2_00B23837
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,	28_2_00B28A9E
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	28_2_00B28A18
Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	28_2_00B27E03
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtGetStringTypeA,	34_2_0043404A
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	34_2_00438178
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: __crtGetLocaleInfoA_stat,	34_2_00440116
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	34_2_004382A2
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	34_2_0043834F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	34_2_00438423
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	34_2_004387C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,	34_2_0043884E
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	34_2_00432B6D
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	34_2_00432FAD
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	34_2_004335E7
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,_LcidFromHexString,GetLocaleInfoW,	34_2_00437BB3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	34_2_00437E27
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	34_2_00437E83
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	34_2_00437F00
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,	34_2_0042BF17
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	34_2_00437F83
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	34_2_00B480D3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	34_2_00B48077
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	34_2_00B431FD
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	34_2_00B481D3
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	34_2_00B3C167
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	34_2_00B48150
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	34_2_00B4429A
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	34_2_00B483C8
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	34_2_00B50366
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	34_2_00B484F2
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	34_2_00B4859F
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	34_2_00B43837
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: GetLocaleInfoW,	34_2_00B48A9E
Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe	Code function: EnumSystemLocalesW,	34_2_00B48A18

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00432283 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00432283

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_00B1A1E0 GetCurrentProcess,SetPriorityClass,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,GetVersion,lstrcpyW,_memset,ShellExecuteExW,CreateThread,lstrlen,_malloc,_memset,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlen,lstrcpy,GetUserNameW,WaitForSingleObject,WaitForSingleObject,CloseHandle,

5_2_00B1A1E0

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

Code function: 5_2_0042FE47 ____lc_codepage_func,__getenv_helper_nolock,_strlen,_strlen,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_0042FE47

Source: C:\Users\user\Desktop\Q3FGHfhdgU.exe

5_2_00481920

Source: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	21 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Services File Permissions Weakness	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Q3FGHfhdgU.exe	97%	ReversingLabs	Win32.Trojan.BrsecmonE
Q3FGHfhdgU.exe	90%	Virustotal		Browse
Q3FGHfhdgU.exe	100%	Avira	TR/AD.InstaBot.gce
Q3FGHfhdgU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe	97%	ReversingLabs	Win32.Trojan.BrsecmonE

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
https://api.2ip.ua/geo.jsons	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonZ	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonT	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonp)(	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonv	0%	Avira URL Cloud	safe
https://api.2ip.ua/	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json2	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json=H	0%	Avira URL Cloud	safe
https://api.2ip.ua/i	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonD	0%	Avira URL Cloud	safe
http://crl.microsoftN	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json-Agent:	0%	Avira URL Cloud	safe
http://www.openssl.org/support/faq.html	0%	Avira URL Cloud	safe
http://ring2.ug/As73yhsyU34578hxxx1/SDf565g/get.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
api.2ip.ua	188.114.96.3	true	false	unknown
ring2.ug	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.2ip.ua/geo.json	false	Avira URL Cloud: safe	unknown
http://ring2.ug/As73yhsyU34578hxxx1/SDf565g/get.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.2ip.ua/geo.jsonp)(	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	Q3FGHfhdgU.exe, 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/	Q3FGHfhdgU.exe, 00000005.00000002.1708845166.0000000000596000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.0000000000643000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000002.1707074273.000000000076C000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1536934972.000000000076B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonZ	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonT	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsont	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonv	Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.0000000000643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsons	Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.0000000000643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json2	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/i	Q3FGHfhdgU.exe, 00000005.00000002.1708845166.0000000000596000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.json=H	Q3FGHfhdgU.exe, 0000001C.00000002.1720994498.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonD	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.000000000076C000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000022.00000003.1536934972.000000000076B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoftN	Q3FGHfhdgU.exe, 00000005.00000003.1392250317.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, Q3FGHfhdgU.exe, 00000005.00000003.1392348298.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json-Agent:	Q3FGHfhdgU.exe, 00000022.00000002.1707074273.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	Q3FGHfhdgU.exe, 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	api.2ip.ua	European Union		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511614
Start date and time:	2024-09-16 00:21:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Q3FGHfhdgU.exe renamed because original name is a hash value
Original Sample Name:	488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@18/52@5/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 93.184.221.240, 20.189.173.20
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, time.windows.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:22:45	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe s>--Task
00:22:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe" --AutoStart
02:17:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe" --AutoStart
20:17:39	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	3Kel6xErOk.exe	Get hash	malicious	Nitol	Browse	web.ad87h92j.com/4/t.bmp
	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp
	http://www.pelisplus3.city/pl	Get hash	malicious	Phisher	Browse	www.pelisplus3.city/pl
	http://ea721twc.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	ea721twc.pages.dev/favicon.ico
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/kslt/
	Comprobante.PDF867564575869708776565434576897.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sweetwhore/five/fre.php
	r9856_7.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/x5bi/
	DistinctiveCarpets#92161.pdf	Get hash	malicious	HTMLPhisher	Browse	uyvi.jjscommunitysupport.online/favicon.ico
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse	vlha.shop/LP341/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.2ip.ua	Wm0uFsapfrnONF16Njxegq7s.exe	Get hash	malicious	Djvu	Browse	188.114.97.3
	66d5df681876c_file010924.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	e8997f96b91ab5ea1fed555a7d62369a8307b0cfcbd0e32c5e9a7e430ab42240.zip	Get hash	malicious	Djvu	Browse	188.114.97.3
bg.microsoft.map.fastly.net	https://defydapp.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	http://netflix-clone-rho-rose.vercel.app/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://membership.garenaa.id.vn/css/greeting.jsp/index.html	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://fghfdghfdgfd678678.blogspot.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://sasktelliveadetailsnet56367163.weebly.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://nsctpl.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	SecuriteInfo.com.Program.Unwanted.4988.31668.29519.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	199.232.214.172
	file.exe	Get hash	malicious	Clipboard Hijacker, Raccoon Stealer v2	Browse	199.232.210.172
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Clipboard Hijacker, Raccoon Stealer v2	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://zansecuredes.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.182
	https://defydapp.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://netflix-clone-rho-rose.vercel.app/	Get hash	malicious	Unknown	Browse	172.64.155.119
	https://membership.garenaa.id.vn/css/greeting.jsp/index.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://fghfdghfdgfd678678.blogspot.mk/	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://fghfdghfdgfd678678.blogspot.com/	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://auth-exts-coin--basewallet.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://continue-clone23-here.vercel.app/	Get hash	malicious	Unknown	Browse	104.21.19.26
	https://coinbase--help--sso--extension.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.11.212
	https://app-coinbasepro-n-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Get hash	malicious	Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win64.Malware-gen.12732.27825.exe	Get hash	malicious	Latrodectus	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	Clipboard Hijacker, Raccoon Stealer v2	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_02f2c633-3ce4-432b-8fb4-3ffe61a05738\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8985491448596502
Encrypted:	false
SSDEEP:	192:dN9p8nke57tf056rgjGfzuiFqZ24IO8DT:Xw/VtM56rgj2zuiFqY4IO8DT
MD5:	8EFFDE5BDBDE38920EEB29FAF26C57F8
SHA1:	29A8B6E653E6F2D7EEB1A8729583171D733EC476
SHA-256:	873C421FE0F7E49D923EA5C9DCF5D2F4F780C254BC384A1D9185AE54B1C8BE52
SHA-512:	17A5BF979253BD6433A07A597CDEF794623E317075234CD89FA521EDE4C8D2A9BB52D6B5E16A051A38A81A266855012FA565CEEB79CDDFF3F19C75E1DC1F681C
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.6.8.2.0.2.2.1.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.f.2.c.6.3.3.-.3.c.e.4.-.4.3.2.b.-.8.f.b.4.-.3.f.f.e.6.1.a.0.5.7.3.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.5.1.d.1.7.a.8.-.9.2.4.a.-.4.6.b.f.-.b.e.f.d.-.2.0.d.c.a.1.8.a.9.3.d.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.0.-.0.0.0.1.-.0.0.1.4.-.a.0.a.8.-.3.c.c.a.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_19242484-c679-4941-bd57-6f540315428c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0612686308252057
Encrypted:	false
SSDEEP:	192:d/+pnkejf056rIjG1KXGzuiFqZ24IO8XT:1+p/jM56rIjfGzuiFqY4IO8XT
MD5:	62777B5622B1825A7618500A8E97546E
SHA1:	06D4308D07A7A406442902217FB3B6E6072BBC0A
SHA-256:	9B6F57A5D2D54A22536277228595026B20D2C0BCB492FF7F48A610B64C771163
SHA-512:	4A66FA08366C6241C3B1F1BAA12981CAE299A1DBB015E0142E878A05C6666A8744E4B7C3277E69E148E7A5DE802F5F98A69B04CAD0F6E1E78A4F4A867CA4B7E5
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.6.6.2.6.7.4.5.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.2.4.2.4.8.4.-.c.6.7.9.-.4.9.4.1.-.b.d.5.7.-.6.f.5.4.0.3.1.5.4.2.8.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.f.e.5.6.0.6.-.2.8.2.2.-.4.4.e.3.-.a.7.4.8.-.f.f.c.4.d.e.4.5.e.0.c.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_30a2ab8c-d918-47d4-8a43-671b7fcd7b6b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8799915870688884
Encrypted:	false
SSDEEP:	96:dswg/pnkeRs2mZoA7Rq6tQXIDcQnc6rCcEhcw3r54I+HbHg/opAnQk8pEpXqOEXu:dDg/pnkeRf056rIjGfzuiFqZ24IO8XT
MD5:	18BEF9B4945AC40EC0B457A93133E51D
SHA1:	AD1EAA231E9F0AA68E733D0711CB2047EC2758B1
SHA-256:	312053AB1F463206DC0BB74C38DE5264B2B253FB38831E1298464552E4B95C1E
SHA-512:	DC0381423E693DF88099C9D1BDEE875724C5C5F45812EA125374375513B987022B099740F2782F163C72AEC6AA1168E97DC1D8FA8C78CDF1A6B85FB98FF161AD
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.5.5.8.3.3.6.6.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.a.2.a.b.8.c.-.d.9.1.8.-.4.7.d.4.-.8.a.4.3.-.6.7.1.b.7.f.c.d.7.b.6.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.8.a.6.1.b.e.-.0.1.c.b.-.4.1.7.3.-.a.7.5.9.-.b.8.f.4.e.d.e.b.1.0.7.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_4e0c2355-3855-4b4a-9d8f-c6d24df75a1b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8799344303574697
Encrypted:	false
SSDEEP:	96:dOxpnkens2mZoA7Rq6tQXIDcQnc6rCcEhcw3r54I+HbHg/opAnQk8pEpXqOEX/Oa:depnkenf056rIjGfzuiFqZ24IO8XT
MD5:	1CFC1F13E4F96155F4F7D6562077A505
SHA1:	B84DE8ECE25071E5D8B3E1246625B4380733282D
SHA-256:	A4CD7174430CB985418843F44F9F47F54562FA7666CE6DD0EE4B70D5AA35E7B6
SHA-512:	7EEAD70F9468B971BC561475B8BB47A0A936B5E81D4F8D33EB82D45734300BC33BBFA00E0D640ACE755B245DDFB2F01BD5A83352CDECBFFBFF0BD5FFFCD4B5DE
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.5.6.6.3.9.3.8.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.e.0.c.2.3.5.5.-.3.8.5.5.-.4.b.4.a.-.9.d.8.f.-.c.6.d.2.4.d.f.7.5.a.1.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.5.2.8.6.9.b.-.4.2.b.4.-.4.8.f.4.-.9.a.0.9.-.f.d.9.7.5.b.6.6.8.f.b.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_7aa84280-98f8-4204-b896-7b202f24dfe8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0812996542961226
Encrypted:	false
SSDEEP:	192:dopnkerf056rIjG1KXuzuiFqZ24IO8XT:Wp/rM56rIjfuzuiFqY4IO8XT
MD5:	DE35E01D15BB8730E2ED2DA96A75F6F4
SHA1:	F4795C38D38ABA5FE5846E78629210527FE1EC43
SHA-256:	4D3A54A173A6A38A9C11D0D7C778CA682CD74E1CF2A517556AE54C56C1069475
SHA-512:	7318A2B0AEBFF7CD624C874B3160A78318E8CFE54AD64CBE517633FCE543FC4204CC10048B6F1C88959673BF7A62ECFD4A0CBFE9926E5C786CE7B4EB769829E0
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.6.7.3.4.9.1.2.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.a.8.4.2.8.0.-.9.8.f.8.-.4.2.0.4.-.b.8.9.6.-.7.b.2.0.2.f.2.4.d.f.e.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.4.8.5.a.8.5.-.b.1.1.2.-.4.d.f.d.-.9.6.9.5.-.c.3.8.8.1.b.3.f.e.1.0.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_b5f6b7f5-c7b1-44db-b69a-18a9f6699eb2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0099033598607794
Encrypted:	false
SSDEEP:	96:dqJEpnkeEs2mZoA7Rq6tQXIDcQnc6rCcEhcw3r54I+HbHg/opAnQk8pEpXqOEX/r:dlpnkeEf056rIjG1KXzuiFqZ24IO8XT
MD5:	372AB9F73958A6D03DF615EA2588A754
SHA1:	A23A5B7DC11938AA983E7A9CD2C6101E80ED9601
SHA-256:	73BEC18E6F6C97679887A2004E30211D57DD6CC07EA0822DFD68280F818339BB
SHA-512:	388934E395D826B4E80390CCAF2E0371202FD11E9E82C2A6C3FCB219F2FC56EBDA868CDD3F838A9A51437961307F6F1E40991220983A2D45AADEFE31AE24BE02
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.6.3.5.0.8.8.7.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.f.6.b.7.f.5.-.c.7.b.1.-.4.4.d.b.-.b.6.9.a.-.1.8.a.9.f.6.6.9.9.e.b.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.4.e.a.5.9.f.-.a.f.5.4.-.4.a.f.d.-.8.5.d.7.-.a.d.3.f.c.7.4.d.4.9.6.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_d7d87454-2c28-4c87-8a7c-eef37b0e9881\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.880260714755701
Encrypted:	false
SSDEEP:	96:dxqRpnkeps2mZoA7Rq6tQXIDcQnc6rCcEhcw3r54I+HbHg/opAnQk8pEpXqOEX/W:dIpnkepf056rIjGfzuiFqZ24IO8XT
MD5:	D1B8780697FA0C4F1DC9442C6E13708B
SHA1:	2336F2A600DB32C962E1514309409EC9F0ABB4DF
SHA-256:	A8AAC4E0783FD3C4C3B971B009918F0A286DCCE2260681A13E38A15F791C5D13
SHA-512:	EF6E8C6BEF1BB27819ED8A3DB5FAFCBB9E5AB073261C208A0E968E541E55A08C05CAFAB0FE0D94AA05F1022D06BF12A3FED4BC27C95CADC7CED4E917D4F9EE05
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.5.7.8.8.0.0.7.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.d.8.7.4.5.4.-.2.c.2.8.-.4.c.8.7.-.8.a.7.c.-.e.e.f.3.7.b.0.e.9.8.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.8.7.a.f.e.c.-.9.8.1.f.-.4.5.8.d.-.9.8.1.a.-.1.2.5.7.b.3.0.3.8.7.c.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_dc0c2af4-fe16-4f50-ad76-b6d351fd9326\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8660211603773382
Encrypted:	false
SSDEEP:	96:dbenke2s2mZoA7Rq6tQXIDcQnc6rCcEhcw3r54I+HbHgoC5AJ0VCEwIDV9wGOyWL:dSnke2f056rIjLnzuiFqZ24IO8XT
MD5:	321DB0485DC6E33D9A6878330F10A5C2
SHA1:	A17128EED9302754FF0AADD97A34481C6D5D5136
SHA-256:	8395CF7157A028D6C2B73C8E55BEF5BFC8930C4BFB6EDB46C9F8A37025E44D48
SHA-512:	EA2A34C649CC999AEAC323804F3F30BD30D6FC577BC948415188B14C89E84C13366E03D76EA1269015EC3BE6191247871BD8DE6399CE5626CC419F8B6F07498D
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.7.0.5.6.4.6.6.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.0.c.2.a.f.4.-.f.e.1.6.-.4.f.5.0.-.a.d.7.6.-.b.6.d.3.5.1.f.d.9.3.2.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.8.2.2.f.0.e.-.3.e.c.d.-.4.6.9.5.-.a.4.5.0.-.9.d.4.0.c.9.6.f.5.e.6.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.f.4.-.0.0.0.1.-.0.0.1.4.-.c.6.b.0.-.7.9.c.b.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_de81b23c-3575-47ea-a8e0-d928bba5b47a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8954132270614363
Encrypted:	false
SSDEEP:	192:dAESpnkeu6f056rIjG1OzuiFqZ24IO8XT7:6ESp/u6M56rIjNzuiFqY4IO8XT
MD5:	E8A619B1F14C626438B0DC09F455CDA2
SHA1:	6559608CC6F880D0BA3CAD0FA162F3DD79274901
SHA-256:	C29948FD0DB8FF5AB91B2DEB01D11EE743F01DE5D771E86BF305563532D13319
SHA-512:	ED08572C8576B52C1EEB6B74BDEF24F6E2B941901A80DC78D96CF4EFDBA854952DCBD9F5DE7400785092AF16E46D113655BD1A937FF72473CB7219C3AD8E4C2A
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.5.9.8.1.2.3.2.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.8.1.b.2.3.c.-.3.5.7.5.-.4.7.e.a.-.a.8.e.0.-.d.9.2.8.b.b.a.5.b.4.7.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.f.0.e.9.4.1.-.3.b.2.8.-.4.0.5.5.-.b.9.0.4.-.8.6.b.e.f.3.9.2.3.b.c.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_f2732550-b3d4-4bd2-9f08-b4855e598aa6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8800173559292588
Encrypted:	false
SSDEEP:	192:dZnZpnkecjf056rIjGfzuiFqZ24IO8XT:jnZp/AM56rIj2zuiFqY4IO8XT
MD5:	AE89A9D555A259798AD1F4C909A1EA9F
SHA1:	D940613D555738530BA4398C4F29480CC3E98453
SHA-256:	EE163C9FA1B791F26AEC4F4AE57BC02BD91BABB2A3D8B4B2AB24D4760AF5134B
SHA-512:	4300BB2DEFDF36D2A89C7679D978E58049917E3873F19BADBB53A7316A920F52BD8258F855D3EE9A0C1E232A7D675C73E5DB7F5DF2DD1B515741F1C292F4EED5
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.5.3.3.0.1.5.3.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.7.3.2.5.5.0.-.b.3.d.4.-.4.b.d.2.-.9.f.0.8.-.b.4.8.5.5.e.5.9.8.a.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.6.8.3.3.6.f.-.2.2.4.3.-.4.a.1.d.-.8.6.6.3.-.5.4.9.7.5.7.6.e.1.1.0.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_f694fe59-d6b9-4d2c-9202-235148b2c192\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9091443982611702
Encrypted:	false
SSDEEP:	96:dALYpnkeqs2mZoA7Rq6tQXIDcQnc6rCcEhcw3r54I+HbHg/opAnQk8pEpXqOEX/n:dBpnkeqf056rIjG18zuiFqZ24IO8XT
MD5:	01E2E042B410A619F357441E915BFD48
SHA1:	F47739D8C8344127F5C990A269B1588D1590636D
SHA-256:	7899C76CA2EBA9FA2430F8A82A9E90F744D63375CE0BA4F12EE0CB03EDE22BA4
SHA-512:	FD0AB9E30A24E9290927D8E1FEF82BFDAEF21C90952EF3656A0681CCDB0666BAA5219F252C6AE8E96897D8D01BA48736BC2E7DEF34EF883AD964C10AFB53A216
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.6.0.7.5.1.2.8.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.9.4.f.e.5.9.-.d.6.b.9.-.4.d.2.c.-.9.2.0.2.-.2.3.5.1.4.8.b.2.c.1.9.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.e.b.9.e.c.2.-.4.0.4.3.-.4.e.d.4.-.a.3.d.2.-.4.3.7.f.5.3.5.6.0.0.0.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.0.9././.2.3.:.1.7.:.3.0.:.3.1.!.0.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_abc183f5c9bbaf76adf7519168d8724fae4473b_97d000f2_9eab30f4-355b-49f2-aced-cd99cfeb16e1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	1.161771276682072
Encrypted:	false
SSDEEP:	192:otfaEOpnkeGA0DXsNjG1KXaXzuiFqZ24IO86T:0Op/GbDXsNjfszuiFqY4IO86T
MD5:	A2EACA3221B65D260E56477182C65A62
SHA1:	6EF9F0973E27A527C2AC53619727F43FD00521F8
SHA-256:	796194DBFAB2BDEBCC7E60A8F50C829949A8FC9F87522E789060F83353708452
SHA-512:	3D3D38DDDC76C67A1FBC878039268AD1444BF86FEF237FB5C47E8A0D69C2E0A61DB7560D87E5FF96B2E30CA64B3FB405FB2393D0C82CB6E6CE367D4E6ABFC91B
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.9.1.2.5.7.0.3.4.1.0.6.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.9.1.2.5.7.4.0.4.4.1.9.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.a.b.3.0.f.4.-.3.5.5.b.-.4.9.f.2.-.a.c.e.d.-.c.d.9.9.c.f.e.b.1.6.e.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.7.b.8.0.9.e.0.-.9.3.5.0.-.4.c.6.b.-.a.6.6.7.-.e.2.8.3.a.c.a.0.8.1.0.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Q.3.F.G.H.f.h.d.g.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.f.4.-.0.0.0.1.-.0.0.1.4.-.1.0.9.e.-.f.7.c.1.b.d.0.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.3.a.e.b.5.f.2.7.f.4.c.6.e.3.3.5.3.4.3.6.4.c.f.b.e.4.a.0.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.7.c.9.3.d.2.e.1.5.e.f.9.2.0.1.a.6.f.7.1.5.4.f.9.2.4.f.2.a.c.d.0.5.b.6.2.5.1.1.c.!.Q.3.F.G.H.f.h.d.g.U...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFE3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	81364
Entropy (8bit):	2.13795517088659
Encrypted:	false
SSDEEP:	384:HKCwLizHWG729QIh0KyYXsCdGrIUoxzLGE4cTdmCDWxIeU4:qCwO6yIh09YcCdGrIUoRKE4cGp
MD5:	85655C4183841D3C2CB39C4F29BBC6C3
SHA1:	8180390FAEB64B9ABF8D883ADD65B0AD4FB7FB43
SHA-256:	E0428E2E366EDF97033A985C2CC29038F0DFD64CE99E3D2D213B321950DBF5BD
SHA-512:	17F95093AE311D85227AA3D11CDE13282EE1C7045EDC4BB0E9C47934DE9CD59EF9029C99808AB4B82F9DEE7F7F0DFE1E8E4A04899A29B45DCDF8A24CA68557F8
Malicious:	false
Preview:	MDMP..a..... .......)^.f.........................................0..........T.......8...........T...........h ..l.......................................................................................................eJ......d.......GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB275.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.702472378987399
Encrypted:	false
SSDEEP:	192:R6l7wVeJBy6ih6YNwSU95zGgmfbvpBt89bDvsfMhm:R6lXJ06ih6YaSU95ygmfbaDUfX
MD5:	6CFABB1733D37BDC08D831C6AA4AA30C
SHA1:	8239BB072B0E312847BA7CC42125AAFB3CA93C81
SHA-256:	A0C9644EBF77C9A81F85333A560999ED75F86EF853036B1165A00E646980A373
SHA-512:	83B3DAA5610C0C4B79796A678FBE535F3334BF4566806A522D9C6ABE83FC8EC27465FC44FF24D671D561F11C32C3F57A1615672AB22A488B76A8F5AB05E3FAA2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB748.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.495068185940218
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYu5Ym8M4J2QzeF0A+q8vBz3Jc0aIeMd:uIjf+I7Ms7VKJPTAKBb20aIeMd
MD5:	7E05CCC02C9857914886314C7C147DB1
SHA1:	5E359E19C9682F0FDE5F043DDEEF882A49F168D3
SHA-256:	2C117298E35B2B7EF3F12087AE6ADF0197BCFAA7D2E8B94920FAF8FAD33E1367
SHA-512:	7F8C5DB6128856BA025C75710C49CDF7BCFAC0893EFB5EBDFCE1F90FC190854080454F4F97D0E08CF714A2D8ABA881D2E93295771A3750E423BF2C1F4B5F11B4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9C7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	81256
Entropy (8bit):	2.155524244962111
Encrypted:	false
SSDEEP:	384:yBwLizHWGwcISgB4hXsCdGrIUoxzLGE4dTdmAtcxwPo7:wwO6YISgBAcCdGrIUoRKE4VG4o
MD5:	4A62AD0A90633F99F9F5F262F2D70AEA
SHA1:	112AB516FC05EA45F52D1932A6E6C66F9D780C5B
SHA-256:	D5AE194C6E822357A2D0D1B65D3AE3B8BB639E29EF3879564BFED21E1329A198
SHA-512:	D90CAA9C5E46E7B3E1C308E6FC7AF485863C2A6018233B1EEFE74B9E6DA7D877BFAB33179DC9CE4A8BEF4B4C397B24538EB92F560FEAE710C805B557F4794B70
Malicious:	false
Preview:	MDMP..a..... .......+^.f.........................................0..........T.......8...........T............ ..........................................................................................................eJ......d.......GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA54.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.7017915365627116
Encrypted:	false
SSDEEP:	192:R6l7wVeJBMA6b6YNZSU9x3zgmfbvpBa89bevsfUSqm:R6lXJ16b6YzSU9xDgmfbzeUfUG
MD5:	60570BC04861069E866C4D52911BF4AA
SHA1:	46530C96929B86E2D9AA3D1DE18EC97DB2964D94
SHA-256:	F2B337AA32F7DBFEEAA9C690C32D864C7D47DFA0032ED373428CCE8DA5A27C9B
SHA-512:	3F27C2A16340313D20E6ACDB41D03D49E233297D7956FDE8747BD5FA9B3E354072D0893D0F5A8D49F7489983DC558A8442CA32147B32A06E767A5925CCD09A40
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAA3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.492333177976846
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYPYm8M4J2QzeFTQ+q8vBz3Jc0aIeMd:uIjf+I7Ms7V3JPbKBb20aIeMd
MD5:	A7AAC36F2CA1098BA39EF5C2A6687A56
SHA1:	22C37451BAFD69D068283531D689BCE5878D1F4C
SHA-256:	2295AF28F8902C050A16456F2869F0FC42761DA6A2010952B286FF062E674EEE
SHA-512:	2F77639A96B01285072AECC1298C856BFC397650CF0F51A2409CFB73591BEC4560560F65B50883466A6702A824B9A648DED49DFD5342BF3CBCA58AD72B71321A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD03.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87284
Entropy (8bit):	1.9209426052838885
Encrypted:	false
SSDEEP:	384:JBVLihf37YdHuIW744MxKeGE4gTampR0YDl/4Ix:nVOJEIIWEBxKBE4Id
MD5:	6568323307558CCB1409BC0DC42EB22D
SHA1:	56AFD02DAF9BFF4406CB945FC7C165B60EE1AD89
SHA-256:	DCEB52AF7BB2E00F6F1C8F791E2C1BA10798049DCED1C40088FF4747AC2D9E12
SHA-512:	8231E06213ED461ACCC6F293105E1A70892B5D984B4FC5227C34C80CD9AACF7114EDD4134B1D3044C0558877D4C70088080606002C87727C11449A3422537289
Malicious:	false
Preview:	MDMP..a..... .......,^.f............T...............\.......D....6..........T.......8...........T............"..\2..........@...........,...............................................................................eJ..............GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDA0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.7014513450877953
Encrypted:	false
SSDEEP:	192:R6l7wVeJBD6OaH6YNISU9x3zgmfbvpBT89bevsfUqm:R6lXJF6OaH6YSSU9xDgmfbUeUfI
MD5:	1B99F22A2F5C88DA86F875EE0B092601
SHA1:	5620E6F94087015801B65ECBB19BFCC619359A96
SHA-256:	19BB6D31F9C7846A509A0F7F167ADC0409C7FA4DBBF58DB338B7EF74F888ADF5
SHA-512:	C196824E2D10151641358AADA62EEE4658294AC9205AE0CD447793205231BEEDECD2C4CB077A69D4B2071F7632F92AA22B5C2D9A7409BDA8ABD0533F5B83EB99
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDD0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.496172187413912
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VY7Ym8M4J2QzeFr+q8vBz3Jc0aIeMd:uIjf+I7Ms7VDJPMKBb20aIeMd
MD5:	E454336C238BA176336BFA68D81EFA16
SHA1:	D9782B03B17C2E4463BED26598499CD3BB3DA82A
SHA-256:	E343BD5D0A658CA4251EAD69DB1974B3CAF5C4050832497676D59213228FE328
SHA-512:	14DCEBDA5A9DA815C277FDDBB45157C6A21C03F9FA8B89071D581646742ED55D30B732EED5523EB0BF27099B9B1AC6DCEE4CF383C4463935337ADE18D65F184A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2B0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	86860
Entropy (8bit):	1.9307409813396958
Encrypted:	false
SSDEEP:	384:xFLihf37w/cIJvx84wWKeGE4gTamIJ+69B:jOJlIJveRWKBE4IGT
MD5:	2CF0A4A242F9DB2F92C48160B5B83B1B
SHA1:	CF70849C8881CB868DB5D43209A26F0304763513
SHA-256:	CACB1B01C470BA19D7C22723D072557E1CFA821019B70C6CF2842DF1FD3E61AE
SHA-512:	A9879E89AF53007036BC817833177ED3C6864890EAE357FCAA6EF0D9FC02D4DBC008D5CD81CB3E21169E532991C188E71FA322FA8C0721E53CCA68CB706338E3
Malicious:	false
Preview:	MDMP..a..... ........^.f............T...............\.......T....6..........T.......8...........T............"...0..........@...........,...............................................................................eJ..............GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC58F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.703232722343376
Encrypted:	false
SSDEEP:	192:R6l7wVeJBR6r6YNOSU9xGdgmfbvpBG89bQvsfdQm:R6lXJ36r6YUSU9xEgmfbfQUff
MD5:	BC6B8560FAB759504724506D8D90ABDD
SHA1:	C71C14100B344098DA10CB32C71A53B4EFEE0E1C
SHA-256:	30AD33C80E109830963D7DF91D99DCE94C8FF869727596E737EF0A7B04553866
SHA-512:	B7ED5F6535D44CF62BC4621EAB687BECE58CBFCDEE0CB0440CE708E2427A7D1F1BAD9B07A5DB65D8A223D22C187EA8E7CFB26B5D517E07A8868259A740D1E895
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5BF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.495369818026928
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYtYm8M4J2QzeFlf+q8vBz3Jc0aIeMd:uIjf+I7Ms7VpJPwfKBb20aIeMd
MD5:	D2024123EE327E283056CDF4D650AE5D
SHA1:	1977A66A51B0D8FC8EE936E635448EA0CF292AEB
SHA-256:	3B9DF879817C6DFD7935D1DD7B164539B5B98ED759A42509F9D9E3C8DD943C0C
SHA-512:	21A4F4D5483B84C2182AB817F460BDBDA7245A78A818C4485929B683DEC16F1884DBFB5E238A5FDCAC57FC0BA7F11034BD0D8FF2660A5FD22B3FB2AB6028A062
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC957.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94642
Entropy (8bit):	1.9270229657606568
Encrypted:	false
SSDEEP:	384:RFrCi0cUIQdImuVWwB30UwbncV7QpGE4gTD+5utN53C3zsa743ojIN1rMTkuPa13:3eixcIrVWw0dbncV7QUE4IFJC4mc
MD5:	B8138C443CE8A60B5D03B5EA48737205
SHA1:	B2FA640FFB9DB96FA6810672D3BA850687999195
SHA-256:	916A423FEE1C806BC07D8AF48D5E3C66FBA473D2F23EAC6FDF77F1F28BA4BFA3
SHA-512:	A0F32B291C66AE10FFF61CE2A1DDE63A26C193C43A1F9657540281DB3F87A502FCD2A3878F256FC57B0AD5E87A09066B20CB43AE5334A0D337A80320F0DCA213
Malicious:	false
Preview:	MDMP..a..... ......./^.f.........................................:..........T.......8...........T............*.."G..........H...........4...............................................................................eJ..............GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.701048145853574
Encrypted:	false
SSDEEP:	192:R6l7wVeJB86i6YN1SU95ndgmfbvpBG89bfvsff1m:R6lXJa6i6YPSU95dgmfbffUfQ
MD5:	D04A2980465EDE2508B71F13B752AD40
SHA1:	09E181315238F6EDF0B2A6E2DA4E48CFB95CDC29
SHA-256:	AE7F9824AE1393C30C09525EDEDBBC55EC09F0BCD72656470294CEBC421180D9
SHA-512:	76DD0F8317B655FB4AB3CFCB19CCDB9A67AA6BCC27D982D034C6BEED0B2A9CDDBF22FAB059CBB1221021332265EF1AF7F9BAA87475C3DA4D973DFDE98021A17A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA72.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.494242685978608
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYpYm8M4J2QzeF6aN+q8vBz3Jc0aIeMd:uIjf+I7Ms7VRJPBaNKBb20aIeMd
MD5:	DAD7C4F431561E3497B3163570F82F66
SHA1:	B6254E150BE3591E67BBFED49F4E97B113F982E9
SHA-256:	1AABD08EB24CE964DCE9DF13EB6EAA318A211506AFBC7F4F994C497F4609E953
SHA-512:	C10728E9F897606047FBC8AE303B0A00F6C77C6FA6A333DF9BFE15FDF18CA423407C7A2B7CB940BF06447C0E9E98017AC0B3D142A9C80EC686F385A9BE09EE33
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD00.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	107576
Entropy (8bit):	2.022187378475692
Encrypted:	false
SSDEEP:	384:dMsraRVhU7kII2sryb5RZJi0M788L6cV7QpGE4gTZ+7FK1Myw7yjiC:WsGrFIIXroRq0u88GcV7QUE4ISyRr
MD5:	FE7FB9E5CF53AF2A737650F8748CD0DC
SHA1:	C0CB8A40371CF1C208AC9EEA8522E71664D3FED2
SHA-256:	02B63E007DCA2075AABE72CC2C587D92FC37E3F23EF64D22B9ED56B22E80EDD4
SHA-512:	C610D2A9388BF6805EF04F3095AB90A7C2D913EBA4AB762AF1E6DE7EA1BD657A646BAAE619EB16B6AC7CBA144B125E8FDFBDAADD80EAA0371E31D3F9F85C6714
Malicious:	false
Preview:	MDMP..a..... .......0^.f.........................................>..........T.......8...........T............0..hs..........P...........<...............................................................................eJ..............GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCFA1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.7017213220655503
Encrypted:	false
SSDEEP:	192:R6l7wVeJB56T6YNFSU95ndgmfbvpB+89bWvsfuym:R6lXJf6T6YvSU95dgmfbnWUfS
MD5:	B041B3C52B4F614BFB8870EA2B63C1CB
SHA1:	DB5E59C578EF4D12F28EE7C2CCD49176D13D8345
SHA-256:	80D207BFDA9975685AC2E5356B0F533690F0BEF5344172D3782E14F132FA34F8
SHA-512:	2E139C1FB4D45070513EC883E18DF62585EF6F526A4E55B81979F572BC265C0697B29949DE95B12BA04091C6A34C25786C675C580E830833D6FF44320ECD8EF5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD148.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.491870917250897
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VY/wYm8M4J2QzeFY+q8vBz3Jc0aIeMd:uIjf+I7Ms7VQdJPbKBb20aIeMd
MD5:	AE9916CE98F2C0236C7714E981EFAA59
SHA1:	6A8BAAC2E36522DE09C8189BE15132AF9CF5C3A5
SHA-256:	BC12A0B44E417C4EF605F89223A6F453F7D115028B54300DEEE3E8DE1DEA21B0
SHA-512:	0E2FCCFF71384E55315112FE910E4D7A3AC6F65D5CCB6178803869ACECFAE4CFA52927CA08BC0B48418CBB8416A8C463A5E5654E30CFDF15F27491DC88C7112B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7CE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	122960
Entropy (8bit):	2.1038654655867473
Encrypted:	false
SSDEEP:	768:pOWHBb2I8v0JU2nfGcV7QUE4I7lNygC7:Fhb20JU6ecV7CF7lNq
MD5:	38F8A9589022FCAD14893AB3E87F7720
SHA1:	D8F9DD3E470150847E531CC911C438AF4398E624
SHA-256:	7B4EB72BCB91A43FA79F65787BF6ACB0BABD67F6AF15CFF859D5D04730F86EB5
SHA-512:	2B93759DEE3898C431DB594849C7009995A407A5BBD5FC50532A479FD7832E74202EEB1045DD12F692F1D03ED35DD84C56A50F89E4B7732F67F68E2D0A731A44
Malicious:	false
Preview:	MDMP..a..... .......3^.f.........................................I..........T.......8...........T...........(B..(............!...........#..............................................................................eJ......X$......GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD89A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.70263045840651
Encrypted:	false
SSDEEP:	192:R6l7wVeJB06j6YNaSU9fkdgmfbvpBT89bkvsf9Mm:R6lXJi6j6YgSU9fWgmfbUkUfD
MD5:	24D0DB9AF8722B1E9E9F8D56836B4985
SHA1:	0FC78D9F4B6C46291C01137415EE3EA708E071E3
SHA-256:	6D52D6520AEBCAC2654C26E603727D14520D134737F6E9E579038045E35908E2
SHA-512:	6E40EAB296FA8410CB2456745FFFBF092A4F3E03C6E47168008E9A8002167F1AA9C43EEE9962ED579DFB65884DE0475F100503570E6F0EA438FB045F7A427F38
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8CA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.494585105936563
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYEYm8M4J2QzeFTL+q8vBz3Jc0aIeMd:uIjf+I7Ms7VkJP4KBb20aIeMd
MD5:	2264EC9EC6C676F27F1F05D25FC7314C
SHA1:	5765B40BB8FA87F508C048611616D5DD5A72975C
SHA-256:	FA94669D2AF322200CF9D1C54735E55084EB1A4B4F9D919325B4EC4BE2341B35
SHA-512:	2B07C64DD01003F59D4A608579775D3C0CCC361F073E75BDA163FA4D557A19B8E51738722EC0ECFA48E895D9EF76F923309A21C649AF63E87E06199BF272D15F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE29C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	121902
Entropy (8bit):	2.0961189402592613
Encrypted:	false
SSDEEP:	384:k6Ozn5/T/0WI87zjmi88H1xEQ4af4i+B/Thwefv5KCNw11pmwoyb1:TO7hYWI8f38Y1xEAf49RxKRJ/
MD5:	8621EBEA165748C2B37D44E1DA7E6E81
SHA1:	5B29497252DA56A4EA6CF0689942F60A76DA80C6
SHA-256:	B78920E5BE819D29A255575D220D1882FA6A8BA7D0B5645C3B11DECE5E942602
SHA-512:	018570BDA6E998617A174E50B9C3A6CE0F8823E21A8740DA8A9E469CEF48FE2EC98FE140BB5D8EA8A897C9A9D252BCE54A5E013E4FC446D2BA494384DB4D1DC1
Malicious:	false
Preview:	MDMP..a..... .......6^.f........................H...........$....Q..........T.......8...........T...........xQ..............d%..........P'..............................................................................eJ.......'......GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE339.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.7020177473478797
Encrypted:	false
SSDEEP:	192:R6l7wVeJB06IlpWY6YN6SUr5cgmfbvpB589bJvsfzDm:R6lXJi6IDWY6YASUrigmfbmJUfm
MD5:	1D4EFDBB89DE3E26A2F08D3571CE6133
SHA1:	69EAADC1423E7061BD73B91AD9786075DDF8DBC9
SHA-256:	5B5FAE0606B9E6AF80B593D65D398E4B2FBD5D7232D901488184ED3D670147E3
SHA-512:	EF855FE73E55B52B197CEA4C1184B6F83ECEE6DE096D815967F72A09742C4A171CAFAFCBFE08C23015CDFAF70B4917BC439C62D70F54CA32FA035700FD2ABA81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE369.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.493027384086704
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYwYm8M4J2QzeFd+q8vBz3Jc0aIeMd:uIjf+I7Ms7VYJPCKBb20aIeMd
MD5:	BED1EBF07BDE4083436CA3949582A89D
SHA1:	5A0EFF9E13FA83FD1BA53C1497E48BFF75504783
SHA-256:	CE6048F88BB8BEDDDDA3198402EEF31624765B2D43EA6E6B0BC437D872DE9137
SHA-512:	CB57E8CF4CF107ACDC07D4C81ED26B2F717CFFC94C550D1B89E1EE0DA97EAE424B055C2639C7683BAA39DF1104BB97C09F0A73740A099B5668CCB09CC4A21811
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6C2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	133492
Entropy (8bit):	2.2090106957037214
Encrypted:	false
SSDEEP:	768:0Cekhauyk+I8uqA9PIygjuOC98B1wf48ek+n5KWVvjn:0ahfFauQ28BqhekO5KWvj
MD5:	39D769DE3986A1B1F1C791D53E36DEF4
SHA1:	0D38C4028B18A0D993F8241C8BC93AA912B2180E
SHA-256:	CC46564F5F59BB76D70615233D300CF148F0BB1B3BB74703DA6AD24A00DD6255
SHA-512:	A813D4B90CFAA82759F51861D41541719045CC3A28C3F693A2D4E3797634A7A8EFFF4C913075BA1F54E541CDD80F656FB83CEAA42E93B5AB6A1E5C582D8A1433
Malicious:	false
Preview:	MDMP..a..... .......7^.f............D...............L............U..........T.......8...........T...........`U...............&...........(..............................................................................eJ......\)......GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7AE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8420
Entropy (8bit):	3.701504480087811
Encrypted:	false
SSDEEP:	192:R6l7wVeJBq6I0IU6YNQSU/5cgmfbvpBP89bAvsfuAm:R6lXJc6I0T6YaSU/igmfbAAUfQ
MD5:	670EB85233CBE9468847C0034CDAE0CC
SHA1:	6BBCA69C65285CAD287871849ED84B8C342CC796
SHA-256:	7DA55B2DF9E6613106CEDCEFE7E1B4E490A520DAE519F1BAEEE9A5DCC25D02FA
SHA-512:	93400FB5869D94E95ABDFC1626440368975582E1F877A7A0FE340AEA2AE160701ED690AAD68A35595657091CBB0FE3C9C7C2856C1089C6B74DEC335EA62B37A5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7DD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.492684251265756
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYvYm8M4J2QzeFxMm+q8vBz3Jc0aIeMd:uIjf+I7Ms7V7JPsBKBb20aIeMd
MD5:	34CF8005DAAEF6DF9942C166257E563C
SHA1:	19017A09BB5936673C29228136AA817CF39FDDB2
SHA-256:	BA4C73ACCEB485712EDF9665142228AB10E02071DFF5F3D9EC8999E3AD74CD61
SHA-512:	3EFF3F6B14DB6FB120BC69DF90B9E8F94E4BA5013EF0CB421E94B1EA5299CD4FD92161DBD8E9E50AD19DE047543B9EB686A8CF8D3B787DC200C5987146CC1BD9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	3.7288522216081446
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbRvl6y8YOnCFXmSv5aMOUO89bhNsfT7Lm:R6l7wVeJRvl6y8YbvpBO89bhNsfT7Lm
MD5:	89F23950356A3FC2EA7D5122B8766CF5
SHA1:	40940844DDFD72485ABD6670D5122F9676964D1B
SHA-256:	B87C41D18EE92CA2ACF988D20EDB05AE7E17F6F1B2C7BD9116456A8C360A683B
SHA-512:	6BCA9F612C3BDE1CDF993188FF4D14640FA753F908700936C5E2C5DE6C8D9CDA9E42A22B01360B4A32D069A66102F283F1D7AA07A9CC1D653B10CB2D23F14CC5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF086.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	78108
Entropy (8bit):	2.0971250083822466
Encrypted:	false
SSDEEP:	384:PywLizHWG/IbxkYeL0YXrSNchi0IXGf4RTrQmG814G:PywO6eIbwYY7aco0I2f4xq
MD5:	7F9F585BEF9C35751701A4674AF2BF20
SHA1:	1029791AF02E27F408A74AF9B1953A0443537F1F
SHA-256:	720AE9C361724F1C28FFFD4CEE2BC586CC730FD1F3B79A392F6113C739DFB174
SHA-512:	1E3BA07B4AB6FF3B3ABFE06F10BF5756006C1199F9AA148A1D3AC8C3E3F2638903EA5CF3546ACE7A9339F279103974A6D95CB69113A5F442F82A21A12AC16EEC
Malicious:	false
Preview:	MDMP..a..... .......;^.f.........................................0..........T.......8...........T...........X!..........................................................................................................eJ......d.......GenuineIntel............T....... ...6^.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF27A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1099618
Entropy (8bit):	1.1214369402851128
Encrypted:	false
SSDEEP:	1536:GB9mXRxXhpc4LOnE/YuuLBB61Yx9om31Ewk:G6hxR9LsE/YNL761Yx9DA
MD5:	792A111814F909D165E7EC777042AC0A
SHA1:	83701F73A1AD7E7E09085CE5A1E422120522606D
SHA-256:	85CD24823AE3E9E06324161FC140C1C9630218C31709A3D124D22BBB6F3958D2
SHA-512:	3FBE23CB74016BD204EAAB931FFFEA7ED844B478ACFC286BAC216BC6A30A008455EF8BE4049F3BCD60DC5E6AEA38FCC70B83B3334EBB71F7B3BA4D45B4047BEC
Malicious:	false
Preview:	MDMP..a..... .......:^.f............4............"..<............;..........T.......8...........T........... Y..Bn...........)...........+..............................................................................eJ......\,......GenuineIntel............T...........(^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF374.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 15 22:22:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	76728
Entropy (8bit):	2.066180175250906
Encrypted:	false
SSDEEP:	384:5gxqMqFgjtK/PMjsZnYXJ6c1xp9P0DcEKCT7InvmF1t:6xqrFgpYPMjs1YQ4xnPycEKek4
MD5:	6D149C06C9D3C2F2417EA5C7521B39ED
SHA1:	19056360EDE1C169A1D7CA663CA79AF33AB1BF78
SHA-256:	3C1080CD09D309A3FC3FC0D5FD424475BD75C8053A5721A4CBA312B904AE6C34
SHA-512:	055919967CEFAF8BAE55653662DA5110B2FF22E96AC9FEB1D44A9FC02A4896B10273611DA78E2DF0C036AC7F891CC9E8A5809DFD81D9AC6BC7DCD83FB7C7429C
Malicious:	false
Preview:	MDMP..a..... .......:^.f....................................$..../..........T.......8...........T...........`...X.......................................................................................................eJ..............GenuineIntel............T...........8^.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF46F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8400
Entropy (8bit):	3.701509665599866
Encrypted:	false
SSDEEP:	192:R6l7wVeJqQ6eR6YxM6ngmfbvpB+89bunsfg6m:R6lXJd646Yq6ngmfbnusfc
MD5:	76BF5B72FBD1CE17E37F9DFC1B74521B
SHA1:	F3F84CCF2CE8F1C10CB4A0A8F34CDA2CB461A18F
SHA-256:	09A501F6AEF0EACCB5A755252BDEA2F8412936DF574790B0BAD0C487E5E4CC0F
SHA-512:	1F87510D8E4850F829C9B5CE13D4B48052A376ABF313F1183D83769D9815FFEB0199B0C5B1CFD52BBC0F607B040CB4D535489103F5E01F5879C9D55510908D7C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF48F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.492612356167595
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYHHYm8M4J2QzeFz+q8vBzeJc0aIe7d:uIjf+I7Ms7VEaJPQKBy20aIe7d
MD5:	78AF748D15C869616C354031A7364495
SHA1:	350E8F24610729F1ADE125B9622D2B43CFE134E7
SHA-256:	9E7FB8B915BBDDA5E8554B4475C92394EC93A3739C6D83DC6F4C5F0C2A6B749E
SHA-512:	A96445597B5BB0F6747BE6910C5EA43ABCE1BB0DB6CA2ACEBA7DCAE5A8D975C7916540A8DD348244A8E1A2A18504452F21F5FEB5A781C75F6EE5C7C64EBCA77C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB9.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.49144693710015
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYQYm8M4J2QzeF8+q8vBzYJc0aIe4d:uIjf+I7Ms7VkJP/KBM20aIe4d
MD5:	5A042E051F3708F6AB958AA379229829
SHA1:	09C61E792BD3C5BBC98F96D4DB7791B0DD8DFD7B
SHA-256:	D51B881389D934781E84519A21C76DE2D3673310D687412B1091BA90A2BF3566
SHA-512:	D890D95CDBB65378AFD00932E99817789C272F2584F1F52AD3672141A3C0B43278BDA6401AA49D875DB157F29A937BC820C4B7C87C412DFCFD1D2C1E05390FCC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE43.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8316
Entropy (8bit):	3.6991701766144915
Encrypted:	false
SSDEEP:	192:R6l7wVeJBI6P6YNQSU0YhgmfAgpD389bFvsf+RXm:R6lXJ+6P6YaSU0GgmfAFFUfn
MD5:	FD884A1997014B8C0E200B2F142E9316
SHA1:	1690F59E2C8AEE191D1BEF4EA41AD30E80062221
SHA-256:	12E6C377A6B91FE3445B69CBB870726B9C4AFD97BAB9D2F6D5DF1FE1B50E4121
SHA-512:	9038CE806E0A4EF53DEF1FCE7FDD55514D1ABA59808828DF94E7A9C56DAB62221D6930656402F3AC277886409128B03206F3EFF1DA1FFCA0BE58DBA47E6B866D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE73.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.47730316475438
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9SdWpW8VYcYm8M4J2Qzct6FO+q8b4pPjJc0aIeMd:uIjf+I7Ms7VcJPQtZG41j20aIeMd
MD5:	107F31C94E53853916125B09F03BBE10
SHA1:	2EF18E72A63D03C269805F3844677E8FD17914E7
SHA-256:	2B76964B6725480CA37F8C7E8AE2F02F99C90C7D4F5AB9157AED374C6CDBCF6C
SHA-512:	B17D20548D689C3152CCDA962ED834AFEBA7FBCAACE4BC86581F32146DCACBCFD92B527D8636DCD34C10A78795FE0A27FCCBDAFA2564926B57DC7D922246CCB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="501925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\geo[1].json

Download File

Process:	C:\Users\user\Desktop\Q3FGHfhdgU.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	411
Entropy (8bit):	4.6420780896559455
Encrypted:	false
SSDEEP:	12:Yd9wpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:YdgHD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	EDCA7C5EAEC41C2D1880B6161721C8BE
SHA1:	9A650E1C3E6B7E8858A48D55F21C10C99EBE8AC8
SHA-256:	CADED2E85735BEB1518F1C907BB108B1DCD9C481DAD682B7E0A8E1009C541065
SHA-512:	2C39E15ADEAC90FB6D8F5F87B384F86A79E15F0582A4E8618C264FEE7223958E2F51AC5FA60001F95AE215351B677D91718E551DAB655B14F532556CC2D6AA7A
Malicious:	false
Preview:	{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe

Download File

Process:	C:\Users\user\Desktop\Q3FGHfhdgU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	753152
Entropy (8bit):	7.849237928652646
Encrypted:	false
SSDEEP:	12288:T4wbKp60OwVHlsiOnNjS9zVy4sn232h2kkjo7UModgPcBJa0sQtaG4l:TLp0OwjiN25VJsnkkkk7s/tTtaGw
MD5:	E02FD1EEE5D9FC50AC508ABF6896982E
SHA1:	7C93D2E15EF9201A6F7154F924F2ACD05B62511C
SHA-256:	488FC31A56DF22EE62120505326DF0699627525C17FBDDE472437F447BA2B779
SHA-512:	1E78D958C25E41B217B0B5AC97B5FA0C643A6D8A997314D8D531372E497357E863792446BD812228D9A1B4AEC054BE3504D8337DF6515535C69EFCA0E0BD6314
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 97%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.H.:o..:o..:o..h...:o..h..Z:o......:o..:n..:o..h...:o..h...:o..h...:o..h...:o.Rich.:o.........................PE..L.....\.....................2.......i............@..........................p......................................P...a.......<.......XI...................@.............................. ...........@............................................text...m........................... ..`.rdata...C.......D..................@..@.data....n.......*..................@....tls.........`......................@....wexetoc.....p......................@....numokefW...........................@....fayecefZ...........................@....ruk....W...........................@....rsrc...X........J..................@..@.reloc..J$...@...&...X..............@..B................................................................................................................

C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Q3FGHfhdgU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416643173143902
Encrypted:	false
SSDEEP:	6144:dcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNn5+:qi58oSWIZBk2MM6AFBpo
MD5:	954C62214A329661C59421BD88BCEB48
SHA1:	257C7D91F82FED2A6DA7117D15C4536976E29FE2
SHA-256:	3A5490B62DEEA53B1B9C8FC96D182A3CB0804812360E81FA82E83EBD5667BC60
SHA-512:	8C91B73929FB81CFB41580751F3E193521EF0C6EB3123AFBEDD554187D0B8C2869676807C356765FF243644E225E3EF00FEB5A905C565247BD197E87908DD659
Malicious:	false
Preview:	regfN...N....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm2..................................................................................................................................................................................................................................................................................................................................................)M..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.849237928652646
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Q3FGHfhdgU.exe
File size:	753'152 bytes
MD5:	e02fd1eee5d9fc50ac508abf6896982e
SHA1:	7c93d2e15ef9201a6f7154f924f2acd05b62511c
SHA256:	488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779
SHA512:	1e78d958c25e41b217b0b5ac97b5fa0c643a6d8a997314d8d531372e497357e863792446bd812228d9a1b4aec054be3504d8337df6515535c69efca0e0bd6314
SSDEEP:	12288:T4wbKp60OwVHlsiOnNjS9zVy4sn232h2kkjo7UModgPcBJa0sQtaG4l:TLp0OwjiN25VJsnkkkk7s/tTtaGw
TLSH:	F8F4126275D1D033D5AA24B18051C3A98C79BC350F3A96CB7BD507BE2E283D19A3778B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.H.:o..:o..:o..h...:o..h..Z:o......:o..:n..:o..h...:o..h...:o..h...:o..h...:o.Rich.:o.........................PE..L......\...

File Icon


Icon Hash:	1b39581c74797963

Static PE Info

General

Entrypoint:	0x4069f6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, AGGRESIVE_WS_TRIM, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C9DCEB2 [Fri Mar 29 07:52:18 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	48fb5228685f2cc6aa8a303f4e4f0294

Entrypoint Preview

Instruction
call 00007F55384FA8B0h
jmp 00007F55384F171Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test eax, eax
je 00007F55384F18B4h
sub eax, 08h
cmp dword ptr [eax], 0000DDDDh
jne 00007F55384F18A9h
push eax
call 00007F55384F0DC6h
pop ecx
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
mov byte ptr [esi+0Ch], 00000000h
test eax, eax
jne 00007F55384F1905h
call 00007F55384F7D98h
mov dword ptr [esi+08h], eax
mov ecx, dword ptr [eax+6Ch]
mov dword ptr [esi], ecx
mov ecx, dword ptr [eax+68h]
mov dword ptr [esi+04h], ecx
mov ecx, dword ptr [esi]
cmp ecx, dword ptr [004B11A8h]
je 00007F55384F18B4h
mov ecx, dword ptr [004B10C0h]
test dword ptr [eax+70h], ecx
jne 00007F55384F18A9h
call 00007F55384F2E49h
mov dword ptr [esi], eax
mov eax, dword ptr [esi+04h]
cmp eax, dword ptr [004B0FC8h]
je 00007F55384F18B8h
mov eax, dword ptr [esi+08h]
mov ecx, dword ptr [004B10C0h]
test dword ptr [eax+70h], ecx
jne 00007F55384F18AAh
call 00007F55384FAAE7h
mov dword ptr [esi+04h], eax
mov eax, dword ptr [esi+08h]
test byte ptr [eax+70h], 00000002h
jne 00007F55384F18B6h
or dword ptr [eax+70h], 02h
mov byte ptr [esi+0Ch], 00000001h
jmp 00007F55384F18ACh
mov ecx, dword ptr [eax]
mov dword ptr [esi], ecx
mov eax, dword ptr [eax+04h]
mov dword ptr [esi+04h], eax
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 14h
mov eax, dword ptr [004B0488h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
push esi
xor ebx, ebx

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[EXP] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1e350	0x61	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d9d4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x4958	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x134000	0x12a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1c820	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1c7d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18d6d	0x18e00	c2a452539340f8bafc5fa9441f5a5368	False	0.5855743561557789	data	6.73798479963453	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x43b1	0x4400	f5fcb97442d02daccdd23e10cb033987	False	0.37890625	data	5.318209813551272	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0xa6ee8	0x92a00	cef0bebe0b6ba3fab5eea50be2da6cf2	False	0.9916513480392157	data	7.992603020634233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xc6000	0x9	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.wexetoc	0xc7000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.numokef	0xc8000	0x357	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.fayecef	0xc9000	0x15a	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ruk	0xca000	0x157	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xcb000	0x68958	0x4a00	a60495d31e0e79d3c977a1b9a8276ff1	False	0.6686021959459459	data	5.998084889945786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x134000	0x244a	0x2600	2f2636e8e6a5596c1da905213a2c35c8	False	0.4068667763157895	data	4.112415230356127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb2d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Farsi	Iran	0.7476012793176973
RT_ICON	0xcb2d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Farsi	Afganistan	0.7476012793176973
RT_ICON	0xcb2d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Farsi	Tajikistan	0.7476012793176973
RT_ICON	0xcb2d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Farsi	Uzbekistan	0.7476012793176973
RT_ICON	0xcc178	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Farsi	Iran	0.788594470046083
RT_ICON	0xcc178	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Farsi	Afganistan	0.788594470046083
RT_ICON	0xcc178	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Farsi	Tajikistan	0.788594470046083
RT_ICON	0xcc178	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Farsi	Uzbekistan	0.788594470046083
RT_ICON	0xcc840	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Farsi	Iran	0.6886929460580913
RT_ICON	0xcc840	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Farsi	Afganistan	0.6886929460580913
RT_ICON	0xcc840	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Farsi	Tajikistan	0.6886929460580913
RT_ICON	0xcc840	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Farsi	Uzbekistan	0.6886929460580913
RT_STRING	0xceff8	0x82	data			0.6076923076923076
RT_STRING	0xcf080	0x162	StarOffice Gallery theme o, 1627417088 objects, 1st s			0.5480225988700564
RT_STRING	0xcf1e8	0x5c	data			0.6304347826086957
RT_STRING	0xcf248	0x7e	data			0.626984126984127
RT_STRING	0xcf2c8	0x444	data			0.4624542124542125
RT_STRING	0xcf710	0x248	data			0.4948630136986301
RT_ACCELERATOR	0xcee18	0x18	data	Farsi	Iran	1.2916666666666667
RT_ACCELERATOR	0xcee18	0x18	data	Farsi	Afganistan	1.2916666666666667
RT_ACCELERATOR	0xcee18	0x18	data	Farsi	Tajikistan	1.2916666666666667
RT_ACCELERATOR	0xcee18	0x18	data	Farsi	Uzbekistan	1.2916666666666667
RT_GROUP_ICON	0xcede8	0x30	data	Farsi	Iran	0.875
RT_GROUP_ICON	0xcede8	0x30	data	Farsi	Afganistan	0.875
RT_GROUP_ICON	0xcede8	0x30	data	Farsi	Tajikistan	0.875
RT_GROUP_ICON	0xcede8	0x30	data	Farsi	Uzbekistan	0.875
RT_VERSION	0xcee30	0x1c4	ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970			0.588495575221239

Imports

DLL

Import

KERNEL32.dll

SetConsoleCtrlHandler, ConnectNamedPipe, GetPrivateProfileStringA, GetQueuedCompletionStatus, WideCharToMultiByte, SetCommBreak, EnumDateFormatsExW, GetSystemWindowsDirectoryA, GetCurrentProcess, GlobalAlloc, GetFullPathNameW, ResetWriteWatch, GetProcAddress, HeapReAlloc, ReadConsoleW, lstrcpyW, SetThreadExecutionState, GetDefaultCommConfigW, GetEnvironmentVariableW, BuildCommDCBAndTimeoutsW, GetAtomNameW, GetLastError, FindNextVolumeW, GetMailslotInfo, GetTickCount, lstrlenA, lstrlenW, SetupComm, LoadResource, LoadLibraryA, CompareStringW, InterlockedIncrement, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, RaiseException, HeapFree, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlUnwind, GetStartupInfoW, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetCPInfo, HeapAlloc, GetModuleHandleA, HeapCreate, VirtualFree, VirtualAlloc, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, SetFilePointer, CloseHandle, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, HeapSize, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, SetStdHandle, FlushFileBuffers, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, ReadFile, CreateFileA

ADVAPI32.dll

IsValidSid, RegisterEventSourceW, RegQueryMultipleValuesA

Exports

Name	Ordinal	Address
@dfkvodv@0	1	0x403360
@mctraxer@0	2	0x403360

Possible Origin

Language of compilation system	Country where language is spoken	Map
Farsi	Iran
Farsi	Afganistan
Farsi	Tajikistan
Farsi	Uzbekistan

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-16T00:22:45.157930+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-16T00:22:59.584061+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49712	188.114.96.3	443	TCP
2024-09-16T00:23:03.191518+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49713	188.114.96.3	443	TCP
2024-09-16T00:23:06.839513+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49715	188.114.96.3	443	TCP
2024-09-16T00:23:10.816902+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49720	188.114.96.3	443	TCP
2024-09-16T00:23:28.718835+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49731	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 16, 2024 00:22:43.377770901 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:43.377816916 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:43.377882004 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:43.390142918 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:43.390172005 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:43.858747959 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:43.858834982 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:44.802572012 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:44.802607059 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:44.802968979 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:44.803020000 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:44.806879044 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:44.847398996 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:45.157936096 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:45.158024073 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:45.158075094 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:45.158102989 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:45.161314964 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:45.161345959 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:58.701224089 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:58.701268911 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:58.701939106 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:58.748735905 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:58.748764038 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.215106010 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.215189934 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.221188068 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.221240044 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.221570015 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.221661091 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.223349094 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.263406992 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.584058046 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.584112883 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.584136009 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.584147930 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:22:59.584168911 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.584192991 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.585094929 CEST	49712	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:22:59.585118055 CEST	443	49712	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:02.342643023 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.342696905 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:02.342786074 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.344546080 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.344557047 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:02.809043884 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:02.809113979 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.813535929 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.813548088 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:02.813858032 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:02.814040899 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.820847034 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:02.863403082 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:03.191584110 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:03.191827059 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:03.191864014 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:03.191888094 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:03.191925049 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:03.191948891 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:03.197166920 CEST	49713	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:03.197185040 CEST	443	49713	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:05.950381041 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:05.950427055 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:05.950879097 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:05.955425978 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:05.955440998 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.448621035 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.448733091 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.454217911 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.454247952 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.454571962 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.454631090 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.455893040 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.499414921 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.839521885 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.839585066 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.839611053 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.839629889 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:06.839651108 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.839673996 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.846681118 CEST	49715	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:06.846718073 CEST	443	49715	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:09.888977051 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:09.889009953 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:09.889308929 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:09.897031069 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:09.897041082 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.352878094 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.352947950 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.386790991 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.386825085 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.387195110 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.387244940 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.392420053 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.435445070 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.816900969 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.816992998 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.817002058 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:10.817047119 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.837938070 CEST	49720	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:10.837977886 CEST	443	49720	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:27.875214100 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:27.875247955 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:27.875364065 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:27.877361059 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:27.877374887 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.340234995 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.340312958 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:28.353981018 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:28.354012966 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.354259014 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.354346991 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:28.355863094 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:28.403395891 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.718839884 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.718919992 CEST	443	49731	188.114.96.3	192.168.2.7
Sep 16, 2024 00:23:28.719017982 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:28.719662905 CEST	49731	443	192.168.2.7	188.114.96.3
Sep 16, 2024 00:23:28.719685078 CEST	443	49731	188.114.96.3	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 16, 2024 00:22:43.358592987 CEST	61244	53	192.168.2.7	1.1.1.1
Sep 16, 2024 00:22:43.368545055 CEST	53	61244	1.1.1.1	192.168.2.7
Sep 16, 2024 00:23:29.206633091 CEST	57526	53	192.168.2.7	1.1.1.1
Sep 16, 2024 00:23:29.734040022 CEST	53	57526	1.1.1.1	192.168.2.7
Sep 16, 2024 00:23:35.969825983 CEST	64192	53	192.168.2.7	1.1.1.1
Sep 16, 2024 00:23:35.998195887 CEST	53	64192	1.1.1.1	192.168.2.7
Sep 16, 2024 00:23:41.032541037 CEST	51985	53	192.168.2.7	1.1.1.1
Sep 16, 2024 00:23:41.385900974 CEST	53	51985	1.1.1.1	192.168.2.7
Sep 16, 2024 00:23:46.487598896 CEST	58108	53	192.168.2.7	1.1.1.1
Sep 16, 2024 00:23:46.514930964 CEST	53	58108	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 16, 2024 00:22:43.358592987 CEST	192.168.2.7	1.1.1.1	0x2eb0	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:29.206633091 CEST	192.168.2.7	1.1.1.1	0x266e	Standard query (0)	ring2.ug	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:35.969825983 CEST	192.168.2.7	1.1.1.1	0x2a93	Standard query (0)	ring2.ug	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:41.032541037 CEST	192.168.2.7	1.1.1.1	0x368f	Standard query (0)	ring2.ug	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:46.487598896 CEST	192.168.2.7	1.1.1.1	0x5036	Standard query (0)	ring2.ug	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 16, 2024 00:22:43.368545055 CEST	1.1.1.1	192.168.2.7	0x2eb0	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:22:43.368545055 CEST	1.1.1.1	192.168.2.7	0x2eb0	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:22:49.967981100 CEST	1.1.1.1	192.168.2.7	0xe11d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:22:49.967981100 CEST	1.1.1.1	192.168.2.7	0xe11d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:29.734040022 CEST	1.1.1.1	192.168.2.7	0x266e	Name error (3)	ring2.ug	none	none	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:35.998195887 CEST	1.1.1.1	192.168.2.7	0x2a93	Name error (3)	ring2.ug	none	none	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:41.385900974 CEST	1.1.1.1	192.168.2.7	0x368f	Name error (3)	ring2.ug	none	none	A (IP address)	IN (0x0001)	false
Sep 16, 2024 00:23:46.514930964 CEST	1.1.1.1	192.168.2.7	0x5036	Name error (3)	ring2.ug	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	188.114.96.3	443	4340	C:\Users\user\Desktop\Q3FGHfhdgU.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 22:22:44 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-09-15 22:22:45 UTC	889	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 22:22:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lnZMU7isv0Qhf1k4kWkRPGB9tDufm7FgX0NPp8tUe8TWd6Fhjsf%2BSmCqb2EtsrwZKW%2FVY5ymaavsLOZg%2FDpjTtb7IqlaGmZZt6DhspZQ1drzocML3oYDoZK2fodk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3c046a5cb280d3-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 22:22:45 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-09-15 22:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49712	188.114.96.3	443	7924	C:\Users\user\Desktop\Q3FGHfhdgU.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 22:22:59 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-09-15 22:22:59 UTC	885	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 22:22:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOXrQ5PGKNDShSvL7Ka69JJpy7OpNHa9obRSQQAH4FkUyXOsp1EPGRc77TfdpJACWk8UeXR4g9JiXCZghz9cJEAjWDqbV9CnjAhE9e6nJ2%2BQnMgZdTzzFqhBUOSC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3c04c49e9f1821-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 22:22:59 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-09-15 22:22:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49713	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-09-15 22:23:02 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-09-15 22:23:03 UTC	893	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 22:23:03 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2Fy%2FvPEiZ%2Fl71Htc2v5jELCXTJSe%2FcNtKTU2OfWXbFCIkZF8UA4jrpmqESWOgaB5jkWBrP9F5kgSNCsQ4kEzolMIA3vHzf5QnsnXenjv014MWyroaQlU5kk%2FT6Of"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3c04db08e67cab-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 22:23:03 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-09-15 22:23:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49715	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-09-15 22:23:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-09-15 22:23:06 UTC	887	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 22:23:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LoHPg5h2enRgqG%2BBlr50j0OFCL2oIco63swGXwXUOs4sBjvcZPAb7WGSyvnWxkW4JPUa849rr1k6AOreevKnktBDk74uGyCYB8dzarpmRnWcFT9438r%2BkJv1PHRz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3c04f1dd940fab-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 22:23:06 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-09-15 22:23:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49720	188.114.96.3	443	7712	C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 22:23:10 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-09-15 22:23:10 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 22:23:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xIKKv28BqGwRbJRVMK%2BltSvTPYiuKKjaPK9gaq7xpcNnQQAor7bpW%2Fo%2FcVlR3KiR3g2qCBM6qBE8PWZCXuMeXF8LA2ADf3VocbO6hYdox4OSOJcR7i%2BUnG90xqTA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3c050a4b9c0c96-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 22:23:10 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-09-15 22:23:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49731	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-09-15 22:23:28 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-09-15 22:23:28 UTC	889	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 22:23:28 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHOzyI0yB%2FCdRw1GFvzVzWmLPdqLDatIP5BxCZYT4ow05sBhdqnqHv7OvrAh8%2FtjEcQ%2BKQnNbC0fYSd9Whf7HR8HsgG8LPP3eiiGO0nqaFkRthCjG3aN0YtHgAR5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3c057a9bed19cb-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 22:23:28 UTC	418	IN	Data Raw: 31 39 62 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 Data Ascii: 19b{"ip":"8.46.123.33","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c
2024-09-15 22:23:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	5
Start time:	18:22:32
Start date:	15/09/2024
Path:	C:\Users\user\Desktop\Q3FGHfhdgU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Q3FGHfhdgU.exe"
Imagebase:	0x400000
File size:	753'152 bytes
MD5 hash:	E02FD1EEE5D9FC50AC508ABF6896982E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000003.1276659217.0000000000C20000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:22:33
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 804
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:22:35
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 824
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:22:36
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 836
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:22:37
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 844
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:22:39
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1008
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:22:40
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1104
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:22:43
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1560
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:22:44
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x6b0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:22:46
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2080
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:22:46
Start date:	15/09/2024
Path:	C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\f678b272-44bb-4064-8bc4-fda6d571d3b4\Q3FGHfhdgU.exe --Task
Imagebase:	0x400000
File size:	753'152 bytes
MD5 hash:	E02FD1EEE5D9FC50AC508ABF6896982E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001C.00000002.1721419993.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001C.00000002.1720777653.000000000042B000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001C.00000003.1423002468.0000000000C10000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 97%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	18:22:47
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2160
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	18:22:47
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 848
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	18:22:48
Start date:	15/09/2024
Path:	C:\Users\user\Desktop\Q3FGHfhdgU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Q3FGHfhdgU.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	753'152 bytes
MD5 hash:	E02FD1EEE5D9FC50AC508ABF6896982E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.1707372254.0000000000A74000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000022.00000003.1449044854.0000000000C30000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	18:22:50
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2128
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	18:22:50
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 764
Imagebase:	0xf50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	55.6%
Signature Coverage:	38.9%
Total number of Nodes:	54
Total number of Limit Nodes:	8

Executed Functions

Function 008D17C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008D17EE
Module32First.KERNEL32(00000000,00000224), ref: 008D180E

Memory Dump Source

Source File: 00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp, Offset: 008D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8d1000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 641a937656e4de8e716cc66c9229081ac72a7979578f214003008f5a20cb6875
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A2F062366007157BDB207BF9A88DA6A77E8FF49725F10062AE643D11C0DB70E8454661

Function 00B0003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00B0024D

Strings

cess, xrefs: 00B0018D
kernel32.dll, xrefs: 00B0008F, 00B00095

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 7542df993745fcff554517fc2fffe42fb17577dd71943bf5a81cae2702fba6c9
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: F9526974A11229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB391DB30AE85DF14

Function 00B00DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,00B00223,?,?), ref: 00B00E02
SetErrorMode.KERNEL32(00000000,?,?,00B00223,?,?), ref: 00B00E07

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 68de513db2260e303c9ca9b1764c375080aabd5005250b2a22351784ea416c49
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 4FD0123264522CB7DB002A94DC09BCEBF5CDF05BA6F008061FB0DE91C1CBB09A4046EA

Function 0042FB64 Relevance: 1.5, APIs: 1, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ____lc_codepage_func__getenv_helper_nolock__tzset_nolock_strlen
String ID:
API String ID: 1085943652-0
Opcode ID: 3574f1bb9b332b07c93f76f9ecd54ff8338c0edd155d73770d9e1c4b5108e45d
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 3574f1bb9b332b07c93f76f9ecd54ff8338c0edd155d73770d9e1c4b5108e45d
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 008D1485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 008D14D6

Memory Dump Source

Source File: 00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp, Offset: 008D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8d1000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bc918f876501d7df7f4f929fb2d187cc4442e7b25e204d3afd90d855944d7692
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 32112B79A00208FFDB01DF98C989E99BBF5EF08751F158095F9489B362D375EA90DB80

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Heap32ListNext, xrefs: 00481DC7
CreateToolhelp32Snapshot, xrefs: 00481D67
NETAPI32.DLL, xrefs: 004819A9
LanmanWorkstation, xrefs: 00481A26
Heap32First, xrefs: 00481D8E
GetQueueStatus, xrefs: 00481C6B
NetApiBufferFree, xrefs: 004819F0
CloseToolhelp32Snapshot, xrefs: 00481D7B
Thread32Next, xrefs: 00481E13
KERNEL32.DLL, xrefs: 0048199C
CryptAcquireContextW, xrefs: 00481AD5
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Heap32ListFirst, xrefs: 00481DB4
NetStatisticsGet, xrefs: 004819E2
Process32First, xrefs: 00481DDA
$, xrefs: 00481F7E
ADVAPI32.DLL, xrefs: 00481989
CryptReleaseContext, xrefs: 00481AF6
Module32First, xrefs: 00481E26
CryptGenRandom, xrefs: 00481AE3
USER32.DLL, xrefs: 00481C31
Heap32Next, xrefs: 00481DA1
GetForegroundWindow, xrefs: 00481C4A
LanmanServer, xrefs: 00481A74
Module32Next, xrefs: 00481E39
Process32Next, xrefs: 00481DED
Thread32First, xrefs: 00481E00
GetCursorInfo, xrefs: 00481C58

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: d0c9dc36b4d04ce520009d10def5062eb759fd51e32cbd4963177faf8e1f05e5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: d0c9dc36b4d04ce520009d10def5062eb759fd51e32cbd4963177faf8e1f05e5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00B1A1E0 Relevance: 92.6, APIs: 46, Strings: 6, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 00B0D160: _memset.LIBCMT ref: 00B0D19A
Part of subcall function 00B0D160: InternetOpenW.WININET(004FFF7C,00000000,00000000,00000000,00000000), ref: 00B0D1AF
Part of subcall function 00B0D160: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B0D1F6

GetCurrentProcess.KERNEL32 ref: 00B1A214
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00B1A22A
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,00513268,?,00000000,00529228,00000000), ref: 00B1A30B
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B1A312
GetCommandLineW.KERNEL32(?,?), ref: 00B1A3B1

Part of subcall function 00B12730: CreateMutexA.KERNEL32(00000000,00000000,005043F8), ref: 00B1274E
Part of subcall function 00B12730: GetLastError.KERNEL32 ref: 00B12759
Part of subcall function 00B12730: CloseHandle.KERNEL32 ref: 00B1276C

Strings

x*P, xrefs: 00B1AF34
7P, xrefs: 00B1B3B4
x2Q, xrefs: 00B1AAA6
<, xrefs: 00B1A8CB
X1P, xrefs: 00B1A6D5
I:\5d2860c89d774.jpg, xrefs: 00B1B57F

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: FileInternetOpen$ClassCloseCommandCreateCurrentErrorHandleLastLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: <$I:\5d2860c89d774.jpg$X1P$x*P$x2Q$7P
API String ID: 2520268641-702818883
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: ea30eed12cc3139dada505cae4260c055520aeb8682d7d3046fc67775cd95a5c
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 9FD2C1705083419BD714EF24D895FDBBBE5FF94704F8009ACF48587292EB71AA89CB92

Function 00B1E8E0 Relevance: 70.7, APIs: 39, Strings: 1, Instructions: 696
stringfilenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 00B1E910

Part of subcall function 00B0C8F0: RegOpenKeyExW.ADVAPI32(80000001,004FFE08,00000000,000F003F,?), ref: 00B0C912
Part of subcall function 00B0C8F0: RegQueryValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,?), ref: 00B0C943
Part of subcall function 00B0C8F0: RegCloseKey.ADVAPI32(00000000), ref: 00B0C950

_memset.LIBCMT ref: 00B1E957

Part of subcall function 00B0C750: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B0C76B

InternetOpenW.WININET ref: 00B1E993
_wcsstr.LIBCMT ref: 00B1E9FE
lstrcpyW.KERNEL32(?,?), ref: 00B1EB5A
lstrcatW.KERNEL32(?,005044D8), ref: 00B1EB8D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B1EBA4
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00B1EBBF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1EBDC
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1EBF3
lstrlen.KERNEL32(?,00000000,00000000,000000FF), ref: 00B1EC1D
_strstr.LIBCMT ref: 00B1EC86
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1ECA9
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1ECC4
DeleteFileA.KERNEL32(?), ref: 00B1ECD2
lstrcpy.KERNEL32(?,?), ref: 00B1ECF4
lstrcpy.KERNEL32(?,?), ref: 00B1ED0A
lstrcpyW.KERNEL32(?,00000000), ref: 00B1EDAB
_malloc.LIBCMT ref: 00B1EDD6
_memset.LIBCMT ref: 00B1EDE4
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 00B1EDFE
lstrcpyW.KERNEL32(?,00000000), ref: 00B1EE06
_strstr.LIBCMT ref: 00B1EE2A
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1EE50
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1EE74
DeleteFileA.KERNEL32(?), ref: 00B1EE82
lstrlenW.KERNEL32(?), ref: 00B1EE8E
lstrcpyW.KERNEL32(?,00000000), ref: 00B1EF7A
_malloc.LIBCMT ref: 00B1EFA5
_memset.LIBCMT ref: 00B1EFB3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 00B1EFCD
lstrcpyW.KERNEL32(?,00000000), ref: 00B1EFD5
lstrlenW.KERNEL32(?), ref: 00B1EFF3
lstrlenW.KERNEL32(?), ref: 00B1EFFE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1F023
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1F047
DeleteFileA.KERNEL32(?), ref: 00B1F055
_free.LIBCMT ref: 00B1F065
_free.LIBCMT ref: 00B1F072

Strings

", xrefs: 00B1EEF0

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$lstrcpy$Folder$AppendFilelstrlen$DeleteInternetOpen_memset$ByteCharMultiWide_free_malloc_strstr$CloseQueryReadTimeValue_wcsstrlstrcattime
String ID: "
API String ID: 3037119233-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 03a4e896df0e741d9f03578dfb4bfe1ae64dfeb6443ef1af560a8bbe8aeedac3
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: A442D371508341ABDB20DF24DC49BDB7BE8BF85304F4409ACF98997192DB74D689CBA2

Function 004391F6 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 773COMMON

Download Yara Rule

APIs

__cftof.LIBCMT ref: 004393CD
__aulldvrm.LIBCMT ref: 00439A47
_write_multi_char.LIBCMT ref: 00439BC4
_write_string.LIBCMT ref: 00439BED
_write_multi_char.LIBCMT ref: 00439C0F
__cftof.LIBCMT ref: 00439C47
_write_string.LIBCMT ref: 00439C78
_write_string.LIBCMT ref: 00439CAC
_write_multi_char.LIBCMT ref: 00439CD8

Strings

, xrefs: 00439B84
g, xrefs: 00439731

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _write_multi_char_write_string$__cftof$__aulldvrm
String ID: $g
API String ID: 3487108997-3845294767
Opcode ID: 3674d438f0f3e93fb6af946fbe31acf64ae890128c108ee0610b87ba3d76b2bd
Instruction ID: 779344a1c95b5f3aeef4d63f9698a70ca82f0baf9f213eb6bca70eeefbd9f604
Opcode Fuzzy Hash: 3674d438f0f3e93fb6af946fbe31acf64ae890128c108ee0610b87ba3d76b2bd
Instruction Fuzzy Hash: 0C52C371905218CFEB259B18CC447AAB7F1FB58310F28A1DBD489A7390DBB99D81CF84

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 939964852-1805842116
Opcode ID: a15a1525fa9131f69cb06d7fba4762e921f22c98714f4bcadf025483b776ef82
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: a15a1525fa9131f69cb06d7fba4762e921f22c98714f4bcadf025483b776ef82
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 00B11210 Relevance: 24.1, APIs: 16, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00B11260
__CxxThrowException@8.LIBCMT ref: 00B11276

Part of subcall function 00B3111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B23DEC,?,0050793C,?,00000001), ref: 00B3116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00B1128B
__CxxThrowException@8.LIBCMT ref: 00B112A1
lstrlen.KERNEL32(?,00000000), ref: 00B112A9
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00B112B4
__CxxThrowException@8.LIBCMT ref: 00B112CA
__CxxThrowException@8.LIBCMT ref: 00B112FB
_memset.LIBCMT ref: 00B1131A
__CxxThrowException@8.LIBCMT ref: 00B11340
_malloc.LIBCMT ref: 00B11350
_memset.LIBCMT ref: 00B1135B
_sprintf.LIBCMT ref: 00B1137E
lstrcat.KERNEL32(?,?), ref: 00B1138C
CryptDestroyHash.ADVAPI32(00000000), ref: 00B113A4
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00B113AF

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Context_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID:
API String ID: 2261035504-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 8a90ec94ee727a7a9c5f91fcd26a4ff2cd71fdefdcfa4d94944e947908c97e6d
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 8E514971D40219ABDB11EFA4EC86FEFBBB8FB04740F100465FA05F6191EB746A018BA5

Function 00B81B70 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 587
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00B81BD3
FreeLibrary.KERNEL32(?), ref: 00B81D15
FreeLibrary.KERNEL32(?), ref: 00B81E65
LoadLibraryA.KERNEL32(004F6CF4), ref: 00B81E86
FreeLibrary.KERNEL32(?), ref: 00B81F95
GetTickCount.KERNEL32 ref: 00B82153
GetTickCount.KERNEL32 ref: 00B82241
GetTickCount.KERNEL32 ref: 00B822B6

Strings

$, xrefs: 00B821CE

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Library$CountFreeTick$LoadVersion
String ID: $
API String ID: 3930474377-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 7e71d73a57b5f23f8b30a067db35183ad2554bf75f59197dbeb10f7b7987c962
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: B0325FB0E0022D9ADF60AF64CC45BAEB7B9FF45700F0445EAE60CA6191DB748E84CF59

Function 00B0D490 Relevance: 23.2, APIs: 15, Instructions: 702comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B0D4BC
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B0D4DF
CoCreateInstance.COMBASE(004D506C,00000000,00000001,004D4FEC,?), ref: 00B0D525
VariantClear.OLEAUT32(?), ref: 00B0D5E7
VariantClear.OLEAUT32(?), ref: 00B0D5F4
VariantClear.OLEAUT32(?), ref: 00B0D601
VariantClear.OLEAUT32(?), ref: 00B0D612
CoUninitialize.COMBASE ref: 00B0D625

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ClearVariant$Initialize$CreateInstanceSecurityUninitialize
String ID:
API String ID: 464164406-0
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 72604db1698bfe0432389466d5be212147312440ff27f7924cc76db07f61b813
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 6F524E70E00219DFDB50DBA4C884FAEBBF5FF49704F148198E509AB291DB71AE45CBA0

Function 00B0F980 Relevance: 21.7, APIs: 14, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 6c07354a0092f411ca6cf04fe413c32f68879dcc5354bf9c1a5d00f9d53ecb7a
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 9E52A171D00209DBDF20DFA8D885BEEBBF5FF14304F5041A9E419A7291E771AA89CB91

Function 00B103B0 Relevance: 18.7, APIs: 12, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 1bba9171007d29d0f756936a54fa13a6951ccb00e1242e473e7cd5446a194fd1
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 63429D70D10208DBDF14EFA4D985BDEB7F5FF14308F6041A9E409A7291EB71AA85CBA1

Function 00B1BD30 Relevance: 18.3, APIs: 12, Instructions: 320nativewindowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 00B1BD99
NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00B1BE0A
_malloc.LIBCMT ref: 00B1BE34
GetComputerNameW.KERNEL32(00000000,?), ref: 00B1BE44
_free.LIBCMT ref: 00B1BF27

Part of subcall function 00B11F20: RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00B11F62
Part of subcall function 00B11F20: _memset.LIBCMT ref: 00B11F8B
Part of subcall function 00B11F20: RegQueryValueExW.ADVAPI32(?,004FFE5C,00000000,?,?,00000400), ref: 00B11FB3
Part of subcall function 00B11F20: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00B11FBC
Part of subcall function 00B11F20: lstrlen.KERNEL32(005002EC,?,?), ref: 00B12026
Part of subcall function 00B11F20: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00B12098

IsWindow.USER32(?), ref: 00B1C1B9
DestroyWindow.USER32(?), ref: 00B1C1CB
NtdllDefWindowProc_W.NTDLL(?,00008003,?,?), ref: 00B1C1F8

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Window$NtdllProc_$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3527213737-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 2db855241f87148c35e45163d18c13860f1b6c8e7775daea07ccc4cd7d4dc297
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: BAC1D371548380EFDB20DF24DC49B9ABBE0FF85314F54496DF889932A2D7719898CB52

Function 00B0EAC0 Relevance: 18.2, APIs: 12, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 00B0EB1E
__CxxThrowException@8.LIBCMT ref: 00B0EB34

Part of subcall function 00B3111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B23DEC,?,0050793C,?,00000001), ref: 00B3116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00B0EB49
__CxxThrowException@8.LIBCMT ref: 00B0EB5F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 00B0EB78
__CxxThrowException@8.LIBCMT ref: 00B0EB8E
__CxxThrowException@8.LIBCMT ref: 00B0EBBF
_memset.LIBCMT ref: 00B0EBDE
__CxxThrowException@8.LIBCMT ref: 00B0EC04
_sprintf.LIBCMT ref: 00B0EC23

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$Crypt$Hash$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID:
API String ID: 3953910439-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 61f5b6524e564d7efd4781f68b8c85e1168e5ed905b46168838ab853b3779a5f
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 52516DB1D40209ABEF11DFA4DC86FEEBBB8EB04700F200465FA15B61C1D775AA458BA5

Function 00B0ECF0 Relevance: 18.2, APIs: 12, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 00B0ED51
__CxxThrowException@8.LIBCMT ref: 00B0ED67

Part of subcall function 00B3111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B23DEC,?,0050793C,?,00000001), ref: 00B3116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00B0ED7C
__CxxThrowException@8.LIBCMT ref: 00B0ED92
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 00B0ED9E
__CxxThrowException@8.LIBCMT ref: 00B0EDB4
__CxxThrowException@8.LIBCMT ref: 00B0EDE5
_memset.LIBCMT ref: 00B0EE04
__CxxThrowException@8.LIBCMT ref: 00B0EE2A
_sprintf.LIBCMT ref: 00B0EE44
CryptDestroyHash.ADVAPI32(00000000), ref: 00B0EE94
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00B0EE9F

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Context$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID:
API String ID: 1770977381-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 908f8d525d515d91ae55f24744c25dd216d8848ca3cfe317b5c03036423b4922
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 35515F71D40209ABDF11DFA5DC46FEEBBB8FB08704F200569FA05B61C1D774AA058BA4

Function 00B0E8C0 Relevance: 18.1, APIs: 12, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B0E8CF

Part of subcall function 00B20EB2: __FF_MSGBANNER.LIBCMT ref: 00B20EC9
Part of subcall function 00B20EB2: __NMSG_WRITE.LIBCMT ref: 00B20ED0
Part of subcall function 00B20EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B20EF5

_malloc.LIBCMT ref: 00B0E8DB
_wprintf.LIBCMT ref: 00B0E8EE
_free.LIBCMT ref: 00B0E8F4

Part of subcall function 00B20E3D: HeapFree.KERNEL32(00000000,00000000,?,00B252CF,00000000,00B2545D,00B20F39), ref: 00B20E51
Part of subcall function 00B20E3D: GetLastError.KERNEL32(00000000,?,00B252CF,00000000,00B2545D,00B20F39), ref: 00B20E63

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00B0E909
_free.LIBCMT ref: 00B0E915
_malloc.LIBCMT ref: 00B0E91D
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00B0E930
_sprintf.LIBCMT ref: 00B0E970
_wprintf.LIBCMT ref: 00B0E982
_wprintf.LIBCMT ref: 00B0E98C
_free.LIBCMT ref: 00B0E995

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID:
API String ID: 3901070236-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 613025d417d5b20a62bd699b6ed1bdabaf97ba9aa6e45d23327704ec7e0cdcad
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 6111E772D006743AC66173B56C02EFF7AEC9F45711F0408E9FB9CE1182EA589A1493B2

Function 00B0FDE8 Relevance: 13.8, APIs: 9, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 00B0FE25
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 00B0FEB3
_malloc.LIBCMT ref: 00B0FEC2
lstrcpyW.KERNEL32(00000000,?), ref: 00B0FEDC
lstrcatW.KERNEL32(00000000,?), ref: 00B0FEF5
_free.LIBCMT ref: 00B0FF27

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloclstrcatlstrcpy
String ID:
API String ID: 742760126-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: 8c6e877e3cc9192e6357f8f70e4b6f52dc0ea7062936e16d39c64b3c0884772e
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: CEB16C70D10219DADB20EFA4DC85BEEBBF5FF15304F5040A9E409A7292EB319A89CF55

Function 00B0D160 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228networkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0D19A
InternetOpenW.WININET(004FFF7C,00000000,00000000,00000000,00000000), ref: 00B0D1AF
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B0D1F6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 00B0D21D

Strings

$, xrefs: 00B0D392
, xrefs: 00B0D38B
(, xrefs: 00B0D399

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Internet$Open$FileRead_memset
String ID: $$$(
API String ID: 1444302772-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 8e27240ca17443042e455b9c4f96cb2787796615d45bd2f1aed2106e06dbc8c2
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 5891BE70D00218DBEF20CBA4DC4ABEEBBF4AF05304F2441A8E515772D1DBB65A88CB65

Function 00B11B50 Relevance: 12.1, APIs: 8, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00B11B65
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00B11B82
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00B11BA6
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00B11BB2
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00B11BF3
_memset.LIBCMT ref: 00B11C08
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 00B11C2C

Part of subcall function 00B12DF0: lstrlenW.KERNEL32(?), ref: 00B12E19

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocErrorFormatLastLocalMessage_memsetlstrcpylstrcpyn
String ID:
API String ID: 656605479-0
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: e9f3822e2fa36aa151da67650368fc00376f1d6866b537e7fa03d17fb612d67c
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 49210531A40218FBD7516BA59C8AFAE7A78EB85B11F1000A4FB08B61D0DE741D819BE9

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 164af0fc3c1cebefd05d87cea4567ea6b2c2e140d54bf1c05fb7af81252cf02b
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 164af0fc3c1cebefd05d87cea4567ea6b2c2e140d54bf1c05fb7af81252cf02b
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 00B384F2 Relevance: 6.1, APIs: 4, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00B38509
_wcscmp.LIBCMT ref: 00B3851A
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00B38536
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00B38560

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID:
API String ID: 1351282208-0
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: 61920e903d493859cb01947aa2e1c15699f9cbb4067b37c5b23c803442dbf1a3
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: 8D01C031240205BBDB109E18DC82FEA33D8EB24B60F2180A2F50CDB060EF60DB418795

Function 0046B0D0 Relevance: 5.4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

Strings

gfff, xrefs: 0046B11A
...................., xrefs: 0046B221
You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html, xrefs: 0046B58F
.\crypto\rand\md_rand.c, xrefs: 0046B143, 0046B159, 0046B176, 0046B2B4, 0046B50B, 0046B54A, 0046B57F

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: ....................$.\crypto\rand\md_rand.c$You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html$gfff
API String ID: 0-3960724764
Opcode ID: 1dbb0a0b0e169cc974855134dbe36ac22f307b2cb5df9217aa824aef98807aa2
Instruction ID: 1c72c1dbeef18bec71d5527a1a20f23b8155c6d031f039a8833c718c9f3e7aa4
Opcode Fuzzy Hash: 1dbb0a0b0e169cc974855134dbe36ac22f307b2cb5df9217aa824aef98807aa2
Instruction Fuzzy Hash: 91D13A31A083C45AD310AF768882B9BBBE4AF59704F040D2FF9D5D7243E768D4998B97

Function 0046B209 Relevance: 4.0, Strings: 3, Instructions: 293COMMON

Download Yara Rule

Strings

...................., xrefs: 0046B221
You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html, xrefs: 0046B58F
.\crypto\rand\md_rand.c, xrefs: 0046B2B4, 0046B50B, 0046B54A, 0046B57F

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: ....................$.\crypto\rand\md_rand.c$You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html
API String ID: 0-2083530453
Opcode ID: 99738049c5b88e2218731c5c72ce27c976d2569eff7fa66779de8246e11df378
Instruction ID: a2ebd8ea25edbb22338c2015d4d6775e5aa41e2438485ddc8f771bdfda6b588c
Opcode Fuzzy Hash: 99738049c5b88e2218731c5c72ce27c976d2569eff7fa66779de8246e11df378
Instruction Fuzzy Hash: 51A10731A083C45AD310AF768881B9BBBE49F59704F040D2FFAD6D7243E668D4998B97

Function 0046AC20 Relevance: 4.0, Strings: 3, Instructions: 250COMMON

Download Yara Rule

Strings

D+Q, xrefs: 0046AEE0
gfff, xrefs: 0046AD49
.\crypto\rand\md_rand.c, xrefs: 0046AC63, 0046AC89, 0046ACB2, 0046AD7C, 0046AEC9, 0046AF3E

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\rand\md_rand.c$D+Q$gfff
API String ID: 0-2303755974
Opcode ID: 3a1fb28b3a121d7b9b8b7a411a73e2472b4910110095115a9f884e45e6b7dfae
Instruction ID: 8f8f4d8f895064480638f80618644951c2f8f2268ce1f49380362015487a19c9
Opcode Fuzzy Hash: 3a1fb28b3a121d7b9b8b7a411a73e2472b4910110095115a9f884e45e6b7dfae
Instruction Fuzzy Hash: C781F871A083445BD304EF69DC42B9B77E8EB98708F00492FF945EB282F768D5588B97

Function 00B0092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 00B009DC, 00B009DF, 00B009E4
l, xrefs: 00B00966
., xrefs: 00B0095F

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ab417fe44c35a1b0f449e14a6ebf762ed44077bfdf660c63e51642ee01a5ce11
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 8F318AB6910609DFDB10DF99C880BAEBBF9FF08324F24418AD841A7351D771EA45CBA4

Function 00B243B8 Relevance: 3.1, APIs: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B243ED
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00B244A2

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID:
API String ID: 2328436684-0
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: 44f4b1eba358d17ee78b53fa3c5d6c2cff5884d3401c2621a13791edabe777b9
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 0131B47591122C9BCB21DF24E9887CDB7F8EF08310F5052EAE81CA6651EB349F858F45

Function 00B113C8 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00B113E0
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00B113F0

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: 44cb8d7af7e794a84d5eaa8e9bbf0c6f4acb34b910a86273a056afdbee66b889
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: 9BE0ECB4F00306A7DF10DBBAAC89FAB76E8BB04745F840460F615E2640DB28E8408629

Function 00B0ECA1 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00B0ECB9
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00B0ECC9

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: e57c4c3d33516af17ba2a3c215b062ae9938fbcbcc3ab33116ff17f29a3f9dd3
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: CEE04C74F0024597EF20DBB69D89B6A76ECFB08745F444864F815F22C5D629D8018925

Function 00B0EEB8 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00B0EED0
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00B0EEE0

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: df7befdb6f92fe30fc4c1d66ad1859de0b65b4aa1434d580a62b7e8c3ef7149b
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 21E04C74F0420A97EF60DFB6DD49F6B7AECBB14745F444864F515F2281D628E8018629

Function 00B32C3C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00B244B6,?,?,?,00000001), ref: 00B32C41
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00B32C4A

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?), ref: 004329FA

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Function 0046BFE0 Relevance: 2.8, Strings: 2, Instructions: 297COMMON

Download Yara Rule

Strings

.%lu, xrefs: 0046C25B
ooo, xrefs: 0046C260, 0046C266

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .%lu$ooo
API String ID: 0-166504061
Opcode ID: 297d1f8fde068470a79cb55c9b97be9892fd080a0d339e70b795d8df3049b050
Instruction ID: 12ec3914585c8a074eb26a39b0149d3fa8def95d427499550f2b1ba8ffb48b67
Opcode Fuzzy Hash: 297d1f8fde068470a79cb55c9b97be9892fd080a0d339e70b795d8df3049b050
Instruction Fuzzy Hash: 7D913772A083018BD7209EA598D173BB7E4AF95304F44096FFCC593342FB69D9098A9B

Function 0040C070 Relevance: 2.8, Strings: 2, Instructions: 280COMMON

Download Yara Rule

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 0-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 004870B0 Relevance: 2.0, Strings: 1, Instructions: 791COMMON

Download Yara Rule

Strings

.\crypto\ec\ec_mult.c, xrefs: 00487116, 004871AD, 004871CF, 0048726F, 0048729F, 004872BA, 004872D5, 004872E7, 00487450, 00487571, 00487603, 0048762B, 0048764E, 0048772E, 004877B9, 00487A72

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\ec\ec_mult.c
API String ID: 0-660504448
Opcode ID: 3dd1aec7c6a0d9f1da5454ae67cf6ca72be492ea43a0b6105a994991b3719b02
Instruction ID: 45bbf90c44119e445ba391644e39ecd09313cb57dc49c11f2461ec7e59dba25c
Opcode Fuzzy Hash: 3dd1aec7c6a0d9f1da5454ae67cf6ca72be492ea43a0b6105a994991b3719b02
Instruction Fuzzy Hash: BA529D71A0C3019BD710EF69C891A1FB7E0AF84744F240C2EF995A7351E779E905CB9A

Function 00477BB0 Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

.\crypto\pkcs7\pk7_doit.c, xrefs: 00477C4E, 00477C7E, 00477D24, 00477F93

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\pkcs7\pk7_doit.c
API String ID: 0-3703027278
Opcode ID: 5c52ca15cea37edce38dac0b511b0287fc0e01327e75e1a3329671f7f2de1350
Instruction ID: 3292d28ed10b4befcef55f0a2eab787c39ee10a7c1943aea50417e5bb0546643
Opcode Fuzzy Hash: 5c52ca15cea37edce38dac0b511b0287fc0e01327e75e1a3329671f7f2de1350
Instruction Fuzzy Hash: B0B1E5B1A083015FD710EF25DD42B5B73E8AF54708F84486FF94D97252E629E9048B9B

Function 0046E2E0 Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

.\crypto\asn1\a_object.c, xrefs: 0046E365, 0046E4F3, 0046E59F, 0046E5B0, 0046E5C1, 0046E5D2, 0046E655

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\asn1\a_object.c
API String ID: 0-1678179117
Opcode ID: dbf0df1da57e3ad2ba6dd9e642d536eef230612b58fcc9f1d7efe4d745c60cd7
Instruction ID: b349925cfe8d7e94b26de6330c4a7b88a7b2bf93ccce95f6aecbf69505e2a379
Opcode Fuzzy Hash: dbf0df1da57e3ad2ba6dd9e642d536eef230612b58fcc9f1d7efe4d745c60cd7
Instruction Fuzzy Hash: FEA12B79A043019BD720DE669881B3FB7D0AFA5719F44042FFC4697352FB28D9058B9B

Function 00468A70 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

.\crypto\rsa\rsa_oaep.c, xrefs: 00468AF2, 00468AFF, 00468D43, 00468D5F, 00468D8B

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\rsa\rsa_oaep.c
API String ID: 0-3887057465
Opcode ID: 376f902b1f74dd7fa70da59b47702032152cc382da78932ad4ff539b0a3dca36
Instruction ID: d3e4cf2cb0b6af71cf7bd002a6b369e47ce05a80d8f82a9b698a6d3cb9ec74aa
Opcode Fuzzy Hash: 376f902b1f74dd7fa70da59b47702032152cc382da78932ad4ff539b0a3dca36
Instruction Fuzzy Hash: F3A12971A043455BD710DF29CC41BAFB7E4AFD5708F040A2EFA85D7292FA78990487A7

Function 00B38A18 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(004387B4,00000001,?,00B3790C,0043775A,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00B38A46

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 76856dd23a8d71a9a59fa0d60a1051abde5b3be4023d9c7dc77f759e2ff7a53d
Instruction ID: 7ae1a0bcca13e5c226b5e4fc44e9db9e7952b07a9b4948290461790cb92a3ce4
Opcode Fuzzy Hash: 76856dd23a8d71a9a59fa0d60a1051abde5b3be4023d9c7dc77f759e2ff7a53d
Instruction Fuzzy Hash: 4AE04632140308BBCF21CFA0EC41B983BA6AB58711F104465F61C4A960CBB1A964AB48

Function 004387C8 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(004387B4,00000001,?,004376BC,0043775A,00000003,00000000), ref: 004387F6

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 76856dd23a8d71a9a59fa0d60a1051abde5b3be4023d9c7dc77f759e2ff7a53d
Instruction ID: e2c19f37e5f1fa56fd16d2c75426893bf8b780345540c0397aa12dc95392e8cd
Opcode Fuzzy Hash: 76856dd23a8d71a9a59fa0d60a1051abde5b3be4023d9c7dc77f759e2ff7a53d
Instruction Fuzzy Hash: 4DE08C32150308FBCF21CFA0EC41FD83BA6BB58710F104419F61C4AA60CB71A964EB48

Function 00B38A9E Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,00B2C31D,?,?,?,00000002), ref: 00B38AC5

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 226e58c457aad325719b948ae6d91a641da7dcd0d883941e63e1cbc8cb95818f
Instruction ID: e0359eaa705f694ac01f833cd4fb0dea6a8089eaf080292d747b4791a934f474
Opcode Fuzzy Hash: 226e58c457aad325719b948ae6d91a641da7dcd0d883941e63e1cbc8cb95818f
Instruction Fuzzy Hash: EDD01732000208FF8F019FE0EC45C6A3BA9FB08310B140445F90C45520DA32A834EB66

Function 0043884E Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,0042C0CD,?,?,?,00000002), ref: 00438875

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c8fd9b3d3767aec0a51b62ebf5f05fdf7a2ea5e766c85915e140363299b4f200
Instruction ID: 4201596fe771204303fc80694ffa3c51b65a798dd9aa63856d52ff29377aa1ed
Opcode Fuzzy Hash: c8fd9b3d3767aec0a51b62ebf5f05fdf7a2ea5e766c85915e140363299b4f200
Instruction Fuzzy Hash: 7ED0173200020CFF8F01AFE1EC45C6A7B69FF0C314B180409FA1C45120DA36A820EB25

Function 00B32C0B Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00B31FF6,00431D5B), ref: 00B32C11

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Function 004687F0 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

.\crypto\rsa\rsa_oaep.c, xrefs: 00468831, 0046885E, 004688EE, 00468908

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\rsa\rsa_oaep.c
API String ID: 0-3887057465
Opcode ID: d069adac73065d471d25a825e8ac27893f6a8be17b6942fa2c0feb60fa74b54a
Instruction ID: b08f727342a3a8c0bee966adb2bf56101593b7141ced5e294988dda9a5cee267
Opcode Fuzzy Hash: d069adac73065d471d25a825e8ac27893f6a8be17b6942fa2c0feb60fa74b54a
Instruction Fuzzy Hash: B1716D71B043051BD710AB3DCC42BAB7794AFD4348F44062FF9859B292FA69E509839B

Function 00B056A7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 5db6cdec976afdfc444f7ecce2a1312dcbb7553e57ef442b57558c45ba7fe89a
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 7742AF71629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Function 00405457 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 12dc41f5204b819c6de09e3277dcbc51b0cd2b4360b2e0eb725200a29fa1d5ac
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 2B42AF71629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Function 00496780 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2a970270b59ebbb8f92985afda4c5ad8367b6b3e2432174551bc8d9ea206d9
Instruction ID: fceec53b77ad25fe049f5bab679b11fcbb8254e30c4d6050791c11ca3865cdcc
Opcode Fuzzy Hash: 9e2a970270b59ebbb8f92985afda4c5ad8367b6b3e2432174551bc8d9ea206d9
Instruction Fuzzy Hash: 6F121411315FC58FD315CA7DC89025AFE92ABAA200B8C8A7DE4C6DBB83C514F919C7E1

Function 00B098D6 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: ed069516f904a59709c7fa7c375bed5bd750248975d014f7c77429dc787f28e9
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: B922E176904B168FC714CF19D08055AFBE1FF88324F158A6EE8A9A7B51C730BA55CF81

Function 00409686 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 0a70c7497a2a57246437f4284b71f6c44b6655f6e65f58b690be51a05330869f
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 3022EFB6904B028FC714CF19D18055AF7E1FF88324F158A2EE8A9A7B51C734BA55CF85

Function 00B02410 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 004021C0 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 00B02DD0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 447d9a91b2d605ff4f8b4811332d45ccc333f4a46b5bd7b680ea72fa5af2b8c1
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 78028B711187058FC756EF0CD49035AF7E1FFC8309F198A2DD68987A60E739AA198F82

Function 00402B80 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 15947b6c3721e59d0fe8962aa19f0a8dab8abef4ed30c2548e5a0ab933ec52cb
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: B0029B711087058FC756EE0CD49031AF3E1FFC8309F19893DD68997AA4E739AA198F86

Function 00B08280 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: e33e0b0090ae25bd18cc8e1b2ac959d5ddefcb9db525ff1b0a52a92e9ba0593e
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 87C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 00408030 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: f6d7a372aef5befaa9ab8cae1b8e866d44a41b6196c34007c1dc93d534c5e1c5
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: B7C12833E2477906D764DEAE8D500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 00B0A960 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: efd107b338dc50ab83d898fc2710ee71466a6aba31ae0c42b5be69279d3453f3
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 0AA1DB0A8090E4ABEF455A7E80B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 0040A710 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: e860a63083750337effb18e539a22bba23e2c33b801c9e422b930a4700f084e4
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 7BA1EA0A8090E4ABEF455A7E80B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 00435240 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 03e618a9aaee4999908fb9cd69f8ac82b759301476547c7e12a249d93893b2bc
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 67C1F6322094930ADF1D463AC43117FFAA16EA57B171A275FD8B3CB6C4EF28D524C664

Function 00435675 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 110fc3d8e3289f2de2aab8ca7cdbb353600e28ddb9487b76c8dd162e0e1c3f89
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 5EC1F53220949349DF2D463AC43113FBBA16E967B1B0A276FD4B2CB6C4EF18D524D664

Function 00B029A0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 00402750 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 00434E0B Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 14e2127f22e4f50ba689086665bf74ce8f4aad625ca5d057df4c8e0ce200988b
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: A2C1D3322090930ADF2D463AC43117FFAA16AE67B171A276FD4B3CB6C4EF18D524D664

Function 004349F3 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 7f9d78cd87d97e665d725d835d678d0b0490cea1dc0f281cd861a3bbe5489e0c
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 28C1D63220909309DF2D463AC4311BFFAA16AE67B171A275FD4B3CB6C4EF18E524D564

Function 00B0C2C0 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: a8aa6d25ac6c8cfa1528b562e33581d5235dc1fea5e6435d43b899e634fd27f2
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 7EC17DB5E003599FCB54CFA9C885ADEFBF1FF48300F24856AE919E7201E334AA558B54

Function 00B05697 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 9a0f4f2d540d974d6825330c9d40facfcc1efb3f286a7379669847cf7adcefd5
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 69B1A66003AFA686CBD3FF30911024BF7E0BFC525DF44094AD99986864EF3EE94E9215

Function 00405447 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 8cc2199a165a562169f7ecbf6999e2fef0f18f66bad012de800e797bc2d371c6
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: D3B18460039FA686CBD3FF30911024BF7E0BFC525DF44094AD99996864EB3EE94E9215

Function 00496150 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1076e3de1860f1da88080676fb30845b5d7f926eaf862ba88bd98df6461948e2
Instruction ID: 9e85d3bffe525fe75bbb218e78ecbba79e012cbdb649c8dada2ef1d65ba74922
Opcode Fuzzy Hash: 1076e3de1860f1da88080676fb30845b5d7f926eaf862ba88bd98df6461948e2
Instruction Fuzzy Hash: B3A1FF2171A6C79FC31D8E6D48805A9FF60BB7610074887DEE885EF783C514EA99C7E2

Function 00B06DD0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: b803cc8af8f1e90aa28a484bef21d0079a2902b2843cb2004fb5ea2c88d66246
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 9C912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E4697D0

Function 00406B80 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 53cc368bcb446cd42ad9529d453d51aa1bb7d475ea8118e90b31e97192f47ed7
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 369115739187BA06D7609EAE8C441B9B6E3AFC4210F9B0776DD9467282C9709E0697D0

Function 00B0C010 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: ed5e8a209edd0ebf52f430c12a56291fbfb756ad708989427d9f201e7b5fe06c
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: EDB16AB5E002199FCB84CFE9C885ADEFBF0FF48214F64816AD919E7301E334AA558B54

Function 0040BDC0 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: dd0030fd0a7875149aee9059f6285016d8f613d36493dd9a45a836b4a4b814ec
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 83B16BB5E002199FCB84DFE9C985ADEFBF0FF48210F64816AD515E7301E334AA558B54

Function 00B0A1C6 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: e78fd14b86a9f341a447e617a4ec12e78b2f249a428dc23e388aed0962364e92
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 8E71D473A20B254B8714DEB98D94192F2F1EF84610B57C27CCE85E7B41EB31B95A96C0

Function 00409F76 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 74b7297904588ebaa6ab1c5df3583e9d586d3ac2a89db25a5709110100e2d33a
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 4C71D473A20B254B8714DEB98D94192F2F1EF88610B57C27DCE84E7B41EB31BD5A96C0

Function 004A6550 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8ab83184bbf6eae4fdf9bf57c9d169c4bc5f104da84b782ac5c5b443a26518
Instruction ID: 7f1e944e1ee5b00cf3f39ed4a9633e5a088d7ee1ffe565f0bec4e2a17916981f
Opcode Fuzzy Hash: 0e8ab83184bbf6eae4fdf9bf57c9d169c4bc5f104da84b782ac5c5b443a26518
Instruction Fuzzy Hash: 3871EE356106068FDB14CF28C880726B7E2FFE6314F5A456ED9568B395E738ED0ACB81

Function 00B052A7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 9ad299c8b9194534f3e70d84655390513ed8101eb9b3bf72d90a269eb51dcf20
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: B78126B2A047019FC328CF19D88566BF7E1FFD8210F15892DE99A83B41D770F8558B92

Function 00405057 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: e3c2a017dd6badd9714311eea86c864eeb0421fb574ba0955e6d85605a7693db
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: F38137B2A047019FC328CF19D88566BF3E1FFD8210F15892EE99A93B40D770F8558A92

Function 00B08710 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: cd33e41055be11df4425051b5fed8e67eb23d04e7c646c049e545fce511714c7
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: F071F422535B7A0AEBC3DA3D885046BE7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Function 004084C0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 973606295ae52b7844e7c35d371e9ca4fcc074182ff58c16dbea1c31bcbf3ed1
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: B371E422535B7A0AEBC3DA3D885046BF7D0BE4910AB85095ADCD0F3181D72EDE4E77A4

Function 00409CF9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 245603f09c670fc9cc06d8cbe5191dd1f272ebddcf45c93c0bd57830841b11c0
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: AA815875A10B669BD714CF2AD8C045AFBF1FB08310B518A3AD89583B81D338F961DF94

Function 00B089D0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 1792e6f0cca3f0421ab59761f64830edaa23efcbe4029adb9bdaa7689308f4a3
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: E661A33390467B5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 00408780 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: eb5f8a68be8f5ba1f77d73b6cfc90761462ff0b2d3c76a4cc6d82de228f99981
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: B861A33390467B5BDB649E6DD8401A9B7A2BFC4310F5B8A76DC9823642C234EA11DBD0

Function 00B07330 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: eca8745bc26187b44baf37e312fbab713fc1ff79089fc4a58b1e23e92818218d
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 70617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642CB34F9119AC4

Function 004070E0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: ddda33d882aa0bc509a49eedb89f55d50321a200eee9a62c9bb3f9e1a1ff7f76
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 81617C3791262B9BD761DF59D84537AB3A2EFC4360F6B8A358C0427642C734F9119AC4

Function 00458110 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001472641a09b6bd79b707b4f716f19135f0dc6ab40226326b0e7ceb2e01e033
Instruction ID: d8fd3e6b6b8cabc9ec6a10df23f334cfb0651a4bda809948c6f89302a1929b9b
Opcode Fuzzy Hash: 001472641a09b6bd79b707b4f716f19135f0dc6ab40226326b0e7ceb2e01e033
Instruction Fuzzy Hash: 3251C036A05A018FC728CF29D492956F7E2FF8C310716C5ADE84A9B725DB34FA15CB84

Function 00B07130 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 47f81353738278bc810210b1b5b1492a63db8f06b4146ccc26bd4da5c6ab7393
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: E851DD329257B946EBC3DA3D88504AEBBE0BE49206B460557DCD0B3181C72EDE4DB7E4

Function 00406EE0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 4672b28f6a6bf8f4344f83f0830caeee8163c048b15d37234af557155bfedee2
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 6051DE229257B945EBC3DA3D88504AEBBE0BE49206B460557DCD0B3181C72EDE4DB7E4

Function 004A85B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91da4bc188a11ec5597461e4dd5dbeadd1112cf4aa891ec709a6e44e97ef8b21
Instruction ID: 3d558f919f40558a2bb83d912b74f5d6480479b7873367d0077c950ff97ec649
Opcode Fuzzy Hash: 91da4bc188a11ec5597461e4dd5dbeadd1112cf4aa891ec709a6e44e97ef8b21
Instruction Fuzzy Hash: BF4119226663854EEB09416C04423DA2F12EB7B358F5CC6AED844CF3C7D51BCA1BE386

Function 00B06AD0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 00406880 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 00495CA0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc010f79417680e9d144fce1f63f2476ab01a2dcf659e9af5c7c8309c1a0c54
Instruction ID: 12f9ea60d0f69408099c8400c1950d8b05f1e5723b843ea31dc8e3541daf09f8
Opcode Fuzzy Hash: 8bc010f79417680e9d144fce1f63f2476ab01a2dcf659e9af5c7c8309c1a0c54
Instruction Fuzzy Hash: 314151612193D29FC70E8E6D48806A6FF646F66100B4886DEECC4EF387C514D6A9C7F5

Function 00B06990 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 00406740 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 00B06C43 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: c3fee7fc6f1a3ed40df4d7e83c6c4da8d4ddba061bca29986f01a0ae2b65c873
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: EC31F2706183459FD741EF29C880A4BFBE4FFC8254F05DA59F9889B261D730ED848A62

Function 00406A00 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07245ce3fe1886065405c2d9f10d40f60ff713eed2a00f35c44cb8e6d4891cd2
Instruction ID: 9be1b94b6d9b027f81d748654aed723852b57a0394b650738f5722617e1ac87c
Opcode Fuzzy Hash: 07245ce3fe1886065405c2d9f10d40f60ff713eed2a00f35c44cb8e6d4891cd2
Instruction Fuzzy Hash: 193106716183419FD341EF2AC88094BF7E5FFC9258F02C92EF989A7261D734E9848A52

Function 00B21180 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 2eda7b7874610ba9dca59f997f2a3d52dd6895f9ebc9064f711cc6aa4b214003
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F3115E7724007183D614CA6EF8F46BBA7E5EBF632272C4BF6D24A9B748C13295519500

Function 00B0A8B0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: c8a7ebceb1a6d91dd9a1d01e7b7d8553bf7ff7460a41af343ca53fd58f2adaf8
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 9A114F0A8492C4BDCF424A7840E56EBFFA58E37258F4A71DAC8C44B743D01B150FE7A1

Function 0040A660 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 12798de650c464c34aa3778ce5e64fe04281c395c40e5146a0d3500761537530
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 7E113D0A8492C4BDCF424A7840E56EBEFA58E37218F4A71DA88C45B753D01B190FE7A1

Function 008D10A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709213142.00000000008D1000.00000040.00000020.00020000.00000000.sdmp, Offset: 008D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8d1000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 7e0f4e191cfdabaa0016baac6b5e238b39c41a8ffcd840ef8ae121e1f086e730
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1C117C72340100AFDB54DE59DC85EA673EAFF89360B298166ED08CB316E676EC42C760

Function 00B00D90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 393018de0bb91036e0644652fff5171431eae9109f5cee150703412dbfbe736b
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: 7DF0C276A205049FDB21EFA4C805BAE77F9FB94315F0442F5DC0AD7281D330E9428B60

Function 00B0A04A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: a57789add8d25392fbd28597a144a6a0bc1151bcef067197187d5bfb0e1d7791
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 270128B68107669BD700DF3EC8C045AFBE1BB082117528B2AD89083A41D334E666DBE4

Function 00409DFA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: e163d73bb3bb1c3335a9f655194f480995ee83516259669aaa46f0d203b42e4d
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: F80128768106669BD700DF3EC8C045AFBF1BB082117528B3AD89083A41D338E662DBE8

Function 00401178 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0981c63a9f74f2cef49bc96d02ddff45abf4a099554e5cdf54aba45a1097e0a9
Instruction ID: 4e82b3bf9c856ad283c1aa7fcc5662c157764fb6338ab4a3d9b9e059fef01284
Opcode Fuzzy Hash: 0981c63a9f74f2cef49bc96d02ddff45abf4a099554e5cdf54aba45a1097e0a9
Instruction Fuzzy Hash: D2C09B315002004FD735CA24DD613A273B277AB301F1588A5D1175B054D73A9015C506

Function 00B12730 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 214
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,005043F8), ref: 00B1274E
GetLastError.KERNEL32 ref: 00B12759
CloseHandle.KERNEL32 ref: 00B1276C
CreateMutexA.KERNEL32(00000000,00000000,00504420), ref: 00B127A0
GetLastError.KERNEL32 ref: 00B127AB
CloseHandle.KERNEL32 ref: 00B127BE

Strings

D, xrefs: 00B12970

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID: D
API String ID: 4294037311-2746444292
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: 15d6209358acd3a79ca0543dde75cbcfb95e952630899c0c456ecf3b79586ca9
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 9B711F72940218AADF50EBE1DC89FDE7BACFB44301F5445A6F609D2090DF759A88CF64

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: ba03a2e5e42d847be9fa1a5c62943ab4e99fec1194133577bbbb74d661dd731c
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: ba03a2e5e42d847be9fa1a5c62943ab4e99fec1194133577bbbb74d661dd731c
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00B25CE7 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00B25CFE

Part of subcall function 00B28EE6: __calloc_impl.LIBCMT ref: 00B28EF5

__calloc_crt.LIBCMT ref: 00B25D22
_free.LIBCMT ref: 00B25D30
__calloc_crt.LIBCMT ref: 00B25D3E
_free.LIBCMT ref: 00B25D4E
_free.LIBCMT ref: 00B25D54
__copytlocinfo_nolock.LIBCMT ref: 00B25D63
__setmbcp_nolock.LIBCMT ref: 00B25D84
_free.LIBCMT ref: 00B25D92
___removelocaleref.LIBCMT ref: 00B25D99
___freetlocinfo.LIBCMT ref: 00B25DA0
_free.LIBCMT ref: 00B25DA6

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: dad13fabb566356fc7e89163f2a49e38d689a267d26ee5c2e7984ad3e61e2000
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 72219235509A31AAE7317F64F806E5F7BE4DF517A0B2188A9F48C554A2EE328840DB51

Function 00469350 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 168COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00469452

Strings

dynamic, xrefs: 00469416, 0046945E
DIR_LOAD, xrefs: 00469490
OPENSSL_ENGINES, xrefs: 0046944D
.\crypto\engine\eng_list.c, xrefs: 0046935E, 0046937C, 004693FD, 004694F7
LIST_ADD, xrefs: 004694BE
id=, xrefs: 00469508
DIR_ADD, xrefs: 004694A5
LOAD, xrefs: 004694D4
C:\Build-OpenSSL-VC-32/lib/engines, xrefs: 00469459, 004694A4

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __wgetenv
String ID: .\crypto\engine\eng_list.c$C:\Build-OpenSSL-VC-32/lib/engines$DIR_ADD$DIR_LOAD$LIST_ADD$LOAD$OPENSSL_ENGINES$dynamic$id=
API String ID: 1112669753-613467719
Opcode ID: d8c12b6cecbc2a152a1438591538cd30de4b223a7f0141548b1d55cfe454f99e
Instruction ID: 93c721e730456b0751f01afdf29b9ec0f249dd5f65d46a011da8796c85f981b9
Opcode Fuzzy Hash: d8c12b6cecbc2a152a1438591538cd30de4b223a7f0141548b1d55cfe454f99e
Instruction Fuzzy Hash: E7411A6178874032EB3135361E43B671A4D4B15B4AF580457FE45AA3C3FAEEDC46829F

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 1d9b188d17e0480fd30dd7d4bf24a71c94dfac426fd36cb2f4ef340344809e2c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 1d9b188d17e0480fd30dd7d4bf24a71c94dfac426fd36cb2f4ef340344809e2c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00B4F4BC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00B4F4CF

Part of subcall function 00B30F4C: std::exception::_Copy_str.LIBCMT ref: 00B30F65

__CxxThrowException@8.LIBCMT ref: 00B4F4E4

Part of subcall function 00B3111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B23DEC,?,0050793C,?,00000001), ref: 00B3116F

std::exception::exception.LIBCMT ref: 00B4F4FD
__CxxThrowException@8.LIBCMT ref: 00B4F512
std::regex_error::regex_error.LIBCPMT ref: 00B4F524

Part of subcall function 00B4F1C4: std::exception::exception.LIBCMT ref: 00B4F1DE

__CxxThrowException@8.LIBCMT ref: 00B4F532
std::exception::exception.LIBCMT ref: 00B4F54B
__CxxThrowException@8.LIBCMT ref: 00B4F560

Strings

bad function call, xrefs: 00B4F566
leM, xrefs: 00B4F558

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call$leM
API String ID: 2464034642-307869844
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 5caa66a9f0f0e75f1e6cee8075e24b095fe92b122bb6825e60c7b486d5ebb4c0
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 2C11AA74C0020DBBCB00FFA4D456CDEBBBCAB04344F5089A6BE14A7645EB74A3488B94

Function 00B237C6 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B23801

Part of subcall function 00B25458: __getptd_noexit.LIBCMT ref: 00B25458

__gmtime64_s.LIBCMT ref: 00B2389A
__gmtime64_s.LIBCMT ref: 00B238D0
__gmtime64_s.LIBCMT ref: 00B238ED
__allrem.LIBCMT ref: 00B23943
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B2395F
__allrem.LIBCMT ref: 00B23976
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B23994
__allrem.LIBCMT ref: 00B239AB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B239C9
__invoke_watson.LIBCMT ref: 00B23A3A

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 15884ca238a166d4b29a2e54a9657fa1178a2f11d9d6521ae59a188ea97e9ada
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7271DB71A00727ABD714AE69EC42B6AB3F8EF15B20F1441BAF51DD6281E774DE4087D0

Function 00B25DBE Relevance: 16.6, APIs: 11, Instructions: 131COMMON

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00B25DF7
__calloc_crt.LIBCMT ref: 00B25E48
__lock.LIBCMT ref: 00B25E5E
__copytlocinfo_nolock.LIBCMT ref: 00B25E6F
_wcscmp.LIBCMT ref: 00B25EA9
__lock.LIBCMT ref: 00B25EC0
__updatetlocinfoEx_nolock.LIBCMT ref: 00B25ED2
___removelocaleref.LIBCMT ref: 00B25ED8
__updatetlocinfoEx_nolock.LIBCMT ref: 00B25EF7

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: aff10181db78c52afe5dafe9d9aaff12697b064f94ffda9252a095af5e7f2f51
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 43413432904728AFDB20BFA4FD82B9E77E4EF04310F2040ADF51C9A192DB759A45DB11

Function 004549A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1233653401-1672312481
Opcode ID: 90c684128eb5e8e5df80e0a351cb190437495bff95dc85ab757f84aa99128f37
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 90c684128eb5e8e5df80e0a351cb190437495bff95dc85ab757f84aa99128f37
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 81d809e9d71c059113a903a7fc2c2efdb5cdf039f1f061fc9f175b130ce46ee2
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 81d809e9d71c059113a903a7fc2c2efdb5cdf039f1f061fc9f175b130ce46ee2
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00B82530 Relevance: 13.6, APIs: 9, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B54BF0: GetModuleHandleA.KERNEL32(00512A94,?,00000001,?,00B54DC2), ref: 00B54C17
Part of subcall function 00B54BF0: GetProcAddress.KERNEL32(00000000,004D742C), ref: 00B54C27
Part of subcall function 00B54BF0: GetDesktopWindow.USER32 ref: 00B54C4B
Part of subcall function 00B54BF0: GetProcessWindowStation.USER32(?,00B54DC2), ref: 00B54C51
Part of subcall function 00B54BF0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00B54DC2), ref: 00B54C6C
Part of subcall function 00B54BF0: GetLastError.KERNEL32(?,00B54DC2), ref: 00B54C7A
Part of subcall function 00B54BF0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00B54DC2), ref: 00B54CB5
Part of subcall function 00B54BF0: _wcsstr.LIBCMT ref: 00B54CDA

CreateDCA.GDI32(004F6E00,00000000,00000000,00000000), ref: 00B82566
CreateCompatibleDC.GDI32(00000000), ref: 00B82573
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 00B8259E
SelectObject.GDI32(00000000,00000000), ref: 00B825AC
GetObjectA.GDI32(00000000,00000018,?), ref: 00B825BE
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 00B8261A
GetBitmapBits.GDI32(?,?,00000000), ref: 00B82626
SelectObject.GDI32(?,?), ref: 00B82686
DeleteObject.GDI32(00000000), ref: 00B8268D

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Object$Create$BitmapCompatibleInformationSelectUserWindow$AddressBitsDeleteDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID:
API String ID: 487453144-0
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 7d7e82612eb05f6841302507285da1db4666ae3cfd3ec3816e40e2b037fcab61
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: C241C831944304EBD3106BB5DC86F2FBBF8FF89711F000969FA55962A1E77198008B96

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: 87eaa8ac1572454a83bf0067174873e4fb49b47427992fc09f83c9f4ae3a25fc
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: 87eaa8ac1572454a83bf0067174873e4fb49b47427992fc09f83c9f4ae3a25fc
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 00B54BF0 Relevance: 12.1, APIs: 8, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00512A94,?,00000001,?,00B54DC2), ref: 00B54C17
GetProcAddress.KERNEL32(00000000,004D742C), ref: 00B54C27
GetDesktopWindow.USER32 ref: 00B54C4B
GetProcessWindowStation.USER32(?,00B54DC2), ref: 00B54C51
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00B54DC2), ref: 00B54C6C
GetLastError.KERNEL32(?,00B54DC2), ref: 00B54C7A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00B54DC2), ref: 00B54CB5
_wcsstr.LIBCMT ref: 00B54CDA

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID:
API String ID: 2112994598-0
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: d0c023e4beeae3ca65f9adac8d11915139b0728c15d92c00c2ce0a797e8e0b33
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: AF31C631A00209ABDB209B79EC45BAE77F8DF94725F1042F6FC1AD71D0EB3099548B51

Function 00B54D30 Relevance: 12.1, APIs: 8, Instructions: 75registrywindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00B54E66,004D7470,004D73E0,004D73E0,004D73E0,00B54A5E,004D73E0,00000253,004D73F4,?,00B51F87,00000000,00B0CFFE,00000001,00000001), ref: 00B54D4A
GetFileType.KERNEL32(00000000,?,00B51F87,00000000,00B0CFFE,00000001,00000001), ref: 00B54D55
__vfwprintf_p.LIBCMT ref: 00B54D77

Part of subcall function 00B2C01C: _vfprintf_helper.LIBCMT ref: 00B2C02F

vswprintf.LIBCMT ref: 00B54DAD
RegisterEventSourceA.ADVAPI32(00000000,004D7458), ref: 00B54DCE
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00B54DF2
DeregisterEventSource.ADVAPI32(00000000), ref: 00B54DF9
MessageBoxA.USER32(00000000,?,004D7460,00000010), ref: 00B54E23

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID:
API String ID: 277090408-0
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: e5159734d4c61fed26687555b30a9ae338148b2a88ef8db4edf69cdc204cefa7
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 3021F571A48340ABE770AB60DC87FEB77D8EF58700F404869F69E861D1EAB494848B57

Function 00B125B0 Relevance: 12.1, APIs: 8, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?), ref: 00B125D9
_memset.LIBCMT ref: 00B12606
RegQueryValueExW.ADVAPI32(?,004FFE5C,00000000,00000001,?,00000400), ref: 00B1262E
RegCloseKey.ADVAPI32(?), ref: 00B12637
GetCommandLineW.KERNEL32 ref: 00B12644
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00B1264F
lstrcpyW.KERNEL32(?,00000000), ref: 00B1265E
lstrcmpW.KERNEL32(?,?), ref: 00B12672

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID:
API String ID: 122392481-0
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: ce7b5af6cc90c2e0f93be01ad989d1f47c5df48a653169057092c59ef1a3a46b
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: F211177294020DABDB50DFA0DC89FEAB7BCBB04705F0445A5F609E2191DBB49A889F54

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

, xrefs: 00457482
0123456789ABCDEF, xrefs: 004574D6
+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: b985b484ee475b36d1976565a89a8ed99a1b92853eca9386b18e2df1a658536a
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: b985b484ee475b36d1976565a89a8ed99a1b92853eca9386b18e2df1a658536a
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 00465110 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 004651A4
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,0000018E), ref: 00465289

Strings

.\crypto\bio\bss_file.c, xrefs: 00465284, 004652BA, 004652F3
fopen(', xrefs: 004652A9
',', xrefs: 004652A3

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorLast__setmode
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 3737066399-2085858615
Opcode ID: e849cc0089a0e95fad7d96d99632b4c14ea6f9f4e9d4ef5310eee888fbdda515
Instruction ID: 163a7161baf1eb16d028d666008b586f19609d927e015f3406657a88ab31951f
Opcode Fuzzy Hash: e849cc0089a0e95fad7d96d99632b4c14ea6f9f4e9d4ef5310eee888fbdda515
Instruction Fuzzy Hash: DB513CB37403142BD7005B99BC42BEAB394EB44B67F04017BFB44E6281E7AED915475E

Function 00B12470 Relevance: 10.6, APIs: 7, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00B12485
CommandLineToArgvW.SHELL32(00000000,?), ref: 00B12490
PathFindFileNameW.SHLWAPI(00000000), ref: 00B12498
LoadLibraryW.KERNEL32(00500374), ref: 00B124A6
LoadLibraryW.KERNEL32(005003C8), ref: 00B124E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B1254E
CloseHandle.KERNEL32(00000000), ref: 00B12597

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CommandLibraryLineLoad$ArgvCloseFileFindHandleNameOpenPathProcess
String ID:
API String ID: 3932594339-0
Opcode ID: a611d5a9879eaf53dfc826cc6aff3f8b5b2e7e35405f7696e128a603212a688a
Instruction ID: 3638c275bed2c47da54027d0ff0fed6be4aa182c854684737e9eb3685eaa2a53
Opcode Fuzzy Hash: a611d5a9879eaf53dfc826cc6aff3f8b5b2e7e35405f7696e128a603212a688a
Instruction Fuzzy Hash: 9E315071E00219AFDF11ABA59C85EEEBBB8FF49704F0144A9F504E2190DA749A418BA5

Function 00B0DD10 Relevance: 9.2, APIs: 6, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B0DD3B
CoCreateInstance.COMBASE(004D4F6C,00000000,00000001,004D4F3C,?), ref: 00B0DD5B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,004CA948,000000FF), ref: 00B0DE26
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 00B0DE33
_memset.LIBCMT ref: 00B0DE88
CoUninitialize.COMBASE ref: 00B0DEE2

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID:
API String ID: 330603062-0
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: fdb98688c1c2e3baacccab37e70faac1c28f94c72edf38178b7a475e4707e788
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: 3E510770A40209AFDB00DF94CC99FAE7BB9FF88705F208459F509AB2A0DB75A945CF54

Function 00B4193B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00B41976
__invoke_watson.LIBCMT ref: 00B419D0
_strlen.LIBCMT ref: 00B41984

Part of subcall function 00B25458: __getptd_noexit.LIBCMT ref: 00B25458

_strnlen.LIBCMT ref: 00B41A0F
__lock.LIBCMT ref: 00B41A20
__getenv_helper_nolock.LIBCMT ref: 00B41A2B

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 2a76c8b2b8129dde154066b93acc039d1fe7ad4c8dfc7d5eff910a9e7e819d5f
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 9A31E832E012356BDB217A6CAC0176E77D4DF11B21F2048D5F818DF285DF74CA8167A1

Function 00B11DE0 Relevance: 9.1, APIs: 6, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B11E00
CoCreateInstance.COMBASE(004CE908,00000000,00000001,004CD568,00000000), ref: 00B11E18
CoUninitialize.COMBASE ref: 00B11E20
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00B11E62
SHGetPathFromIDListW.SHELL32(?,?), ref: 00B11E72
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00B11EB8

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID:
API String ID: 2287340669-0
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: a0009b67727ba2d7645f0ff3d308efc2b3231b19cdbbc8cb7a044754d47ce74e
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: B4415D75A40209AFDB10CBA4DC88FEA7BBCEF48705F1044A9FA09D7190D7B0AE85CB50

Function 00B11C60 Relevance: 9.1, APIs: 6, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00B11C6D
OpenServiceW.ADVAPI32(00000000,00500268,00000020), ref: 00B11C82
ControlService.ADVAPI32(00000000,00000001,?), ref: 00B11C96
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00B11CAB
Sleep.KERNEL32(?), ref: 00B11CC5
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00B11CD0

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Service$OpenQueryStatus$ControlManagerSleep
String ID:
API String ID: 3598506262-0
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 5c11769896dffd9f091053e51043dd535c52f0bd7c749f43f07c246c783e3715
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 6E11A331641206ABDB209BD99C88FEF7BFCEB44711F440571FB04E6140DB20D981CAE4

Function 00B0F560 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(005001F8), ref: 00B0F588
GetProcAddress.KERNEL32(00000000,00500210), ref: 00B0F5A3

Strings

\, xrefs: 00B0F798

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: \
API String ID: 2574300362-2967466578
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 31b6f859174727f1e7ac0c47cf351396c9b00a05977d4297f90797bf33c7976b
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: FEC16B71E01209EADF10DFA4DD8ABEEBBF5FF14304F104069E805A7290EB759A58CB91

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 4ae76c461777ea60cd0d65a2f021a7c0ef4a2c2d17b8efed8afe2f2793f22b47
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 4ae76c461777ea60cd0d65a2f021a7c0ef4a2c2d17b8efed8afe2f2793f22b47
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 00B25591 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00B255A4

Strings

U, xrefs: 00B255AD

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: bc61d34109ebc43847791ae2e217e0dc19399837111dfd87f7be1df460958eb4
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: B8210A32644A28AFEB20AA64BC45BBE73DDDB54761F6001E5F90DCA181FF71DE408794

Function 004548D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 004548F7
_swscanf.LIBCMT ref: 0045491A

Part of subcall function 004C5F62: _vscan_fn.LIBCMT ref: 004C5F76

_strtoul.LIBCMT ref: 00454929

Part of subcall function 00431546: strtoxl.LIBCMT ref: 00431566

Strings

OPENSSL_ia32cap, xrefs: 004548E8
%I64i, xrefs: 00454914

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __wgetenv_strtoul_swscanf_vscan_fnstrtoxl
String ID: %I64i$OPENSSL_ia32cap
API String ID: 409312853-1470193844
Opcode ID: bac845e630d3a57e6badd78c933abaaffb2293c869e7eb6b0c0941ce37c6c7fd
Instruction ID: 02ad6d9c21fd5608b4e191a4842a8a74cf6c4616c263a1aa16a65e1262f920e3
Opcode Fuzzy Hash: bac845e630d3a57e6badd78c933abaaffb2293c869e7eb6b0c0941ce37c6c7fd
Instruction Fuzzy Hash: FE1102B29042116FE710DB65CC4276777D4AFD5399F08843FFC48A7266E63C8C88879A

Function 00B0C990 Relevance: 7.8, APIs: 5, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00B2122D: __wfsopen.LIBCMT ref: 00B21238

_fgetws.LIBCMT ref: 00B0CA0C
CreateDirectoryW.KERNEL32(004FFE70,00000000), ref: 00B0CB9B

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws
String ID:
API String ID: 1649371814-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: bad714f583e7b3183e7a2a246457d3c02771dcc7f26201c3b0d8a6cd8f3d26cc
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 8C919171D00219ABDF20DFA4DC867AEBFF5EF04304F1406A9E809A3291E775AE54CB95

Function 00B10E20 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00B10E62
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00B10E89
_memset.LIBCMT ref: 00B10E9C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00B10EB3

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: a9651e84458d056f9dd8210a3a35246027dfc9f4ae1c233ff268e15f4058f893
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: D791A175A18341CFD728DF28C895BABB7E1FF88700F54895DF58A87290E770A981CB52

Function 00B10CA0 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00B10CC5
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00B10D32
PathFileExistsA.SHLWAPI(?), ref: 00B10D49
SetErrorMode.KERNEL32(00000000), ref: 00B10D52
GetDriveTypeA.KERNEL32(?), ref: 00B10D6B

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: 23bd8a0d3de398c09b35d2bafa0fde2dd0d4ca304e6ca2ed475742f79c29e7ec
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: F141D271108340DFD710EF68D885B5ABBE4FB89714F900A6DF48A922E1DBB5D984CB93

Function 00B3B94F Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B3B95B

Part of subcall function 00B20EB2: __FF_MSGBANNER.LIBCMT ref: 00B20EC9
Part of subcall function 00B20EB2: __NMSG_WRITE.LIBCMT ref: 00B20ED0
Part of subcall function 00B20EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B20EF5

_free.LIBCMT ref: 00B3B96E

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: fcca72b2880a8288e117c3b3dc1918366d6ca07876b4fef4139575ef9cfa23ee
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: BA11CE32904625ABCB203B75B885F6A37D8AF14371F3046E9FB5C9A299DF3088808794

Function 00B12690 Relevance: 7.6, APIs: 5, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00B1269F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00B126B9
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B126F1
TerminateProcess.KERNEL32(00000000,00000009), ref: 00B12700
Process32NextW.KERNEL32(00000000,0000022C), ref: 00B12711

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2688562911-0
Opcode ID: f800ed1a70d164d25c801f6619c0d912ca8855511ce51469826557765f8e188c
Instruction ID: addcbd04ffaee6668060cd39d6e3b459315f6d30ff8b1d4c8767fe587811e9c3
Opcode Fuzzy Hash: f800ed1a70d164d25c801f6619c0d912ca8855511ce51469826557765f8e188c
Instruction Fuzzy Hash: 87019235501219BBE7206BA1ACC9FEF77BCEB09B50F0400A1F908D1182EA608D448BA9

Function 00B0C8F0 Relevance: 7.5, APIs: 5, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,004FFE08,00000000,000F003F,?), ref: 00B0C912
RegQueryValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,?), ref: 00B0C943
RegCloseKey.ADVAPI32(00000000), ref: 00B0C950
RegSetValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,00000004), ref: 00B0C975
RegCloseKey.ADVAPI32(00000000), ref: 00B0C97E

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID:
API String ID: 3962714758-0
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 0348f96e0dea5afa8da80d46cb64f6638f30645c87b17309d2cdddd984187ac9
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 2A112D7594020CFBDB119F91CC4AFEEBBB8EB04708F1041A5FA04B21A1D7B15B18AB98

Function 00B1E938 Relevance: 7.5, APIs: 5, Instructions: 44stringfilenetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B1E957

Part of subcall function 00B0C750: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B0C76B

InternetOpenW.WININET ref: 00B1E993
_wcsstr.LIBCMT ref: 00B1E9FE
lstrcpyW.KERNEL32(?,?), ref: 00B1EB5A
lstrcatW.KERNEL32(?,005044D8), ref: 00B1EB8D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B1EBA4
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00B1EBBF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1EBDC
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1EBF3
lstrlen.KERNEL32(?,00000000,00000000,000000FF), ref: 00B1EC1D
_strstr.LIBCMT ref: 00B1EC86
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1ECA9
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1ECC4
DeleteFileA.KERNEL32(?), ref: 00B1ECD2
lstrcpy.KERNEL32(?,?), ref: 00B1ECF4
lstrcpy.KERNEL32(?,?), ref: 00B1ED0A
lstrcpyW.KERNEL32(?,00000000), ref: 00B1EDAB
_malloc.LIBCMT ref: 00B1EDD6
_memset.LIBCMT ref: 00B1EDE4
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 00B1EDFE
lstrcpyW.KERNEL32(?,00000000), ref: 00B1EE06
_strstr.LIBCMT ref: 00B1EE2A
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1EE50
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1EE74
DeleteFileA.KERNEL32(?), ref: 00B1EE82

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$lstrcpy$Folder$AppendFileInternet$DeleteOpen_memset_strstr$ByteCharMultiReadWide_malloc_wcsstrlstrcatlstrlen
String ID:
API String ID: 2057544059-0
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: bfb52ba6dedc7a4a08980c68e7e71741e57b2d05784316cd42c4eca2b6a48e9f
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 43019E30408381ABDA70DF209C49FDF7BD8AF45744F8448A8F98882182EB74D2488BA7

Function 0040CBA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __except_handler4
String ID:  $Error encrypting message: %s$\\n
API String ID: 2000125651-3771355929
Opcode ID: 8af1f58bede3706d82a36293f76a7596179a6936843eb3dd7d644c92f66f27d8
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 8af1f58bede3706d82a36293f76a7596179a6936843eb3dd7d644c92f66f27d8
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 4a44d4e655e45bd035bad35dd1e9204a6ebf9d5eaf034f13d90d823ef41036ab
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 4a44d4e655e45bd035bad35dd1e9204a6ebf9d5eaf034f13d90d823ef41036ab
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00B1BC60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00B1BC9A
RegisterClassExW.USER32(00000030), ref: 00B1BCC3

Strings

0, xrefs: 00B1BC6D
>P, xrefs: 00B1BCB5

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$>P
API String ID: 1693014935-2710508548
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 00B1A0C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B1A108
_memset.LIBCMT ref: 00B1A119
_memset.LIBCMT ref: 00B1A12A

Strings

p2Q, xrefs: 00B1A132

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: f126d2b754d2daa2442c2ffa1ca88de763340d07e0815a6c3f27a557594dc36d
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: EFF0C068684750A5F7117B60BC26B817ED16731B04F104084E1182A2E5D7FD238C679D

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00B4F48E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00B4F4A1

Part of subcall function 00B30F4C: std::exception::_Copy_str.LIBCMT ref: 00B30F65

__CxxThrowException@8.LIBCMT ref: 00B4F4B6

Part of subcall function 00B3111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B23DEC,?,0050793C,?,00000001), ref: 00B3116F

Strings

TeM, xrefs: 00B4F497, 00B4F4AB
TeM, xrefs: 00B4F4AE

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 757275642-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: be4d2537c3a3832f578bb67a1a94b258ebc3705ff6c63af3aa55514a014103a9
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 21D06774C0020CBBCB00EFA4D49ACCDBBBCAF04344F1084A6AE14A7241EB74A3498BD4

Function 00B656D0 Relevance: 6.4, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 00B65718
GetLastError.KERNEL32(?,?,00000000), ref: 00B65724
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00B65747
GetLastError.KERNEL32(?,?,00000000), ref: 00B65753
GetLastError.KERNEL32(004E2188,000000A9,?,00000000,?,?,00000000), ref: 00B65845

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorLast$ByteCharMultiWide
String ID:
API String ID: 3361762293-0
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 026faf80228f2c1c4460cdd24b11e0eb59a8ac55fa173a0f08ac106a1e925121
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 12518971A80709BBEB306BA0DC43FBE76E8EF55701F1001A5FA05BB1C1DAA54D0186B2

Function 00B0CDF0 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 00B0D02E
_malloc.LIBCMT ref: 00B0D062
_malloc.LIBCMT ref: 00B0D071
_fprintf.LIBCMT ref: 00B0D0C5

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 565decb6755f5d1d492b6f347973f6d3e2da394d838df231421e322d9ea3fe8b
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: F2A141B1C00249DBEF11EFD4DC46BEEBFB5AF14314F5400A8E50576292D7B65A88CBA2

Function 00B22380 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B223DE
__read_nolock.LIBCMT ref: 00B224AE
__filbuf.LIBCMT ref: 00B224D1
_memset.LIBCMT ref: 00B22515

Part of subcall function 00B25458: __getptd_noexit.LIBCMT ref: 00B25458

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 2f2203c94e0e6000812a2807f593257bb64dc350c7cbbd8ce604178da82c1d98
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 5A51D430A00325EBDB24DF69A8805AE77E1EF50320F2487A9F83DD62D1D7749E508B44

Function 00B3C8C7 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B3C8FD
__isleadbyte_l.LIBCMT ref: 00B3C92B
MultiByteToWideChar.KERNEL32(?,00000009,004FFCF0,?,00000000,00000000,?,00000000,00000000,?,0000007A,004FFCF0), ref: 00B3C959
MultiByteToWideChar.KERNEL32(?,00000009,004FFCF0,00000001,00000000,00000000,?,00000000,00000000,?,0000007A,004FFCF0), ref: 00B3C98F

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 60ec93253951e6f42547deb00a6d7dacfb6887e56fef13d1bc6688688a4f3024
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: A731A131600256EFDB229EB5CC85B7A7FE9FF41310F2642A9E858E71A0D731D950D790

Function 00B0F330 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00B0F375
lstrlen.KERNEL32(?,?,00000000), ref: 00B0F3E8
WriteFile.KERNEL32(00000000,?,00000000), ref: 00B0F3F1
CloseHandle.KERNEL32(00000000), ref: 00B0F3F8

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 7ffb627d191d2ae3f6307e4143d8fb4dcb28e037210e7f22da568dde3ec34781
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: 11312532A00105EBDB249F68CC4ABEE7BB8EF04314F5041A8F906A76C0D7716A45CBA4

Function 00B0C750 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B0C76B
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B0C789

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID:
API String ID: 29327785-0
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a0749268ee2f1d3c1d433d5abb2ae592cd951ed83cd4bc71924e5cf14314bebd
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: AB11E372A8033833D92072687C87FEB77DCDB46B21F0001E6FE0CE2182A66A5A4645E5

Function 00BC72E4 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00BC72FB

Part of subcall function 00BC79F0: ___BuildCatchObjectHelper.LIBCMT ref: 00BC7A22
Part of subcall function 00BC79F0: ___AdjustPointer.LIBCMT ref: 00BC7A39

_UnwindNestedFrames.LIBCMT ref: 00BC7312
___FrameUnwindToState.LIBCMT ref: 00BC7324
CallCatchBlock.LIBCMT ref: 00BC7348

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: d4d4d56669ea9b50e3675b159739e04eae15a7706dda538c6165cd06a491de40
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011732000149BBCF126F55DD01FDA3BBAEF88754F148058FD1865121C772E8A1AFA4

Function 00B40C09 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00B40C2D

Part of subcall function 00B4134D: __fltout2.LIBCMT ref: 00B41376

__cftog_l.LIBCMT ref: 00B40C53
__cftoe_l.LIBCMT ref: 00B40C85

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 8448ce142122c0b5f88e72fb0b11c58429146b9236b13594a1a60eba94c5759c
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 20014E3645014AFBCF126E84CC818ED3FA2FF18351B588695FB5959132C236CAB1BB81

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 00B129F0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00B12A09
_malloc.LIBCMT ref: 00B12A13

Part of subcall function 00B20EB2: __FF_MSGBANNER.LIBCMT ref: 00B20EC9
Part of subcall function 00B20EB2: __NMSG_WRITE.LIBCMT ref: 00B20ED0
Part of subcall function 00B20EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B20EF5

_memset.LIBCMT ref: 00B12A1E
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 00B12A34

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 6958536ed3368997b957a4917d2c8f3e039e33750f95725a566aebdfdd28e541
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: 7DF02735701214BBE72066659C4AFABB69DEF86760F100175FA08E31C1E9A12D0152F5

Function 00B12A50 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 00B12A56
_malloc.LIBCMT ref: 00B12A64

Part of subcall function 00B20EB2: __FF_MSGBANNER.LIBCMT ref: 00B20EC9
Part of subcall function 00B20EB2: __NMSG_WRITE.LIBCMT ref: 00B20ED0
Part of subcall function 00B20EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B20EF5

_memset.LIBCMT ref: 00B12A6F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00B12A82

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: 521eddb61e35d9c8da2d8cee14501d8f5abed2d1fd4b349bf0cbc2015895d28b
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 49E08676701134BBF510235A7C8EFAB665CCBC27A1F100165F619D21D28AA41C0185B4

Function 0048BAD0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 265COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0048BB61

Strings

NO X509_NAME, xrefs: 0048BB5B
.\crypto\x509\x509_obj.c, xrefs: 0048BDB6

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: .\crypto\x509\x509_obj.c$NO X509_NAME
API String ID: 2961919466-14672339
Opcode ID: 4cc0e634c82776b8e6b8af14f13902336e58473581cafcfdb07a608ab0feec39
Instruction ID: 88de260af9a5fd1e3028375c42afa8bd5264b3a62bff26a3f98b123bcc4ba400
Opcode Fuzzy Hash: 4cc0e634c82776b8e6b8af14f13902336e58473581cafcfdb07a608ab0feec39
Instruction Fuzzy Hash: 2A91C1719083419FD721AF29C88175FB7E0EF85308F58486EF88597352D739E9058BDA

Function 0040C740 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 4241100979-54166481
Opcode ID: 0dc0c108755559449e400f96eda7fce006297efcbf55791017422bc814fc260c
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 0dc0c108755559449e400f96eda7fce006297efcbf55791017422bc814fc260c
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00480D00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

.\crypto\engine\eng_ctrl.c, xrefs: 00480D51, 00480D79, 00480D95, 00480DCE, 00480DEE, 00480E35, 00480E6D, 00480E90
C:\Build-OpenSSL-VC-32/lib/engines, xrefs: 00480D1D

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\engine\eng_ctrl.c$C:\Build-OpenSSL-VC-32/lib/engines
API String ID: 0-1539679004
Opcode ID: e15262ba6dfe6b912e9122ad7db7f925754a259673c029d2ef663e9602d74825
Instruction ID: 56032b303ab72e22bbded8e9c3d747b3a31bfef0a87394d47780a94f2346a1d3
Opcode Fuzzy Hash: e15262ba6dfe6b912e9122ad7db7f925754a259673c029d2ef663e9602d74825
Instruction Fuzzy Hash: 3341B571BD431035F6A07059AC43FBF21845B90F19F150C6BFB45B91C2E6DEA94A82AE

Function 004C5D39 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __get_sys_err_msg
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3595405529-798102604
Opcode ID: 2e3f0f1f4edf6c5a3c4510c8aaaca1f8a4a57933e5579e97063164282e05505c
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 2e3f0f1f4edf6c5a3c4510c8aaaca1f8a4a57933e5579e97063164282e05505c
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00B63240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00B632CE
_memset.LIBCMT ref: 00B632FB

Strings

Enter PEM pass phrase:, xrefs: 00B63286, 00B63293, 00B632D4

Memory Dump Source

Source File: 00000005.00000002.1709410906.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b00000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: Enter PEM pass phrase:
API String ID: 3021507156-3278253880
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 1123fa73403489fdb04e3dd9172732532793d829fbd016e0f7ff8da77a6a99f1
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 3B21CC72A003113BE720AD256C42F6B77ECDFC1BA8F044494FA5867181EB31DD0542B5

Function 0040C500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000005.00000002.1708698065.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1708698065.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1708698065.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 4241100979-54166481
Opcode ID: 5b2242606d7255293268a03623ac74f4226f4a23220726dab8e31c692a174a31
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: 5b2242606d7255293268a03623ac74f4226f4a23220726dab8e31c692a174a31
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Analysis Process: Q3FGHfhdgU.exePID: 7712, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	2

Executed Functions

Function 00AF003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00AF024D

Strings

cess, xrefs: 00AF018D
kernel32.dll, xrefs: 00AF008F, 00AF0095

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a445deda2816a09ded4a15f470f8aeae22a1167eafcf034b9c9443daac78d678
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 53525A74A01229DFDB64CF98C985BA8BBB1BF09304F1480D9E54DAB352DB30AE95DF14

Function 00A5D7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A5D7EE
Module32First.KERNEL32(00000000,00000224), ref: 00A5D80E

Memory Dump Source

Source File: 0000001C.00000002.1721419993.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_a5d000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 07cd3cb3a598bb62e114b48ecb242cd00af2fe0ad32e87e8aa068f5036db688d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 34F096312007106FD7303BF5A88DB6E76E8FF49726F100528EA42D10C0DB70EC494661

Function 00AF0DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,00AF0223,?,?), ref: 00AF0E02
SetErrorMode.KERNEL32(00000000,?,?,00AF0223,?,?), ref: 00AF0E07

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 25d4fd57ba2e3cdbc1762945d8497d25b4eaeb327222dd4f2e53a766f5824180
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B6D0123224522CB7DB002BD4DC09BDEBB1C9F05BA6F008021FB0DE9182CBB49A4046EA

Function 00A5D485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00A5D4D6

Memory Dump Source

Source File: 0000001C.00000002.1721419993.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_a5d000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 0909239ed2c4b22f43110e77d0b8c3a4b200ec18bc2f9447329c5310d8bbc27c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 0E113C79A00208EFDB01DF98CA85E99BBF5AF08351F058094F9489B362D371EA90DF80

Non-executed Functions

Function 00B01210 Relevance: 24.1, APIs: 16, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00B01260
__CxxThrowException@8.LIBCMT ref: 00B01276

Part of subcall function 00B2111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B13DEC,?,0050793C,?,00000001), ref: 00B2116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00B0128B
__CxxThrowException@8.LIBCMT ref: 00B012A1
lstrlen.KERNEL32(?,00000000), ref: 00B012A9
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00B012B4
__CxxThrowException@8.LIBCMT ref: 00B012CA
__CxxThrowException@8.LIBCMT ref: 00B012FB
_memset.LIBCMT ref: 00B0131A
__CxxThrowException@8.LIBCMT ref: 00B01340
_malloc.LIBCMT ref: 00B01350
_memset.LIBCMT ref: 00B0135B
_sprintf.LIBCMT ref: 00B0137E
lstrcat.KERNEL32(?,?), ref: 00B0138C
CryptDestroyHash.ADVAPI32(00000000), ref: 00B013A4
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00B013AF

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Context_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID:
API String ID: 2261035504-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a037d7a91dd98b66fc12094dc745e755f9af7b3c836db67a9f04ab989ac5f46b
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 12514871D40219ABDB11EFA5DC86FEFBBB8FB14740F100465FA05F6190EB746A018BA5

Function 00B0BD30 Relevance: 18.3, APIs: 12, Instructions: 320
nativewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00B0BD99
NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00B0BE0A
_malloc.LIBCMT ref: 00B0BE34
GetComputerNameW.KERNEL32(00000000,?), ref: 00B0BE44
_free.LIBCMT ref: 00B0BF27

Part of subcall function 00B01F20: RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00B01F62
Part of subcall function 00B01F20: _memset.LIBCMT ref: 00B01F8B
Part of subcall function 00B01F20: RegQueryValueExW.ADVAPI32(?,004FFE5C,00000000,?,?,00000400), ref: 00B01FB3
Part of subcall function 00B01F20: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00B01FBC
Part of subcall function 00B01F20: lstrlen.KERNEL32(005002EC,?,?), ref: 00B02026
Part of subcall function 00B01F20: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00B02098

IsWindow.USER32(?), ref: 00B0C1B9
DestroyWindow.USER32(?), ref: 00B0C1CB
NtdllDefWindowProc_W.NTDLL(?,00008003,?,?), ref: 00B0C1F8

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Window$NtdllProc_$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3527213737-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 7ff7dd80f576eeda5ea5e4c9ca81e83abf8ef3ca7d818c6baf46eea29dee0058
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 53C19C71508380AFEB20DF24D845B9ABFE4FF85314F144A6DF889972E2DB759848CB52

Function 00AFEAC0 Relevance: 18.2, APIs: 12, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 00AFEB1E
__CxxThrowException@8.LIBCMT ref: 00AFEB34

Part of subcall function 00B2111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B13DEC,?,0050793C,?,00000001), ref: 00B2116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00AFEB49
__CxxThrowException@8.LIBCMT ref: 00AFEB5F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 00AFEB78
__CxxThrowException@8.LIBCMT ref: 00AFEB8E
__CxxThrowException@8.LIBCMT ref: 00AFEBBF
_memset.LIBCMT ref: 00AFEBDE
__CxxThrowException@8.LIBCMT ref: 00AFEC04
_sprintf.LIBCMT ref: 00AFEC23

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$Crypt$Hash$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID:
API String ID: 3953910439-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: de5c8825305cda154757703066e9d14589118953ee2ecf0fa33107b5e12cc751
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 84516D7194020DAADF11DFE4DC46FFEBBB8EB14700F104425FA05B61D1E775AA058BA5

Function 00AFECF0 Relevance: 18.2, APIs: 12, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 00AFED51
__CxxThrowException@8.LIBCMT ref: 00AFED67

Part of subcall function 00B2111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B13DEC,?,0050793C,?,00000001), ref: 00B2116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00AFED7C
__CxxThrowException@8.LIBCMT ref: 00AFED92
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 00AFED9E
__CxxThrowException@8.LIBCMT ref: 00AFEDB4
__CxxThrowException@8.LIBCMT ref: 00AFEDE5
_memset.LIBCMT ref: 00AFEE04
__CxxThrowException@8.LIBCMT ref: 00AFEE2A
_sprintf.LIBCMT ref: 00AFEE44
CryptDestroyHash.ADVAPI32(00000000), ref: 00AFEE94
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00AFEE9F

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Context$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID:
API String ID: 1770977381-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 0ad049a56d1edadb3010bab54a4ca3b310bbfb7dfe6109b515441985f974a601
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A0514D71E40249BADF11DFE5DC46FFEBBB8EB18704F100029FA05B6191E7746A058BA4

Function 00AFE8C0 Relevance: 18.1, APIs: 12, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00AFE8CF

Part of subcall function 00B10EB2: __FF_MSGBANNER.LIBCMT ref: 00B10EC9
Part of subcall function 00B10EB2: __NMSG_WRITE.LIBCMT ref: 00B10ED0
Part of subcall function 00B10EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B10EF5

_malloc.LIBCMT ref: 00AFE8DB
_wprintf.LIBCMT ref: 00AFE8EE
_free.LIBCMT ref: 00AFE8F4

Part of subcall function 00B10E3D: HeapFree.KERNEL32(00000000,00000000,?,00B152CF,00000000,00B1545D,00B10F39), ref: 00B10E51
Part of subcall function 00B10E3D: GetLastError.KERNEL32(00000000,?,00B152CF,00000000,00B1545D,00B10F39), ref: 00B10E63

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00AFE909
_free.LIBCMT ref: 00AFE915
_malloc.LIBCMT ref: 00AFE91D
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00AFE930
_sprintf.LIBCMT ref: 00AFE970
_wprintf.LIBCMT ref: 00AFE982
_wprintf.LIBCMT ref: 00AFE98C
_free.LIBCMT ref: 00AFE995

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID:
API String ID: 3901070236-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1e45957f7fb23e0bf44e07c7e9ee24431d9080d9b0fc7b225cc9e5d78266de3b
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 4E11E473D006683AC661B3F65C02EFF7AEC9F46711F4404E9FB88E5181EA985A9493B1

Function 00AFFDE8 Relevance: 13.8, APIs: 9, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 00AFFE25
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 00AFFEB3
_malloc.LIBCMT ref: 00AFFEC2
lstrcpyW.KERNEL32(00000000,?), ref: 00AFFEDC
lstrcatW.KERNEL32(00000000,?), ref: 00AFFEF5
_free.LIBCMT ref: 00AFFF27

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloclstrcatlstrcpy
String ID:
API String ID: 742760126-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e99abff72ad96a59065816e4143f975b659866cf71ac421c26f1705ff5c35711
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 3EB17C70D10248DEDF24EFA4CC45BEEBBB5BF15304F5040A9E509AB291EB319A89CF55

Function 00B284F2 Relevance: 6.1, APIs: 4, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00B28509
_wcscmp.LIBCMT ref: 00B2851A
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00B28536
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00B28560

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID:
API String ID: 1351282208-0
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: 4cc00fcf4519f947d1337fbbf32d9c76f9bb789850ad9a7e047c124e09be70b9
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: D3019231206525AEDB119E59FC82FEA37D8EF14B60F1480A6F50CDA161EF60DB8187D8

Function 00B01F20 Relevance: 49.4, APIs: 27, Strings: 1, Instructions: 382
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00B01F62
_memset.LIBCMT ref: 00B01F8B
RegQueryValueExW.ADVAPI32(?,004FFE5C,00000000,?,?,00000400), ref: 00B01FB3
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00B01FBC
lstrlen.KERNEL32(005002EC,?,?), ref: 00B02026
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00B02098
LoadLibraryW.KERNEL32(005001F8,?,?), ref: 00B020E9
GetProcAddress.KERNEL32(00000000,00500210), ref: 00B020F5
GetCommandLineW.KERNEL32 ref: 00B02104
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00B0210F
lstrcpyW.KERNEL32(?,00000000), ref: 00B0211E
PathFindFileNameW.SHLWAPI(?), ref: 00B0212B
UuidCreate.RPCRT4(?), ref: 00B0214C
UuidToStringW.RPCRT4(?,?), ref: 00B02164
RpcStringFreeW.RPCRT4(00000000), ref: 00B021B4
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B021DE
DeleteFileW.KERNEL32(?), ref: 00B02286
CopyFileW.KERNEL32(?,?,00000000), ref: 00B0229C
RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?), ref: 00B022BE
_memset.LIBCMT ref: 00B022E0
lstrlenW.KERNEL32(?), ref: 00B02327
RegSetValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000002,?,00000000), ref: 00B02343
RegCloseKey.ADVAPI32(00000000), ref: 00B0234C
_memset.LIBCMT ref: 00B02370
SetLastError.KERNEL32(00000000), ref: 00B02396

Strings

D, xrefs: 00B02378

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: File$_memset$CloseCommandCreateLineOpenPathStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuerylstrcpy
String ID: D
API String ID: 594894467-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 7a21ab683e1261928d0095118fb3572de22aa8e674a5fd83c4c56777dcbf8211
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: A6E15F71D40219EBDF24DBA0DD89FEEBBB8BF04304F1440A9E609E6191EB745A89CF54

Function 00B02730 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 214
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,005043F8), ref: 00B0274E
GetLastError.KERNEL32 ref: 00B02759
CloseHandle.KERNEL32 ref: 00B0276C
CreateMutexA.KERNEL32(00000000,00000000,00504420), ref: 00B027A0
GetLastError.KERNEL32 ref: 00B027AB
CloseHandle.KERNEL32 ref: 00B027BE

Strings

D, xrefs: 00B02970

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID: D
API String ID: 4294037311-2746444292
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: ccab4a7db025a003d5a873c4050e3e7abcc770c55b7782a035ca29e10f801cd2
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 6A712F72940218AADF50EBE1DC89FDE7BACFB48301F4445A6F609D2090DF759A48CF64

Function 00B15CE7 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00B15CFE

Part of subcall function 00B18EE6: __calloc_impl.LIBCMT ref: 00B18EF5

__calloc_crt.LIBCMT ref: 00B15D22
_free.LIBCMT ref: 00B15D30
__calloc_crt.LIBCMT ref: 00B15D3E
_free.LIBCMT ref: 00B15D4E
_free.LIBCMT ref: 00B15D54
__copytlocinfo_nolock.LIBCMT ref: 00B15D63
__setmbcp_nolock.LIBCMT ref: 00B15D84
_free.LIBCMT ref: 00B15D92
___removelocaleref.LIBCMT ref: 00B15D99
___freetlocinfo.LIBCMT ref: 00B15DA0
_free.LIBCMT ref: 00B15DA6

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 947c244f6de1a819ca45da99608a3ca6b413f75b75fb2a50458bd3f28bcd67c7
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: A021DB32508A01EAE7317F55EC06EDB7BE4DF81750BA048F9F484594A1EF7289C0DB50

Function 00B3F4BC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00B3F4CF

Part of subcall function 00B20F4C: std::exception::_Copy_str.LIBCMT ref: 00B20F65

__CxxThrowException@8.LIBCMT ref: 00B3F4E4

Part of subcall function 00B2111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B13DEC,?,0050793C,?,00000001), ref: 00B2116F

std::exception::exception.LIBCMT ref: 00B3F4FD
__CxxThrowException@8.LIBCMT ref: 00B3F512
std::regex_error::regex_error.LIBCPMT ref: 00B3F524

Part of subcall function 00B3F1C4: std::exception::exception.LIBCMT ref: 00B3F1DE

__CxxThrowException@8.LIBCMT ref: 00B3F532
std::exception::exception.LIBCMT ref: 00B3F54B
__CxxThrowException@8.LIBCMT ref: 00B3F560

Strings

bad function call, xrefs: 00B3F566
leM, xrefs: 00B3F558

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call$leM
API String ID: 2464034642-307869844
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: cf23ccc1061bc5cbba9361574213b2f8caa68b1ac3421a8217f874b6343868be
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 2911AD74C0020DB7CB00FFA4E456CDDBBBCAB04344B4085A6BE18A7641EB74A3588B94

Function 00B137C6 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B13801

Part of subcall function 00B15458: __getptd_noexit.LIBCMT ref: 00B15458

__gmtime64_s.LIBCMT ref: 00B1389A
__gmtime64_s.LIBCMT ref: 00B138D0
__gmtime64_s.LIBCMT ref: 00B138ED
__allrem.LIBCMT ref: 00B13943
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B1395F
__allrem.LIBCMT ref: 00B13976
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B13994
__allrem.LIBCMT ref: 00B139AB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B139C9
__invoke_watson.LIBCMT ref: 00B13A3A

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: b3eb97d8929c8e2ef50f8377aa2cdf22ed83e221c2134f3e4d33873080773d9e
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: B471C671A00716ABD714AF69CC82BEAB3E8EF05B64F5442B9F515D6281F770DE808790

Function 00B15DBE Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00B15DF7
__calloc_crt.LIBCMT ref: 00B15E48
__lock.LIBCMT ref: 00B15E5E
__copytlocinfo_nolock.LIBCMT ref: 00B15E6F
_wcscmp.LIBCMT ref: 00B15EA9
__lock.LIBCMT ref: 00B15EC0
__updatetlocinfoEx_nolock.LIBCMT ref: 00B15ED2
___removelocaleref.LIBCMT ref: 00B15ED8
__updatetlocinfoEx_nolock.LIBCMT ref: 00B15EF7

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: d37e01ed64ad40d882a62eda058f43216a8ff0da79ad4e88b834c91a4d25d009
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 7F412432904708EFDB20AFA4EC82BDE37E4EF84314FA040A9F51896192DB758AC5DB11

Function 00B72530 Relevance: 13.6, APIs: 9, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B44BF0: GetModuleHandleA.KERNEL32(00512A94,?,00000001,?,00B44DC2), ref: 00B44C17
Part of subcall function 00B44BF0: GetProcAddress.KERNEL32(00000000,004D742C), ref: 00B44C27
Part of subcall function 00B44BF0: GetDesktopWindow.USER32 ref: 00B44C4B
Part of subcall function 00B44BF0: GetProcessWindowStation.USER32(?,00B44DC2), ref: 00B44C51
Part of subcall function 00B44BF0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00B44DC2), ref: 00B44C6C
Part of subcall function 00B44BF0: GetLastError.KERNEL32(?,00B44DC2), ref: 00B44C7A
Part of subcall function 00B44BF0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00B44DC2), ref: 00B44CB5
Part of subcall function 00B44BF0: _wcsstr.LIBCMT ref: 00B44CDA

CreateDCA.GDI32(004F6E00,00000000,00000000,00000000), ref: 00B72566
CreateCompatibleDC.GDI32(00000000), ref: 00B72573
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 00B7259E
SelectObject.GDI32(00000000,00000000), ref: 00B725AC
GetObjectA.GDI32(00000000,00000018,?), ref: 00B725BE
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 00B7261A
GetBitmapBits.GDI32(?,?,00000000), ref: 00B72626
SelectObject.GDI32(?,?), ref: 00B72686
DeleteObject.GDI32(00000000), ref: 00B7268D

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Object$Create$BitmapCompatibleInformationSelectUserWindow$AddressBitsDeleteDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID:
API String ID: 487453144-0
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 30fa64ef12ee7e0304396748ef01be04e65447335e2bddc2a435d14e66eba4d6
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: B541D771944304EBD3205BB5DC86F6FBBF8FF89710F004929FA58962A1D775D8008BA6

Function 00AFD160 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228networkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AFD19A
InternetOpenW.WININET(004FFF7C,00000000,00000000,00000000,00000000), ref: 00AFD1AF
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00AFD1F6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 00AFD21D

Strings

$, xrefs: 00AFD392
(, xrefs: 00AFD399
, xrefs: 00AFD38B

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Internet$Open$FileRead_memset
String ID: $$$(
API String ID: 1444302772-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: e8bbc394eac3b697bdb66d2ee13fdd8871d1818e4b41db2995a18abf44879433
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 9291AF71D0024C9BEF21CBA4CC49BEEBBF5AF05304F2441A9E6157B1C1D7B65A88CB61

Function 00BB5F89 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00BB5F8D

Part of subcall function 00B1526F: GetLastError.KERNEL32(?,00B13DB9,00B1545D,00B10F39,?,?,00B13DB9,?), ref: 00B15271
Part of subcall function 00B1526F: __calloc_crt.LIBCMT ref: 00B15292
Part of subcall function 00B1526F: __initptd.LIBCMT ref: 00B152B4
Part of subcall function 00B1526F: GetCurrentThreadId.KERNEL32 ref: 00B152BB
Part of subcall function 00B1526F: SetLastError.KERNEL32(00000000,00B13DB9,00B1545D,00B10F39,?,?,00B13DB9,?), ref: 00B152D3

__calloc_crt.LIBCMT ref: 00BB5FB0
__get_sys_err_msg.LIBCMT ref: 00BB5FCE
__invoke_watson.LIBCMT ref: 00BB5FEB
__get_sys_err_msg.LIBCMT ref: 00BB601D
__invoke_watson.LIBCMT ref: 00BB603B

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00BB5F98, 00BB5FBE

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: ef4c05e28f8f72d64aa06c0ff87f375a7ad2ac6b432e32d3175a310f3a733766
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: F411C432505B18ABEB3176659C42BFAB7CCDF107A0F9004F2FE0897641EAB1DD4082A6

Function 00B44BF0 Relevance: 12.1, APIs: 8, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00512A94,?,00000001,?,00B44DC2), ref: 00B44C17
GetProcAddress.KERNEL32(00000000,004D742C), ref: 00B44C27
GetDesktopWindow.USER32 ref: 00B44C4B
GetProcessWindowStation.USER32(?,00B44DC2), ref: 00B44C51
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00B44DC2), ref: 00B44C6C
GetLastError.KERNEL32(?,00B44DC2), ref: 00B44C7A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00B44DC2), ref: 00B44CB5
_wcsstr.LIBCMT ref: 00B44CDA

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID:
API String ID: 2112994598-0
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: 238bfb200e7c0d363c2cb50011e32798163562f4b7a7ed6f9c195ca19411f1e9
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 7231C631A002099BDB209BB9EC45BEE77F8DF54720F1042B6F81AD31D5EB309A148751

Function 00B01B50 Relevance: 12.1, APIs: 8, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00B01B65
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00B01B82
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00B01BA6
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00B01BB2
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00B01BF3
_memset.LIBCMT ref: 00B01C08
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 00B01C2C

Part of subcall function 00B02DF0: lstrlenW.KERNEL32(?), ref: 00B02E19

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocErrorFormatLastLocalMessage_memsetlstrcpylstrcpyn
String ID:
API String ID: 656605479-0
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: ad84d995a0265491f3e09054f9af5cfc41ebe93ddbb5af739f179fc82961b84d
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 7A213731A40218BBE7506BA18C89FAE3E78EB84B01F1000A4FA08B61D0DF741D419BE9

Function 00B44D30 Relevance: 12.1, APIs: 8, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00B44E66,004D7470,004D73E0,004D73E0,004D73E0,00B44A5E,004D73E0,00000253,004D73F4,?,00B41F87,00000000,00AFCFFE,00000001,00000001), ref: 00B44D4A
GetFileType.KERNEL32(00000000,?,00B41F87,00000000,00AFCFFE,00000001,00000001), ref: 00B44D55
__vfwprintf_p.LIBCMT ref: 00B44D77

Part of subcall function 00B1C01C: _vfprintf_helper.LIBCMT ref: 00B1C02F

vswprintf.LIBCMT ref: 00B44DAD
RegisterEventSourceA.ADVAPI32(00000000,004D7458), ref: 00B44DCE
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00B44DF2
DeregisterEventSource.ADVAPI32(00000000), ref: 00B44DF9
MessageBoxA.USER32(00000000,?,004D7460,00000010), ref: 00B44E23

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID:
API String ID: 277090408-0
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: f9e86874616ba9771d18ea8cdd05d5c717723dbe1af04b0021e84bd12e379d09
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 2A21C271A48344ABE770AB60CC87FEB77D8EF58700F804869F69EC61D1EAB495808757

Function 00B025B0 Relevance: 12.1, APIs: 8, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?), ref: 00B025D9
_memset.LIBCMT ref: 00B02606
RegQueryValueExW.ADVAPI32(?,004FFE5C,00000000,00000001,?,00000400), ref: 00B0262E
RegCloseKey.ADVAPI32(?), ref: 00B02637
GetCommandLineW.KERNEL32 ref: 00B02644
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00B0264F
lstrcpyW.KERNEL32(?,00000000), ref: 00B0265E
lstrcmpW.KERNEL32(?,?), ref: 00B02672

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID:
API String ID: 122392481-0
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: 13ca2f14120366e056f5407c956d38f8d711251847ad66dc05b7f5591b57128b
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: FF11177294020DEBDF50DFA0DC89FEA77BCBB04305F0445A5F609E2191DBB49A889F54

Function 00B02470 Relevance: 10.6, APIs: 7, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00B02485
CommandLineToArgvW.SHELL32(00000000,?), ref: 00B02490
PathFindFileNameW.SHLWAPI(00000000), ref: 00B02498
LoadLibraryW.KERNEL32(00500374), ref: 00B024A6
LoadLibraryW.KERNEL32(005003C8), ref: 00B024E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B0254E
CloseHandle.KERNEL32(00000000), ref: 00B02597

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CommandLibraryLineLoad$ArgvCloseFileFindHandleNameOpenPathProcess
String ID:
API String ID: 3932594339-0
Opcode ID: a611d5a9879eaf53dfc826cc6aff3f8b5b2e7e35405f7696e128a603212a688a
Instruction ID: 49c3c520353b5b66fcf74bcdbba3cdec515282f94f6d47ce455cf4fa80080568
Opcode Fuzzy Hash: a611d5a9879eaf53dfc826cc6aff3f8b5b2e7e35405f7696e128a603212a688a
Instruction Fuzzy Hash: B4315071E00219ABDF11ABE59C49EEEBBB8FF49304F0144AAF504E2190DA749A058BA5

Function 00AFDD10 Relevance: 9.2, APIs: 6, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AFDD3B
CoCreateInstance.COMBASE(004D4F6C,00000000,00000001,004D4F3C,?), ref: 00AFDD5B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,004CA948,000000FF), ref: 00AFDE26
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 00AFDE33
_memset.LIBCMT ref: 00AFDE88
CoUninitialize.COMBASE ref: 00AFDEE2

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID:
API String ID: 330603062-0
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 38601acf0f4d8f761e96c3a03e35b476e0c1daa8d175c4dc5c92245fdde471fb
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: 7F510470A40209AFDB00DF94CC99FAE7BB9FF88705F208459F509AB2A0DB75A945CF54

Function 00B3193B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00B31976
__invoke_watson.LIBCMT ref: 00B319D0
_strlen.LIBCMT ref: 00B31984

Part of subcall function 00B15458: __getptd_noexit.LIBCMT ref: 00B15458

_strnlen.LIBCMT ref: 00B31A0F
__lock.LIBCMT ref: 00B31A20
__getenv_helper_nolock.LIBCMT ref: 00B31A2B

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 0916fdbfbd66f9e5355f6fd28ee27f2e2b7849f54d59f6671252238260188804
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: B931F532A40215ABEB216B6C9C02BEE37DCEF55B21F704AD5F814EB285DF74C84187A5

Function 00B01DE0 Relevance: 9.1, APIs: 6, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B01E00
CoCreateInstance.COMBASE(004CE908,00000000,00000001,004CD568,00000000), ref: 00B01E18
CoUninitialize.COMBASE ref: 00B01E20
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00B01E62
SHGetPathFromIDListW.SHELL32(?,?), ref: 00B01E72
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00B01EB8

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID:
API String ID: 2287340669-0
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 83b9a4e4b270972344e94b0a1d2d62e298ce88ac77a257e7bc5bc4b893d7e63b
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: B5414E74A40219AFDB14DBA4DC88FAE7BBCEF48705F1044A9F909D7190D7B1AA45CB50

Function 00B01C60 Relevance: 9.1, APIs: 6, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00B01C6D
OpenServiceW.ADVAPI32(00000000,00500268,00000020), ref: 00B01C82
ControlService.ADVAPI32(00000000,00000001,?), ref: 00B01C96
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00B01CAB
Sleep.KERNEL32(?), ref: 00B01CC5
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00B01CD0

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Service$OpenQueryStatus$ControlManagerSleep
String ID:
API String ID: 3598506262-0
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 8d69b3f57ed3d5ed0f39671bd78491d5c4467a358f88d8df0d49a49d547e90cb
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 8A118635640205EBEB349BD99C88FAF7BFCEB44755F040561FA05E6180DB34DD45CAA4

Function 00AFF560 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(005001F8), ref: 00AFF588
GetProcAddress.KERNEL32(00000000,00500210), ref: 00AFF5A3

Strings

\, xrefs: 00AFF798

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: \
API String ID: 2574300362-2967466578
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: b202661acf0aa332055f3d75ea0865eb4c9381e8a18b958f671e5ff3c69242b6
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: 70C12370D0124DEEDF00DFA4DD8ABEEBBF5AF14304F104069E905A6290EB75AA58CB91

Function 00B15591 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00B155A4

Strings

U, xrefs: 00B155AD

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: ddf908a9b7669133d3a119863069f6839cf7ad91323723d5f8667e7fec51b2f9
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6E21D832644608EAEB209A64AC45BFA73DEDB94760FA001E5F909C6181FB61DDC08694

Function 00AFC990 Relevance: 7.8, APIs: 5, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00B1122D: __wfsopen.LIBCMT ref: 00B11238

_fgetws.LIBCMT ref: 00AFCA0C
CreateDirectoryW.KERNEL32(004FFE70,00000000), ref: 00AFCB9B

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws
String ID:
API String ID: 1649371814-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: e0736630635749ddc0d2cedeaf8e996ccad6ada1f7cbf1c2651a82b0089b6827
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1E91CF71D0020D9BCF20DFA5CE86BAEB7F5AF04324F140569FA09A3281E775AE54CB95

Function 00B00E20 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00B00E62
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00B00E89
_memset.LIBCMT ref: 00B00E9C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00B00EB3

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: c272ceaf9cd961abe3fdabe79180ec63080e088461d22d0143e1bdebfc145908
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 8391AE756183418FD728DF28C895B6BBBE1FF84700F1489ADF48A8B6D0E770A940CB56

Function 00B00CA0 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00B00CC5
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00B00D32
PathFileExistsA.SHLWAPI(?), ref: 00B00D49
SetErrorMode.KERNEL32(00000000), ref: 00B00D52
GetDriveTypeA.KERNEL32(?), ref: 00B00D6B

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: 669590f6765bc49a62f6d18c08b5bbd7516aa68d37a0974ca489b2dc6bb45c89
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: EE41CE71108340DFD710EF68C889B1ABBE4FB85718F500A6DF48A922E2DB75D944CB93

Function 00B2B94F Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B2B95B

Part of subcall function 00B10EB2: __FF_MSGBANNER.LIBCMT ref: 00B10EC9
Part of subcall function 00B10EB2: __NMSG_WRITE.LIBCMT ref: 00B10ED0
Part of subcall function 00B10EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B10EF5

_free.LIBCMT ref: 00B2B96E

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: a6c73737953f3d85d060e0bd5f07a186c257daf95ca7fd0e952de57b8d797ead
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: D411E7325046359BCB203F75BC85EAA37D49F05361F6046E9FA4C96291DF3488C08690

Function 00B02690 Relevance: 7.6, APIs: 5, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00B0269F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00B026B9
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B026F1
TerminateProcess.KERNEL32(00000000,00000009), ref: 00B02700
Process32NextW.KERNEL32(00000000,0000022C), ref: 00B02711

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2688562911-0
Opcode ID: f800ed1a70d164d25c801f6619c0d912ca8855511ce51469826557765f8e188c
Instruction ID: b944818222b299fc4936d52cf48de776f9cfb64a79ff0334d80b663344bf56ef
Opcode Fuzzy Hash: f800ed1a70d164d25c801f6619c0d912ca8855511ce51469826557765f8e188c
Instruction Fuzzy Hash: 3F01B535901215BBE7216BE1ACCDFAE7BBCEF08B50F0400A1FD08D1182EB70CD448AA5

Function 00AFC8F0 Relevance: 7.5, APIs: 5, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,004FFE08,00000000,000F003F,?), ref: 00AFC912
RegQueryValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,?), ref: 00AFC943
RegCloseKey.ADVAPI32(00000000), ref: 00AFC950
RegSetValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,00000004), ref: 00AFC975
RegCloseKey.ADVAPI32(00000000), ref: 00AFC97E

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID:
API String ID: 3962714758-0
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 42776819dd96a962ce76ba69077c4fdb16538e27989aa8dfec23d5094974241d
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 01112D7594020CFBDB109FD1CD46FEEBBB8EB04718F1041A5FB04B21A1D7B15B14AA98

Function 00B0E938 Relevance: 7.5, APIs: 5, Instructions: 44stringfilenetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0E957

Part of subcall function 00AFC750: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00AFC76B

InternetOpenW.WININET ref: 00B0E993
_wcsstr.LIBCMT ref: 00B0E9FE
lstrcpyW.KERNEL32(?,?), ref: 00B0EB5A
lstrcatW.KERNEL32(?,005044D8), ref: 00B0EB8D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B0EBA4
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00B0EBBF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B0EBDC
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B0EBF3
lstrlen.KERNEL32(?,00000000,00000000,000000FF), ref: 00B0EC1D
_strstr.LIBCMT ref: 00B0EC86
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B0ECA9
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B0ECC4
DeleteFileA.KERNEL32(?), ref: 00B0ECD2
lstrcpy.KERNEL32(?,?), ref: 00B0ECF4
lstrcpy.KERNEL32(?,?), ref: 00B0ED0A
lstrcpyW.KERNEL32(?,00000000), ref: 00B0EDAB
_malloc.LIBCMT ref: 00B0EDD6
_memset.LIBCMT ref: 00B0EDE4
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 00B0EDFE
lstrcpyW.KERNEL32(?,00000000), ref: 00B0EE06
_strstr.LIBCMT ref: 00B0EE2A
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B0EE50
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B0EE74
DeleteFileA.KERNEL32(?), ref: 00B0EE82

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$lstrcpy$Folder$AppendFileInternet$DeleteOpen_memset_strstr$ByteCharMultiReadWide_malloc_wcsstrlstrcatlstrlen
String ID:
API String ID: 2057544059-0
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c59072c6c7d7fe0b6ccdf615d458ad90dc5ca7dd17e6bdfdd073574a2b0c2740
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 48019270508385ABDA70DF109C45FDF7FD8AF41704F4448A8F98482182EB74D2088BA7

Function 00B0BC60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00B0BC9A
RegisterClassExW.USER32(00000030), ref: 00B0BCC3

Strings

0, xrefs: 00B0BC6D
>P, xrefs: 00B0BCB5

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$>P
API String ID: 1693014935-2710508548
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 00B0A0C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0A108
_memset.LIBCMT ref: 00B0A119
_memset.LIBCMT ref: 00B0A12A

Strings

p2Q, xrefs: 00B0A132

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: b04f88d95b10509861966d639afb368cc5edcf2be916ea1e960236225b524226
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 8CF0C06C684750A5F7117B60BC26B817DD16735B04F504084E1142A2E5D3F9238C679D

Function 00B3F48E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00B3F4A1

Part of subcall function 00B20F4C: std::exception::_Copy_str.LIBCMT ref: 00B20F65

__CxxThrowException@8.LIBCMT ref: 00B3F4B6

Part of subcall function 00B2111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B13DEC,?,0050793C,?,00000001), ref: 00B2116F

Strings

TeM, xrefs: 00B3F497, 00B3F4AB
TeM, xrefs: 00B3F4AE

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 757275642-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 3de11404c13f65fdb0c765cc037fc74b66d5c995fbbf79c2090d5fc94c199044
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 3ED06274C0021CB7CB00EFA4E45ACCDBBB8AB04344B008496AE1457241EB7493498BD4

Function 00B556D0 Relevance: 6.4, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 00B55718
GetLastError.KERNEL32(?,?,00000000), ref: 00B55724
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00B55747
GetLastError.KERNEL32(?,?,00000000), ref: 00B55753
GetLastError.KERNEL32(004E2188,000000A9,?,00000000,?,?,00000000), ref: 00B55845

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorLast$ByteCharMultiWide
String ID:
API String ID: 3361762293-0
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: b6d37382178cd2158f787b9142e35b689caed4efcaece15a2f91d7e23b20f98b
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: E7513671E80605BBEB306BA49C53FBE76E8EB45703F1401E5FE05BA1C1DAA15D0586A2

Function 00AFCDF0 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 00AFD02E
_malloc.LIBCMT ref: 00AFD062
_malloc.LIBCMT ref: 00AFD071
_fprintf.LIBCMT ref: 00AFD0C5

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: f8f8c7766e3f0d9109a1cb8d9269ad2b1fe24b198f4824219ccae1831bb027fb
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: FCA17FB1C0024DDBEF11EFE4CC46BEEBBB5AF10314F540068E50576282D7B65A98DBA2

Function 00B12380 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B123DE
__read_nolock.LIBCMT ref: 00B124AE
__filbuf.LIBCMT ref: 00B124D1
_memset.LIBCMT ref: 00B12515

Part of subcall function 00B15458: __getptd_noexit.LIBCMT ref: 00B15458

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: c11b1c459bb19596f60549848247a900826ba1931fc672cee5aec088939b6b91
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 5151C170A00305DFDB288F69D8806EE77E2EF50320FA487A9F935962D1D7749EE09B54

Function 00B2C8C7 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B2C8FD
__isleadbyte_l.LIBCMT ref: 00B2C92B
MultiByteToWideChar.KERNEL32(?,00000009,004FFCF0,?,00000000,00000000,?,00000000,00000000,?,0000007A,004FFCF0), ref: 00B2C959
MultiByteToWideChar.KERNEL32(?,00000009,004FFCF0,00000001,00000000,00000000,?,00000000,00000000,?,0000007A,004FFCF0), ref: 00B2C98F

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 87ad250085da1abd43a65ec40052a335cdef618f0e2939bbcd59e7d413c6f074
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 7631A031600266EFDB228E65E885BBE7FE9FF41310F1581A9E8589B1A0D7319891DB90

Function 00AFF330 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00AFF375
lstrlen.KERNEL32(?,?,00000000), ref: 00AFF3E8
WriteFile.KERNEL32(00000000,?,00000000), ref: 00AFF3F1
CloseHandle.KERNEL32(00000000), ref: 00AFF3F8

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 06a24da496eae0015c90ed3cab6e0bb3c6dbba284d5f019bc47e531c838d30a3
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: 82313631900108EFDB149FA8CC4ABBEBBB8EF04314F104168FA16A75C0D7716A45CBE1

Function 00AFC750 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00AFC76B
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00AFC789

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID:
API String ID: 29327785-0
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: aefd2ac1bdb0ea488fa41c6c69e8700dc00c63a5de4f3cade7285e548c28eb84
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: AC11E372A4032C33D92072A96C87FEB739C9B46B25F5000E6FF0CA2182B6665A9645E5

Function 00BB72E4 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00BB72FB

Part of subcall function 00BB79F0: ___BuildCatchObjectHelper.LIBCMT ref: 00BB7A22
Part of subcall function 00BB79F0: ___AdjustPointer.LIBCMT ref: 00BB7A39

_UnwindNestedFrames.LIBCMT ref: 00BB7312
___FrameUnwindToState.LIBCMT ref: 00BB7324
CallCatchBlock.LIBCMT ref: 00BB7348

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: bc48a81e3f1b2944767e96b6540e32663a230e89cbd743ce8960606fc140863e
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: A5011732000509BBCF126F55CC01EEA3BFAEF88754F144154FD1865121C7B2E861EBA4

Function 00B30C09 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00B30C2D

Part of subcall function 00B3134D: __fltout2.LIBCMT ref: 00B31376

__cftog_l.LIBCMT ref: 00B30C53
__cftoe_l.LIBCMT ref: 00B30C85

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 03e4ab466405b72a8119cbc919351f2be88e1116135bd1d26beb917ab75eca6f
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: CB01403601014EBBCF126E84CC518EE3FA6FF18350FA89695FA1958131C337D9B1AB85

Function 00B029F0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00B02A09
_malloc.LIBCMT ref: 00B02A13

Part of subcall function 00B10EB2: __FF_MSGBANNER.LIBCMT ref: 00B10EC9
Part of subcall function 00B10EB2: __NMSG_WRITE.LIBCMT ref: 00B10ED0
Part of subcall function 00B10EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B10EF5

_memset.LIBCMT ref: 00B02A1E
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 00B02A34

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 717fa5a60cc1b3a2accc46d393a03158044143e887a7a1b5ae75e51687735d22
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: 0BF05C36701204BBE72067669C4BFBBB6DDEF86760F100175FA08E31C1E5A12D0142F5

Function 00B02A50 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 00B02A56
_malloc.LIBCMT ref: 00B02A64

Part of subcall function 00B10EB2: __FF_MSGBANNER.LIBCMT ref: 00B10EC9
Part of subcall function 00B10EB2: __NMSG_WRITE.LIBCMT ref: 00B10ED0
Part of subcall function 00B10EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B10EF5

_memset.LIBCMT ref: 00B02A6F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00B02A82

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: d549b8e10939c71995a2ce6a14b6b9897dbfbb664423e5441567aef5cb708bbf
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 81E0CD76701124BBF510235A6C8EFEB665CCFC67B1F500165F615D21D2CAE01C4185B4

Function 00B53240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00B532CE
_memset.LIBCMT ref: 00B532FB

Strings

Enter PEM pass phrase:, xrefs: 00B53286, 00B53293, 00B532D4

Memory Dump Source

Source File: 0000001C.00000002.1721486221.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_af0000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: Enter PEM pass phrase:
API String ID: 3021507156-3278253880
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 3eef693d27ce1a86ad8418bc1f7ff27109f692a4c21a47524e908ad4bfe91c3b
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: BB21AA72B043113BE7209926AC42FAB77DDDFC1BD9F0444D4FE5467281E722DE0942A6

Analysis Process: Q3FGHfhdgU.exePID: 7924, Parent PID: 4340COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	1

Executed Functions

Function 00B1003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00B1024D

Strings

kernel32.dll, xrefs: 00B1008F, 00B10095
cess, xrefs: 00B1018D

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: ec4841675d3e45ba831df9ec5c0a635f876295c3445a3347733a4230b4f8e25e
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 06526874A10229DFDB64CF58C984BA8BBB1BF09304F5480E9E90DAB251DB70AEC5DF14

Function 00A747C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A747EE
Module32First.KERNEL32(00000000,00000224), ref: 00A7480E

Memory Dump Source

Source File: 00000022.00000002.1707372254.0000000000A74000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A74000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_a74000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: de117d96850082000dde5334b620f1fc2c584847024ba9512da6e6650e834b21
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: CCF06D362007146BD7203BF9AC8DB6A76ECAF8D725F108629E64AA14C0DB70E8458A61

Function 00B10DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,00B10223,?,?), ref: 00B10E02
SetErrorMode.KERNEL32(00000000,?,?,00B10223,?,?), ref: 00B10E07

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1dc4d15697f29509d23008307fb695383dcc57ac0bbfa1e0cd338ec226f43c2e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A5D0123264522CB7DB002A95DC09BCEBB5CDF05BA6F408061FB0DE9181CBB09A8046EA

Function 00A74485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00A744D6

Memory Dump Source

Source File: 00000022.00000002.1707372254.0000000000A74000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A74000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_a74000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 06c227e8e96b1180195aa3ad1460bf50e161a4f9fba5240dc61df093fa4e3f0f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C9112B79A00208EFDB01DF98CA85E99BBF5AF08351F05C094F9489B362D371EA90DB80

Non-executed Functions

Function 00B21210 Relevance: 24.1, APIs: 16, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00B21260
__CxxThrowException@8.LIBCMT ref: 00B21276

Part of subcall function 00B4111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B33DEC,?,0050793C,?,00000001), ref: 00B4116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00B2128B
__CxxThrowException@8.LIBCMT ref: 00B212A1
lstrlen.KERNEL32(?,00000000), ref: 00B212A9
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00B212B4
__CxxThrowException@8.LIBCMT ref: 00B212CA
__CxxThrowException@8.LIBCMT ref: 00B212FB
_memset.LIBCMT ref: 00B2131A
__CxxThrowException@8.LIBCMT ref: 00B21340
_malloc.LIBCMT ref: 00B21350
_memset.LIBCMT ref: 00B2135B
_sprintf.LIBCMT ref: 00B2137E
lstrcat.KERNEL32(?,?), ref: 00B2138C
CryptDestroyHash.ADVAPI32(00000000), ref: 00B213A4
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00B213AF

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Context_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID:
API String ID: 2261035504-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 1d2b91bdba58d50e8a0e798d7b98db9e4b9dda30a00562ab6322840cf4bb2131
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 8E514971D40219ABDB10DFA4DC86FEFBBB8FB18740F100565FA05F6191EB746A018BA5

Function 00B1EAC0 Relevance: 18.2, APIs: 12, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 00B1EB1E
__CxxThrowException@8.LIBCMT ref: 00B1EB34

Part of subcall function 00B4111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B33DEC,?,0050793C,?,00000001), ref: 00B4116F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00B1EB49
__CxxThrowException@8.LIBCMT ref: 00B1EB5F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 00B1EB78
__CxxThrowException@8.LIBCMT ref: 00B1EB8E
__CxxThrowException@8.LIBCMT ref: 00B1EBBF
_memset.LIBCMT ref: 00B1EBDE
__CxxThrowException@8.LIBCMT ref: 00B1EC04
_sprintf.LIBCMT ref: 00B1EC23

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$Crypt$Hash$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID:
API String ID: 3953910439-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 9149d49d6a46268b477a13b6f8af5c2825667c52b694805717f52051567f650e
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 5B518E71E40209EADF11DFA0DC86FEFBBB8EB04700F200566FA05B6181D775AA458BA4

Function 00B1E8C0 Relevance: 18.1, APIs: 12, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B1E8CF

Part of subcall function 00B30EB2: __FF_MSGBANNER.LIBCMT ref: 00B30EC9
Part of subcall function 00B30EB2: __NMSG_WRITE.LIBCMT ref: 00B30ED0
Part of subcall function 00B30EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B30EF5

_malloc.LIBCMT ref: 00B1E8DB
_wprintf.LIBCMT ref: 00B1E8EE
_free.LIBCMT ref: 00B1E8F4

Part of subcall function 00B30E3D: HeapFree.KERNEL32(00000000,00000000,?,00B352CF,00000000,00B3545D,00B30F39), ref: 00B30E51
Part of subcall function 00B30E3D: GetLastError.KERNEL32(00000000,?,00B352CF,00000000,00B3545D,00B30F39), ref: 00B30E63

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00B1E909
_free.LIBCMT ref: 00B1E915
_malloc.LIBCMT ref: 00B1E91D
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00B1E930
_sprintf.LIBCMT ref: 00B1E970
_wprintf.LIBCMT ref: 00B1E982
_wprintf.LIBCMT ref: 00B1E98C
_free.LIBCMT ref: 00B1E995

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID:
API String ID: 3901070236-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 78ebfc7d004e9d32644db07189b747a04fb555dde478c2e1dbb5fece9e5e5358
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 0311E472E046643AC661B3F95C12EFF7AEC9F46711F1404E9FF98E1181EA689A0493B1

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 164af0fc3c1cebefd05d87cea4567ea6b2c2e140d54bf1c05fb7af81252cf02b
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 164af0fc3c1cebefd05d87cea4567ea6b2c2e140d54bf1c05fb7af81252cf02b
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 00B484F2 Relevance: 6.1, APIs: 4, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00B48509
_wcscmp.LIBCMT ref: 00B4851A
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00B48536
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00B48560

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID:
API String ID: 1351282208-0
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: 2ffac53e80f5ddf5b6f49e711b3559a47a54d85f40912071f4b18d1bdf15d4ab
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: 81018031204525AADB119E5DDC82FEE37D9EB14F60F1480A6F90CDA161EF70EB81A794

Function 00B22730 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 214
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,005043F8), ref: 00B2274E
GetLastError.KERNEL32 ref: 00B22759
CloseHandle.KERNEL32 ref: 00B2276C
CreateMutexA.KERNEL32(00000000,00000000,00504420), ref: 00B227A0
GetLastError.KERNEL32 ref: 00B227AB
CloseHandle.KERNEL32 ref: 00B227BE

Strings

D, xrefs: 00B22970

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID: D
API String ID: 4294037311-2746444292
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: 8ff3917f878c4f168135cb6297ba4067b46ff079402c8d45f2a27d8f24466784
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 30712F72940218AADF50EBE1EC89FDE7BACFB44301F4445A6F609D2090DF759A48CF64

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 939964852-1805842116
Opcode ID: a15a1525fa9131f69cb06d7fba4762e921f22c98714f4bcadf025483b776ef82
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: a15a1525fa9131f69cb06d7fba4762e921f22c98714f4bcadf025483b776ef82
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: ba03a2e5e42d847be9fa1a5c62943ab4e99fec1194133577bbbb74d661dd731c
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: ba03a2e5e42d847be9fa1a5c62943ab4e99fec1194133577bbbb74d661dd731c
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00469350 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 168COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00469452

Strings

id=, xrefs: 00469508
.\crypto\engine\eng_list.c, xrefs: 0046935E, 0046937C, 004693FD, 004694F7
OPENSSL_ENGINES, xrefs: 0046944D
LIST_ADD, xrefs: 004694BE
LOAD, xrefs: 004694D4
C:\Build-OpenSSL-VC-32/lib/engines, xrefs: 00469459, 004694A4
DIR_LOAD, xrefs: 00469490
dynamic, xrefs: 00469416, 0046945E
DIR_ADD, xrefs: 004694A5

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __wgetenv
String ID: .\crypto\engine\eng_list.c$C:\Build-OpenSSL-VC-32/lib/engines$DIR_ADD$DIR_LOAD$LIST_ADD$LOAD$OPENSSL_ENGINES$dynamic$id=
API String ID: 1112669753-613467719
Opcode ID: d8c12b6cecbc2a152a1438591538cd30de4b223a7f0141548b1d55cfe454f99e
Instruction ID: 93c721e730456b0751f01afdf29b9ec0f249dd5f65d46a011da8796c85f981b9
Opcode Fuzzy Hash: d8c12b6cecbc2a152a1438591538cd30de4b223a7f0141548b1d55cfe454f99e
Instruction Fuzzy Hash: E7411A6178874032EB3135361E43B671A4D4B15B4AF580457FE45AA3C3FAEEDC46829F

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 1d9b188d17e0480fd30dd7d4bf24a71c94dfac426fd36cb2f4ef340344809e2c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 1d9b188d17e0480fd30dd7d4bf24a71c94dfac426fd36cb2f4ef340344809e2c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00B5F4BC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00B5F4CF

Part of subcall function 00B40F4C: std::exception::_Copy_str.LIBCMT ref: 00B40F65

__CxxThrowException@8.LIBCMT ref: 00B5F4E4

Part of subcall function 00B4111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B33DEC,?,0050793C,?,00000001), ref: 00B4116F

std::exception::exception.LIBCMT ref: 00B5F4FD
__CxxThrowException@8.LIBCMT ref: 00B5F512
std::regex_error::regex_error.LIBCPMT ref: 00B5F524

Part of subcall function 00B5F1C4: std::exception::exception.LIBCMT ref: 00B5F1DE

__CxxThrowException@8.LIBCMT ref: 00B5F532
std::exception::exception.LIBCMT ref: 00B5F54B
__CxxThrowException@8.LIBCMT ref: 00B5F560

Strings

leM, xrefs: 00B5F558
bad function call, xrefs: 00B5F566

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call$leM
API String ID: 2464034642-307869844
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: d701864513c2c92fe0e4f7e5ab3ffe4b21dbbbc81d515b9e748fdc019fcde2be
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 4411AA74C0020DBBCB00FFA4D456CEDBBBCAB04344B4089A7BE18A7641EB74A3488B94

Function 00B337C6 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B33801

Part of subcall function 00B35458: __getptd_noexit.LIBCMT ref: 00B35458

__gmtime64_s.LIBCMT ref: 00B3389A
__gmtime64_s.LIBCMT ref: 00B338D0
__gmtime64_s.LIBCMT ref: 00B338ED
__allrem.LIBCMT ref: 00B33943
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B3395F
__allrem.LIBCMT ref: 00B33976
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B33994
__allrem.LIBCMT ref: 00B339AB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B339C9
__invoke_watson.LIBCMT ref: 00B33A3A

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 3ba9bd29d8710895e06782dd87938b5ee123b7a76337d4cf1f24e3b39d1be76f
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8F7185B5A00717EBD714AE6DCC82B6BB3E4EF44B24F2442B9F515D6281E771AE408B90

Function 004549A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1233653401-1672312481
Opcode ID: 90c684128eb5e8e5df80e0a351cb190437495bff95dc85ab757f84aa99128f37
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 90c684128eb5e8e5df80e0a351cb190437495bff95dc85ab757f84aa99128f37
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 81d809e9d71c059113a903a7fc2c2efdb5cdf039f1f061fc9f175b130ce46ee2
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 81d809e9d71c059113a903a7fc2c2efdb5cdf039f1f061fc9f175b130ce46ee2
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00B92530 Relevance: 13.6, APIs: 9, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B64BF0: GetModuleHandleA.KERNEL32(00512A94,?,00000001,?,00B64DC2), ref: 00B64C17
Part of subcall function 00B64BF0: GetProcAddress.KERNEL32(00000000,004D742C), ref: 00B64C27
Part of subcall function 00B64BF0: GetDesktopWindow.USER32 ref: 00B64C4B
Part of subcall function 00B64BF0: GetProcessWindowStation.USER32(?,00B64DC2), ref: 00B64C51
Part of subcall function 00B64BF0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00B64DC2), ref: 00B64C6C
Part of subcall function 00B64BF0: GetLastError.KERNEL32(?,00B64DC2), ref: 00B64C7A
Part of subcall function 00B64BF0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00B64DC2), ref: 00B64CB5
Part of subcall function 00B64BF0: _wcsstr.LIBCMT ref: 00B64CDA

CreateDCA.GDI32(004F6E00,00000000,00000000,00000000), ref: 00B92566
CreateCompatibleDC.GDI32(00000000), ref: 00B92573
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 00B9259E
SelectObject.GDI32(00000000,00000000), ref: 00B925AC
GetObjectA.GDI32(00000000,00000018,?), ref: 00B925BE
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 00B9261A
GetBitmapBits.GDI32(?,?,00000000), ref: 00B92626
SelectObject.GDI32(?,?), ref: 00B92686
DeleteObject.GDI32(00000000), ref: 00B9268D

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Object$Create$BitmapCompatibleInformationSelectUserWindow$AddressBitsDeleteDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID:
API String ID: 487453144-0
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: d6addfb44a07bb39ec35946b4bb90e3197a50c52e609415777483a6b36aec0af
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 6841B671944704BBD3106BB5DC86F2FBBF8FF89710F100929FA55962A1D77598008BA6

Function 00B1D160 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228networkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B1D19A
InternetOpenW.WININET(004FFF7C,00000000,00000000,00000000,00000000), ref: 00B1D1AF
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B1D1F6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 00B1D21D

Strings

$, xrefs: 00B1D392
(, xrefs: 00B1D399
, xrefs: 00B1D38B

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Internet$Open$FileRead_memset
String ID: $$$(
API String ID: 1444302772-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: be5aa0ca65cf1b7b7e9d5179e61038d078b722215e0bec9305b69f0d324c71f2
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 7C91BE70D00218DBEF20CBA4DC4ABEEBBF4AF05704F6441A8E51577281D7B65A88CB65

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: 87eaa8ac1572454a83bf0067174873e4fb49b47427992fc09f83c9f4ae3a25fc
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: 87eaa8ac1572454a83bf0067174873e4fb49b47427992fc09f83c9f4ae3a25fc
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 00B225B0 Relevance: 12.1, APIs: 8, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,00500290,00000000,000F003F,?), ref: 00B225D9
_memset.LIBCMT ref: 00B22606
RegQueryValueExW.ADVAPI32(?,004FFE5C,00000000,00000001,?,00000400), ref: 00B2262E
RegCloseKey.ADVAPI32(?), ref: 00B22637
GetCommandLineW.KERNEL32 ref: 00B22644
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00B2264F
lstrcpyW.KERNEL32(?,00000000), ref: 00B2265E
lstrcmpW.KERNEL32(?,?), ref: 00B22672

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID:
API String ID: 122392481-0
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: 72d3344d5fe8b07188757ef63468047043e53eabb56b350612074d8397e53f08
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: EB11177294020DABDB50DFA0DC89FEA77BCBB04305F1445A5F609E2191DBB49A889F54

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
, xrefs: 00457482
+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: b985b484ee475b36d1976565a89a8ed99a1b92853eca9386b18e2df1a658536a
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: b985b484ee475b36d1976565a89a8ed99a1b92853eca9386b18e2df1a658536a
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 00465110 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 004651A4
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,0000018E), ref: 00465289

Strings

fopen(', xrefs: 004652A9
.\crypto\bio\bss_file.c, xrefs: 00465284, 004652BA, 004652F3
',', xrefs: 004652A3

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorLast__setmode
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 3737066399-2085858615
Opcode ID: e849cc0089a0e95fad7d96d99632b4c14ea6f9f4e9d4ef5310eee888fbdda515
Instruction ID: 163a7161baf1eb16d028d666008b586f19609d927e015f3406657a88ab31951f
Opcode Fuzzy Hash: e849cc0089a0e95fad7d96d99632b4c14ea6f9f4e9d4ef5310eee888fbdda515
Instruction Fuzzy Hash: DB513CB37403142BD7005B99BC42BEAB394EB44B67F04017BFB44E6281E7AED915475E

Function 00B22470 Relevance: 10.6, APIs: 7, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00B22485
CommandLineToArgvW.SHELL32(00000000,?), ref: 00B22490
PathFindFileNameW.SHLWAPI(00000000), ref: 00B22498
LoadLibraryW.KERNEL32(00500374), ref: 00B224A6
LoadLibraryW.KERNEL32(005003C8), ref: 00B224E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B2254E
CloseHandle.KERNEL32(00000000), ref: 00B22597

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CommandLibraryLineLoad$ArgvCloseFileFindHandleNameOpenPathProcess
String ID:
API String ID: 3932594339-0
Opcode ID: a611d5a9879eaf53dfc826cc6aff3f8b5b2e7e35405f7696e128a603212a688a
Instruction ID: 8448ab0ea7a3472553301029060cc2d6e88194bbd395a7dab5dedb28f6c919e1
Opcode Fuzzy Hash: a611d5a9879eaf53dfc826cc6aff3f8b5b2e7e35405f7696e128a603212a688a
Instruction Fuzzy Hash: FF315071E00219BBDF11AFA59C45EEEBBF8FF49304F0144A9F508E2190DA749A018BA5

Function 00B5193B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00B51976
__invoke_watson.LIBCMT ref: 00B519D0
_strlen.LIBCMT ref: 00B51984

Part of subcall function 00B35458: __getptd_noexit.LIBCMT ref: 00B35458

_strnlen.LIBCMT ref: 00B51A0F
__lock.LIBCMT ref: 00B51A20
__getenv_helper_nolock.LIBCMT ref: 00B51A2B

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 68322efec5299c56ee2559ba44c053385e4a61a49cfc55dae929077299d9aed6
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: F331D132A00615ABDB227A6C9C02BAE37D4DF11B22F3148D5FD14EB285DF74CC0987A1

Function 00B1F560 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(005001F8), ref: 00B1F588
GetProcAddress.KERNEL32(00000000,00500210), ref: 00B1F5A3

Strings

\, xrefs: 00B1F798

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: \
API String ID: 2574300362-2967466578
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 3256f001250ccbdfb40e9228bda517cfb30c7cf135de201d050e419f481f0727
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: 3FC15D71D01219EBDF00DFA4DD4ABEEBBF5BF14304F604069E809A7190EB759A58CB91

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 4ae76c461777ea60cd0d65a2f021a7c0ef4a2c2d17b8efed8afe2f2793f22b47
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 4ae76c461777ea60cd0d65a2f021a7c0ef4a2c2d17b8efed8afe2f2793f22b47
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 00B35591 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00B355A4

Strings

U, xrefs: 00B355AD

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 937fca2d3f13ad03a15e39a7d21ef6aee2a68dff6baf248c739f82735604c907
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 40212732644A08AEEB20AA68AC45BBE33EDDB54761F7101E5F909C6180FF70EE408790

Function 004548D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 004548F7
_swscanf.LIBCMT ref: 0045491A

Part of subcall function 004C5F62: _vscan_fn.LIBCMT ref: 004C5F76

_strtoul.LIBCMT ref: 00454929

Part of subcall function 00431546: strtoxl.LIBCMT ref: 00431566

Strings

OPENSSL_ia32cap, xrefs: 004548E8
%I64i, xrefs: 00454914

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __wgetenv_strtoul_swscanf_vscan_fnstrtoxl
String ID: %I64i$OPENSSL_ia32cap
API String ID: 409312853-1470193844
Opcode ID: bac845e630d3a57e6badd78c933abaaffb2293c869e7eb6b0c0941ce37c6c7fd
Instruction ID: 02ad6d9c21fd5608b4e191a4842a8a74cf6c4616c263a1aa16a65e1262f920e3
Opcode Fuzzy Hash: bac845e630d3a57e6badd78c933abaaffb2293c869e7eb6b0c0941ce37c6c7fd
Instruction Fuzzy Hash: FE1102B29042116FE710DB65CC4276777D4AFD5399F08843FFC48A7266E63C8C88879A

Function 00B1C990 Relevance: 7.8, APIs: 5, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00B3122D: __wfsopen.LIBCMT ref: 00B31238

_fgetws.LIBCMT ref: 00B1CA0C
CreateDirectoryW.KERNEL32(004FFE70,00000000), ref: 00B1CB9B

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws
String ID:
API String ID: 1649371814-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 197dcac0d1e66a3226513c9e5a6d07641aff8d506a5f9ad364911035994f8ba3
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: FC919E71D402199BCB20DFA4CC867EEBBF5EF04304F6405A9E809A3241E775AE94CBD5

Function 00B4B94F Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B4B95B

Part of subcall function 00B30EB2: __FF_MSGBANNER.LIBCMT ref: 00B30EC9
Part of subcall function 00B30EB2: __NMSG_WRITE.LIBCMT ref: 00B30ED0
Part of subcall function 00B30EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B30EF5

_free.LIBCMT ref: 00B4B96E

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: 8f565fd4e64b40eccb739ccb1f23977a7ebcdf62523e5a09b89bddf329721a6d
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: 0711C632904729ABCB353F74AC85F6A37E4AF15361F3045E9FB4996291DF34C980A790

Function 00B22690 Relevance: 7.6, APIs: 5, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00B2269F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00B226B9
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B226F1
TerminateProcess.KERNEL32(00000000,00000009), ref: 00B22700
Process32NextW.KERNEL32(00000000,0000022C), ref: 00B22711

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2688562911-0
Opcode ID: f800ed1a70d164d25c801f6619c0d912ca8855511ce51469826557765f8e188c
Instruction ID: 94ecf1c61dd5aa8a2f128da31a0e31fb05412bff2f1c6405235f6b58d0dbd887
Opcode Fuzzy Hash: f800ed1a70d164d25c801f6619c0d912ca8855511ce51469826557765f8e188c
Instruction Fuzzy Hash: 3501B536501215BBE7216BA1BCC9FAE77BCEF08B50F0400A1FD0CD1151EB709D448AA5

Function 00B1C8F0 Relevance: 7.5, APIs: 5, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,004FFE08,00000000,000F003F,?), ref: 00B1C912
RegQueryValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,?), ref: 00B1C943
RegCloseKey.ADVAPI32(00000000), ref: 00B1C950
RegSetValueExW.ADVAPI32(00000000,004FFE5C,00000000,00000004,?,00000004), ref: 00B1C975
RegCloseKey.ADVAPI32(00000000), ref: 00B1C97E

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID:
API String ID: 3962714758-0
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 3afa4e1d748df335a9dc904e1a819f05e80a54123dbcdc4530e9ba367c714d04
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 8711217594020CFBDB119F91CC45FEEBBB8EB04708F1041A5FA04B2191D7715B149A58

Function 00B2E938 Relevance: 7.5, APIs: 5, Instructions: 44stringfilenetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2E957

Part of subcall function 00B1C750: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1C76B

InternetOpenW.WININET ref: 00B2E993
_wcsstr.LIBCMT ref: 00B2E9FE
lstrcpyW.KERNEL32(?,?), ref: 00B2EB5A
lstrcatW.KERNEL32(?,005044D8), ref: 00B2EB8D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00B2EBA4
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00B2EBBF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B2EBDC
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B2EBF3
lstrlen.KERNEL32(?,00000000,00000000,000000FF), ref: 00B2EC1D
_strstr.LIBCMT ref: 00B2EC86
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B2ECA9
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B2ECC4
DeleteFileA.KERNEL32(?), ref: 00B2ECD2
lstrcpy.KERNEL32(?,?), ref: 00B2ECF4
lstrcpy.KERNEL32(?,?), ref: 00B2ED0A
lstrcpyW.KERNEL32(?,00000000), ref: 00B2EDAB
_malloc.LIBCMT ref: 00B2EDD6
_memset.LIBCMT ref: 00B2EDE4
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 00B2EDFE
lstrcpyW.KERNEL32(?,00000000), ref: 00B2EE06
_strstr.LIBCMT ref: 00B2EE2A
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B2EE50
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B2EE74
DeleteFileA.KERNEL32(?), ref: 00B2EE82

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$lstrcpy$Folder$AppendFileInternet$DeleteOpen_memset_strstr$ByteCharMultiReadWide_malloc_wcsstrlstrcatlstrlen
String ID:
API String ID: 2057544059-0
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: 9819a45da36cb21193f0aa1e2e8480b7138412838181907605dd22ce94f9b4d3
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 10019270448391ABDA70DF51AC45FDF7BD8AF42704F4448A9F98882182EB74D2488BA7

Function 0040CBA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __except_handler4
String ID:  $Error encrypting message: %s$\\n
API String ID: 2000125651-3771355929
Opcode ID: 8af1f58bede3706d82a36293f76a7596179a6936843eb3dd7d644c92f66f27d8
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 8af1f58bede3706d82a36293f76a7596179a6936843eb3dd7d644c92f66f27d8
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 4a44d4e655e45bd035bad35dd1e9204a6ebf9d5eaf034f13d90d823ef41036ab
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 4a44d4e655e45bd035bad35dd1e9204a6ebf9d5eaf034f13d90d823ef41036ab
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00B2A0C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2A108
_memset.LIBCMT ref: 00B2A119
_memset.LIBCMT ref: 00B2A12A

Strings

p2Q, xrefs: 00B2A132

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 4422eb67649e6e367c7b1ba19661232728aa0b342931760770d9b0ecc3e40ebf
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 1DF0C06C684750A5F7117B60BC27B817DD16731B04F104084E1142A2E6D3F9638C679D

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00B5F48E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00B5F4A1

Part of subcall function 00B40F4C: std::exception::_Copy_str.LIBCMT ref: 00B40F65

__CxxThrowException@8.LIBCMT ref: 00B5F4B6

Part of subcall function 00B4111A: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00B33DEC,?,0050793C,?,00000001), ref: 00B4116F

Strings

TeM, xrefs: 00B5F4AE
TeM, xrefs: 00B5F497, 00B5F4AB

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 757275642-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 4692ac59d951e0efb7eb5d5e023c3af715ceff2f5b7203a7ec04fdcc08be7ef2
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 42D06774C0020CBBCB00EFA4D49ACDDBBB8AB04344B0085A6AE14A7241EB74A34D9BD4

Function 00B756D0 Relevance: 6.4, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 00B75718
GetLastError.KERNEL32(?,?,00000000), ref: 00B75724
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00B75747
GetLastError.KERNEL32(?,?,00000000), ref: 00B75753
GetLastError.KERNEL32(004E2188,000000A9,?,00000000,?,?,00000000), ref: 00B75845

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ErrorLast$ByteCharMultiWide
String ID:
API String ID: 3361762293-0
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: c6a13b9c00585b9c98bd84b0d65b393a7df89b8e31a6faa04a2b8ffed40e6abf
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: B9516B71A40709BBEB306B618C43FBE76E8EB45701F2441A5FA09BB2C1DAA15D0186B2

Function 00B32380 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B323DE
__read_nolock.LIBCMT ref: 00B324AE
__filbuf.LIBCMT ref: 00B324D1
_memset.LIBCMT ref: 00B32515

Part of subcall function 00B35458: __getptd_noexit.LIBCMT ref: 00B35458

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 3da64b215307f03c70fe246c4fc5d30e5a137b27dcfd251b0be1a1e71087a3de
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1A51CE70A00309EFDF288FA9C88166EB7E1EF50320F3487A9F935962D1DB749E508B54

Function 00B4C8C7 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B4C8FD
__isleadbyte_l.LIBCMT ref: 00B4C92B
MultiByteToWideChar.KERNEL32(?,00000009,004FFCF0,?,00000000,00000000,?,00000000,00000000,?,0000007A,004FFCF0), ref: 00B4C959
MultiByteToWideChar.KERNEL32(?,00000009,004FFCF0,00000001,00000000,00000000,?,00000000,00000000,?,0000007A,004FFCF0), ref: 00B4C98F

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 527a80fb2f71b483e68bdc6028ac4ef80d89259711b32e504fc1e8981d38fc49
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 7531E131602246FFDB628E25C885B7A7FE9FF41B10F1541A9E854C71A0E731DA50E790

Function 00B1F330 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00B1F375
lstrlen.KERNEL32(?,?,00000000), ref: 00B1F3E8
WriteFile.KERNEL32(00000000,?,00000000), ref: 00B1F3F1
CloseHandle.KERNEL32(00000000), ref: 00B1F3F8

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 6fa0efbefe7eea776510d064255a35472247eaa80e389f55f5ebc0fb98bfdef3
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: C9313432900105EBDB149F68DC4ABFEBBB9EF04314F5081A8F916A76C0D7716A85CBE4

Function 00B1C750 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00B1C76B
PathAppendA.SHLWAPI(?,004FFDC4), ref: 00B1C789

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID:
API String ID: 29327785-0
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: 90a7dff75952f1b07c8ae11209c9238ea108dd4b0533586a4ab93692e24b1d37
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: A3110A72A8032833DD3071686C87FDB77DCDB46B21F5000E6FE0CE6182F6A65A4505E5

Function 00BD72E4 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00BD72FB

Part of subcall function 00BD79F0: ___BuildCatchObjectHelper.LIBCMT ref: 00BD7A22
Part of subcall function 00BD79F0: ___AdjustPointer.LIBCMT ref: 00BD7A39

_UnwindNestedFrames.LIBCMT ref: 00BD7312
___FrameUnwindToState.LIBCMT ref: 00BD7324
CallCatchBlock.LIBCMT ref: 00BD7348

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: ca1d52fe47eec1eb54d852d94b16723ceb246ba0431f99dbe5211ea94a218848
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 22012932000109BBCF226F55CC01EDABFBAFF48764F144056FD1866221E776E861EBA4

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 00B229F0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00B22A09
_malloc.LIBCMT ref: 00B22A13

Part of subcall function 00B30EB2: __FF_MSGBANNER.LIBCMT ref: 00B30EC9
Part of subcall function 00B30EB2: __NMSG_WRITE.LIBCMT ref: 00B30ED0
Part of subcall function 00B30EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B30EF5

_memset.LIBCMT ref: 00B22A1E
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 00B22A34

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 0776e890fc0b0bde547043e5c1520ce1e4e60bdd76246dea879990453aa7084d
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: 01F05C35701214BBE72067659C4BFBBB6DDEF86760F200175FA08E31C1E9A16D0142F5

Function 00B22A50 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 00B22A56
_malloc.LIBCMT ref: 00B22A64

Part of subcall function 00B30EB2: __FF_MSGBANNER.LIBCMT ref: 00B30EC9
Part of subcall function 00B30EB2: __NMSG_WRITE.LIBCMT ref: 00B30ED0
Part of subcall function 00B30EB2: RtlAllocateHeap.NTDLL(00510440,00000000,00000001), ref: 00B30EF5

_memset.LIBCMT ref: 00B22A6F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00B22A82

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: 93310ae35a00f2599d057cbd468c50c546d4362d37719265fa5093f99dbbba76
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: EBE08676701124BBF510235A6C8FFAB665CCFC27A1F200165F615D21D28AA05C0185B4

Function 0048BAD0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 265COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0048BB61

Strings

.\crypto\x509\x509_obj.c, xrefs: 0048BDB6
NO X509_NAME, xrefs: 0048BB5B

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: .\crypto\x509\x509_obj.c$NO X509_NAME
API String ID: 2961919466-14672339
Opcode ID: 4cc0e634c82776b8e6b8af14f13902336e58473581cafcfdb07a608ab0feec39
Instruction ID: 88de260af9a5fd1e3028375c42afa8bd5264b3a62bff26a3f98b123bcc4ba400
Opcode Fuzzy Hash: 4cc0e634c82776b8e6b8af14f13902336e58473581cafcfdb07a608ab0feec39
Instruction Fuzzy Hash: 2A91C1719083419FD721AF29C88175FB7E0EF85308F58486EF88597352D739E9058BDA

Function 0040C740 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 4241100979-54166481
Opcode ID: 0dc0c108755559449e400f96eda7fce006297efcbf55791017422bc814fc260c
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 0dc0c108755559449e400f96eda7fce006297efcbf55791017422bc814fc260c
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00480D00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

.\crypto\engine\eng_ctrl.c, xrefs: 00480D51, 00480D79, 00480D95, 00480DCE, 00480DEE, 00480E35, 00480E6D, 00480E90
C:\Build-OpenSSL-VC-32/lib/engines, xrefs: 00480D1D

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\engine\eng_ctrl.c$C:\Build-OpenSSL-VC-32/lib/engines
API String ID: 0-1539679004
Opcode ID: e15262ba6dfe6b912e9122ad7db7f925754a259673c029d2ef663e9602d74825
Instruction ID: 56032b303ab72e22bbded8e9c3d747b3a31bfef0a87394d47780a94f2346a1d3
Opcode Fuzzy Hash: e15262ba6dfe6b912e9122ad7db7f925754a259673c029d2ef663e9602d74825
Instruction Fuzzy Hash: 3341B571BD431035F6A07059AC43FBF21845B90F19F150C6BFB45B91C2E6DEA94A82AE

Function 004C5D39 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: __get_sys_err_msg
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3595405529-798102604
Opcode ID: 2e3f0f1f4edf6c5a3c4510c8aaaca1f8a4a57933e5579e97063164282e05505c
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 2e3f0f1f4edf6c5a3c4510c8aaaca1f8a4a57933e5579e97063164282e05505c
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00B73240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00B732CE
_memset.LIBCMT ref: 00B732FB

Strings

Enter PEM pass phrase:, xrefs: 00B73286, 00B73293, 00B732D4

Memory Dump Source

Source File: 00000022.00000002.1707429098.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b10000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: Enter PEM pass phrase:
API String ID: 3021507156-3278253880
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 2ca3f5a7c9a9772446dbca79a8d9b7874fe6fc9a4a8db6226bbaeadf245548e9
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 6921AA72A443113BE720A9256C42F6BB7DDDFC1B98F148494FA68A71C2E722DD0582A5

Function 0040C500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000022.00000002.1706775449.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000022.00000002.1706775449.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000022.00000002.1706775449.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_400000_Q3FGHfhdgU.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 4241100979-54166481
Opcode ID: 5b2242606d7255293268a03623ac74f4226f4a23220726dab8e31c692a174a31
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: 5b2242606d7255293268a03623ac74f4226f4a23220726dab8e31c692a174a31
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Q3FGHfhdgU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_02f2c633-3ce4-432b-8fb4-3ffe61a05738\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_19242484-c679-4941-bd57-6f540315428c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_30a2ab8c-d918-47d4-8a43-671b7fcd7b6b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_4e0c2355-3855-4b4a-9d8f-c6d24df75a1b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_7aa84280-98f8-4204-b896-7b202f24dfe8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_b5f6b7f5-c7b1-44db-b69a-18a9f6699eb2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_d7d87454-2c28-4c87-8a7c-eef37b0e9881\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_dc0c2af4-fe16-4f50-ad76-b6d351fd9326\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_de81b23c-3575-47ea-a8e0-d928bba5b47a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_f2732550-b3d4-4bd2-9f08-b4855e598aa6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_767614618ed77d56ba8f2ff71bfae8c6612f432_97d000f2_f694fe59-d6b9-4d2c-9202-235148b2c192\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Q3FGHfhdgU.exe_abc183f5c9bbaf76adf7519168d8724fae4473b_97d000f2_9eab30f4-355b-49f2-aced-cd99cfeb16e1\Report.wer

Windows Analysis Report
Q3FGHfhdgU.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre